24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 3a:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4ac,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample aeebcd8c8b15… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample aeebcd8c8b15…. Malware family: Trojan.Generic. Threat score 100/100. 12/27 AV engines flagged this file. 1 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/aeebcd8c8b15645d7e71b68ac05e21e9a4c94f832c64044725d870b87b9573c7","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","aeebcd8c8b15645d7e71b68ac05e21e9a4c94f832c64044725d870b87b9573c7"],"about":{"@type":"SoftwareApplication","name":"28978E987BC59E75CA22562924EAB93355CF679E","applicationCategory":["pedll","64bits","executable"],"identifier":"aeebcd8c8b15645d7e71b68ac05e21e9a4c94f832c64044725d870b87b9573c7","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":12,"total":27},"behavioralIndicators":{"malicious":1,"suspicious":12},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T6ee,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00004740.00000000.113627.81594000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004740.00000000.113627.81594000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004740.00000000.113627.81594000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp")26:T9db,"regsvr32.exe" queried SystemProcessInformation at 00000000-00004740-00000C15-769065612 [PID: 4740] "regsvr32.exe" queried SystemProcessInformation at 00000000-00004740-00000C15-769074722 [PID: 4740] "regsvr32.exe" queried SystemProcessInformation at 00000000-00004740-00000C15-769761869 [PID: 4740] "regsvr32.exe" queried SystemProcessInformation at 00000000-00004740-00000C15-769777733 [PID: 4740] "rundll32.exe" queried SystemProcessInformation at 00000000-00005420-00000C15-769201504 [PID: 5420] "rundll32.exe" queried SystemProcessInformation at 00000000-00005420-00000C15-769210144 [PID: 5420] "rundll32.exe" queried SystemProcessInformation at 00000000-00005420-00000C15-769874668 [PID: 5420] "rundll32.exe" queried SystemProcessInformation at 00000000-00005420-00000C15-769903063 [PID: 5420] "rundll32.exe" queried SystemProcessInformation at 00000000-00008188-00000C15-768961740 [PID: 8188] "rundll32.exe" queried SystemProcessInformation at 00000000-00008188-00000C15-768993960 [PID: 8188] "rundll32.exe" queried SystemProcessInformation at 00000000-00008188-00000C15-769573495 [PID: 8188] "rundll32.exe" queried SystemProcessInformation at 00000000-00008188-00000C15-769582356 [PID: 8188] "rundll32.exe" queried SystemProcessInformation at 00000000-00007356-00000C15-768819087 [PID: 7356] "rundll32.exe" queried SystemProcessInformation at 00000000-00007356-00000C15-768836395 [PID: 7356] "rundll32.exe" queried SystemProcessInformation at 00000000-00007356-00000C15-769464328 [PID: 7356] "rundll32.exe" queried SystemProcessInformation at 00000000-00007356-00000C15-769500617 [PID: 7356] "rundll32.exe" queried SystemProcessInformation at 00000000-00006916-00000C15-774152336 [PID: 6916] "rundll32.exe" queried SystemProcessInformation at 00000000-00006916-00000C15-774211880 [PID: 6916] "rundll32.exe" queried SystemProcessInformation at 00000000-00006916-00000C15-774987289 [PID: 6916] "rundll32.exe" queried SystemProcessInformation at 00000000-00006916-00000C15-775022659 [PID: 6916] "rundll32.exe" queried SystemProcessInformation at 00000000-00007188-00000C15-773819442 [PID: 7188] "rundll32.exe" queried SystemProcessInformation at 00000000-00007188-00000C15-773847540 [PID: 7188] "rundll32.exe" queried SystemProcessInformation at 00000000-00007188-00000C15-774371279 [PID: 7188] "rundll32.exe" queried SystemProcessInformation at 00000000-00007188-00000C15-774379411 [PID: 7188] "rundll32.exe" queried SystemProcessInformation at 00000000-00007344-00000C15-774130562 [PID: 7344]27:T1f9e,Assembly shows XOR instruction xor rax rsp in Stream UID: 55305-2380-000000018001C120 Assembly shows XOR instruction xor eax esp in Stream UID: 55305-2380-000000018001C120 Assembly shows XOR instruction xor rcx rsp in Stream UID: 55305-2380-000000018001C120 Assembly shows XOR instruction xor ecx esp in Stream UID: 55305-2380-000000018001C120 Assembly shows XOR instruction xor rax rsp in Stream UID: 55305-2381-000000018001BF90 Assembly shows XOR instruction xor eax esp in Stream UID: 55305-2381-000000018001BF90 Assembly shows XOR instruction xor rcx rsp in Stream UID: 55305-2381-000000018001BF90 Assembly shows XOR instruction xor ecx esp in Stream UID: 55305-2381-000000018001BF90 Assembly shows XOR instruction xor rax rsp in Stream UID: 55305-2387-000000018001BAE0 Assembly shows XOR instruction xor eax esp in Stream UID: 55305-2387-000000018001BAE0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 55305-2387-000000018001BAE0 Assembly shows XOR instruction xor ecx esp in Stream UID: 55305-2387-000000018001BAE0 Assembly shows XOR instruction xor rax rsp in Stream UID: 55305-2401-000000018001B6D0 Assembly shows XOR instruction xor eax esp in Stream UID: 55305-2401-000000018001B6D0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 55305-2401-000000018001B6D0 Assembly shows XOR instruction xor ecx esp in Stream UID: 55305-2401-000000018001B6D0 Assembly shows XOR instruction xor rax rsp in Stream UID: 55305-2406-000000018001B500 Assembly shows XOR instruction xor eax esp in Stream UID: 55305-2406-000000018001B500 Assembly shows XOR instruction xor rcx rsp in Stream UID: 55305-2406-000000018001B500 Assembly shows XOR instruction xor ecx esp in Stream UID: 55305-2406-000000018001B500 Assembly shows XOR instruction xor rax rsp in Stream UID: 55305-2407-000000018001B450 Assembly shows XOR instruction xor eax esp in Stream UID: 55305-2407-000000018001B450 Assembly shows XOR instruction xor rcx rsp in Stream UID: 55305-2407-000000018001B450 Assembly shows XOR instruction xor ecx esp in Stream UID: 55305-2407-000000018001B450 Assembly shows XOR instruction xor rax rsp in Stream UID: 55305-2411-000000018001B2F0 Assembly shows XOR instruction xor eax esp in Stream UID: 55305-2411-000000018001B2F0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 55305-2411-000000018001B2F0 Assembly shows XOR instruction xor ecx esp in Stream UID: 55305-2411-000000018001B2F0 Assembly shows XOR instruction xor rax rsp in Stream UID: 55305-2414-000000018001B1A0 Assembly shows XOR instruction xor eax esp in Stream UID: 55305-2414-000000018001B1A0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 55305-2414-000000018001B1A0 Assembly shows XOR instruction xor ecx esp in Stream UID: 55305-2414-000000018001B1A0 Assembly shows XOR instruction xor rax rsp in Stream UID: 55305-2434-000000018001A640 Assembly shows XOR instruction xor eax esp in Stream UID: 55305-2434-000000018001A640 Assembly shows XOR instruction xor rcx rsp in Stream UID: 55305-2434-000000018001A640 Assembly shows XOR instruction xor ecx esp in Stream UID: 55305-2434-000000018001A640 Assembly shows XOR instruction xor rax rsp in Stream UID: 55305-2462-0000000180017250 Assembly shows XOR instruction xor eax esp in Stream UID: 55305-2462-0000000180017250 Assembly shows XOR instruction xor rcx rsp in Stream UID: 55305-2462-0000000180017250 Assembly shows XOR instruction xor ecx esp in Stream UID: 55305-2462-0000000180017250 Assembly shows XOR instruction xor rax rsp in Stream UID: 55305-2602-000000018000F780 Assembly shows XOR instruction xor eax esp in Stream UID: 55305-2602-000000018000F780 Assembly shows XOR instruction xor rcx rsp in Stream UID: 55305-2602-000000018000F780 Assembly shows XOR instruction xor ecx esp in Stream UID: 55305-2602-000000018000F780 Assembly shows XOR instruction xor rax rsp in Stream UID: 55305-2616-000000018000CE00 Assembly shows XOR instruction xor eax esp in Stream UID: 55305-2616-000000018000CE00 Assembly shows XOR instruction xor rcx rsp in Stream UID: 55305-2616-000000018000CE00 Assembly shows XOR instruction xor ecx esp in Stream UID: 55305-2616-000000018000CE00 Assembly shows XOR instruction xor rax rsp in Stream UID: 55305-2638-0000000180009AA0 Assembly shows XOR instruction xor eax esp in Stream UID: 55305-2638-0000000180009AA0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 55305-2638-0000000180009AA0 Assembly shows XOR instruction xor ecx esp in Stream UID: 55305-2638-0000000180009AA0 Assembly shows XOR instruction xor rax rsp in Stream UID: 55305-2648-0000000180008740 Assembly shows XOR instruction xor eax esp in Stream UID: 55305-2648-0000000180008740 Assembly shows XOR instruction xor rcx rsp in Stream UID: 55305-2648-0000000180008740 Assembly shows XOR instruction xor ecx esp in Stream UID: 55305-2648-0000000180008740 Assembly shows XOR instruction xor rax rsp in Stream UID: 55305-2650-00000001800092A0 Assembly shows XOR instruction xor eax esp in Stream UID: 55305-2650-00000001800092A0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 55305-2650-00000001800092A0 Assembly shows XOR instruction xor ecx esp in Stream UID: 55305-2650-00000001800092A0 Assembly shows XOR instruction xor rax rsp in Stream UID: 55305-2651-00000001800091F0 Assembly shows XOR instruction xor eax esp in Stream UID: 55305-2651-00000001800091F0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 55305-2651-00000001800091F0 Assembly shows XOR instruction xor ecx esp in Stream UID: 55305-2651-00000001800091F0 Assembly shows XOR instruction xor rax rsp in Stream UID: 55305-2652-0000000180008FC0 Assembly shows XOR instruction xor eax esp in Stream UID: 55305-2652-0000000180008FC0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 55305-2652-0000000180008FC0 Assembly shows XOR instruction xor ecx esp in Stream UID: 55305-2652-0000000180008FC0 Assembly shows XOR instruction xor rax rsp in Stream UID: 55305-2660-0000000180008080 Assembly shows XOR instruction xor eax esp in Stream UID: 55305-2660-0000000180008080 Assembly shows XOR instruction xor rcx rsp in Stream UID: 55305-2660-0000000180008080 Assembly shows XOR instruction xor ecx esp in Stream UID: 55305-2660-0000000180008080 Assembly shows XOR instruction xor rax rsp in Stream UID: 55305-2703-0000000180004F20 Assembly shows XOR instruction xor eax esp in Stream UID: 55305-2703-0000000180004F20 Assembly shows XOR instruction xor rcx rsp in Stream UID: 55305-2703-0000000180004F20 Assembly shows XOR instruction xor ecx esp in Stream UID: 55305-2703-0000000180004F20 Assembly shows XOR instruction xor rax rsp in Stream UID: 55305-2704-0000000180004AF0 Assembly shows XOR instruction xor eax esp in Stream UID: 55305-2704-0000000180004AF0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 55305-2704-0000000180004AF0 Assembly shows XOR instruction xor ecx esp in Stream UID: 55305-2704-0000000180004AF0 Assembly shows XOR instruction xor ecx edx in Stream UID: 55305-2763-0000000180007590 Assembly shows XOR instruction xor eax edx in Stream UID: 55305-2763-0000000180007590 Assembly shows XOR instruction xor rcx rsp in Stream UID: 55305-2813-00000001800086A6 Assembly shows XOR instruction xor ecx esp in Stream UID: 55305-2813-00000001800086A6 Assembly shows XOR instruction xor rcx rsp in Stream UID: 55305-2844-00000001800095A1 Assembly shows XOR instruction xor ecx esp in Stream UID: 55305-2844-00000001800095A1 Assembly shows XOR instruction xor rax rsp in Stream UID: 55305-2928-000000018000CB72 Assembly shows XOR instruction xor eax esp in Stream UID: 55305-2928-000000018000CB72 Assembly shows XOR instruction xor rcx rsp in Stream UID: 55305-2928-000000018000CB72 Assembly shows XOR instruction xor ecx esp in Stream UID: 55305-2928-000000018000CB72 Assembly shows XOR instruction xor rcx rsp in Stream UID: 55305-2942-000000018000D8D8 Assembly shows XOR instruction xor ecx esp in Stream UID: 55305-2942-000000018000D8D828:T13be,"regsvr32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004740) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005420) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008188) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007356) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006916) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007188) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007344) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000372)29:Td1e,"regsvr32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004740) "regsvr32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004740) "regsvr32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004740) "regsvr32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004740) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005420) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005420) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005420) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005420) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008188) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008188) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008188) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008188) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007356) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007356) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007356) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007356) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006916) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006916) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006916) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006916) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007188) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007188) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007188) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007188) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007344) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007344) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007344) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007344) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000372) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000372) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000372) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000372)2a:T96e6,"regsvr32.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004740) "regsvr32.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004740) "regsvr32.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004740) "regsvr32.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004740) "regsvr32.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004740) "regsvr32.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004740) "regsvr32.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004740) "regsvr32.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004740) "regsvr32.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004740) "regsvr32.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004740) "regsvr32.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004740) "regsvr32.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004740) "regsvr32.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004740) "regsvr32.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004740) "regsvr32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004740) "regsvr32.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004740) "regsvr32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004740) "regsvr32.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004740) "regsvr32.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004740) "regsvr32.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004740) "regsvr32.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004740) "regsvr32.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004740) "regsvr32.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004740) "regsvr32.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004740) "regsvr32.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004740) "regsvr32.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004740) "regsvr32.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004740) "regsvr32.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004740) "regsvr32.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004740) "regsvr32.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004740) "regsvr32.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004740) "regsvr32.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004740) "regsvr32.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004740) "regsvr32.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004740) "regsvr32.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004740) "regsvr32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004740) "regsvr32.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004740) "regsvr32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004740) "regsvr32.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004740) "regsvr32.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004740) "regsvr32.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004740) "regsvr32.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004740) "regsvr32.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004740) "regsvr32.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004740) "regsvr32.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004740) "regsvr32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00004740) "regsvr32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00004740) "rundll32.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005420) "rundll32.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005420) "rundll32.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005420) "rundll32.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005420) "rundll32.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005420) "rundll32.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005420) "rundll32.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005420) "rundll32.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005420) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005420) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005420) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005420) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005420) "rundll32.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005420) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005420) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005420) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005420) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005420) "rundll32.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005420) "rundll32.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005420) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005420) "rundll32.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005420) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005420) "rundll32.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005420) "rundll32.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005420) "rundll32.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005420) "rundll32.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005420) "rundll32.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005420) "rundll32.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005420) "rundll32.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005420) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005420) "rundll32.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005420) "rundll32.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005420) "rundll32.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005420) "rundll32.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005420) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005420) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005420) "rundll32.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005420) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005420) "rundll32.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005420) "rundll32.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005420) "rundll32.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005420) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005420) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005420) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005420) "rundll32.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005420) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00005420) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00005420) "rundll32.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00008188) "rundll32.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00008188) "rundll32.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00008188) "rundll32.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00008188) "rundll32.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00008188) "rundll32.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00008188) "rundll32.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00008188) "rundll32.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00008188) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00008188) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00008188) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00008188) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00008188) "rundll32.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00008188) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00008188) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00008188) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00008188) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00008188) "rundll32.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00008188) "rundll32.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00008188) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00008188) "rundll32.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00008188) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00008188) "rundll32.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00008188) "rundll32.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00008188) "rundll32.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00008188) "rundll32.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00008188) "rundll32.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00008188) "rundll32.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00008188) "rundll32.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00008188) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00008188) "rundll32.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00008188) "rundll32.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00008188) "rundll32.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00008188) "rundll32.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00008188) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00008188) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00008188) "rundll32.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00008188) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00008188) "rundll32.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00008188) "rundll32.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00008188) "rundll32.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00008188) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00008188) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00008188) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00008188) "rundll32.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00008188) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00008188) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00008188) "rundll32.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007356) "rundll32.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007356) "rundll32.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007356) "rundll32.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007356) "rundll32.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007356) "rundll32.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007356) "rundll32.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007356) "rundll32.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007356) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007356) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007356) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007356) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007356) "rundll32.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007356) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007356) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007356) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007356) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007356) "rundll32.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007356) "rundll32.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007356) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007356) "rundll32.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007356) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007356) "rundll32.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007356) "rundll32.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007356) "rundll32.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007356) "rundll32.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007356) "rundll32.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007356) "rundll32.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007356) "rundll32.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007356) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007356) "rundll32.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007356) "rundll32.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007356) "rundll32.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007356) "rundll32.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007356) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007356) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007356) "rundll32.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007356) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007356) "rundll32.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007356) "rundll32.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007356) "rundll32.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007356) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007356) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007356) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007356) "rundll32.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007356) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00007356) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007356) "rundll32.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006916) "rundll32.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006916) "rundll32.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006916) "rundll32.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006916) "rundll32.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006916) "rundll32.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006916) "rundll32.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006916) "rundll32.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006916) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006916) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006916) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006916) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006916) "rundll32.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006916) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006916) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006916) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006916) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006916) "rundll32.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006916) "rundll32.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006916) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006916) "rundll32.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006916) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006916) "rundll32.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006916) "rundll32.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006916) "rundll32.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006916) "rundll32.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006916) "rundll32.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006916) "rundll32.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006916) "rundll32.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006916) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006916) "rundll32.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006916) "rundll32.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006916) "rundll32.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006916) "rundll32.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006916) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006916) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006916) "rundll32.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006916) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006916) "rundll32.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006916) "rundll32.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006916) "rundll32.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006916) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006916) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006916) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006916) "rundll32.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006916) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00006916) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00006916) "rundll32.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007188) "rundll32.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007188) "rundll32.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007188) "rundll32.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007188) "rundll32.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007188) "rundll32.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007188) "rundll32.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007188) "rundll32.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007188) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007188) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007188) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007188) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007188) "rundll32.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007188) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007188) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007188) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007188) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007188) "rundll32.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007188) "rundll32.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007188) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007188) "rundll32.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007188) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007188) "rundll32.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007188) "rundll32.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007188) "rundll32.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007188) "rundll32.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007188) "rundll32.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007188) "rundll32.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007188) "rundll32.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007188) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007188) "rundll32.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007188) "rundll32.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007188) "rundll32.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007188) "rundll32.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007188) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007188) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007188) "rundll32.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007188) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007188) "rundll32.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007188) "rundll32.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007188) "rundll32.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007188) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007188) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007188) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007188) "rundll32.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007188) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00007188) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007188) "rundll32.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007344) "rundll32.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007344) "rundll32.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007344) "rundll32.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007344) "rundll32.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007344) "rundll32.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007344) "rundll32.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007344) "rundll32.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007344) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007344) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007344) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007344) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007344) "rundll32.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007344) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007344) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007344) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007344) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007344) "rundll32.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007344) "rundll32.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007344) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007344) "rundll32.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007344) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007344) "rundll32.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007344) "rundll32.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007344) "rundll32.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007344) "rundll32.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007344) "rundll32.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007344) "rundll32.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007344) "rundll32.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007344) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007344) "rundll32.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007344) "rundll32.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007344) "rundll32.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007344) "rundll32.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007344) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007344) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007344) "rundll32.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007344) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007344) "rundll32.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007344) "rundll32.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007344) "rundll32.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007344) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007344) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007344) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007344) "rundll32.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007344) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00007344) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007344) "rundll32.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00000372) "rundll32.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00000372) "rundll32.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00000372) "rundll32.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000372) "rundll32.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00000372) "rundll32.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00000372) "rundll32.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00000372) "rundll32.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00000372) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00000372) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00000372) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00000372) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00000372) "rundll32.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00000372) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00000372) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00000372) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00000372) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00000372) "rundll32.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00000372) "rundll32.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00000372) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00000372) "rundll32.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00000372) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00000372) "rundll32.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00000372) "rundll32.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00000372) "rundll32.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00000372) "rundll32.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00000372) "rundll32.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00000372) "rundll32.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00000372) "rundll32.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00000372) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00000372) "rundll32.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00000372) "rundll32.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00000372) "rundll32.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00000372) "rundll32.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00000372) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00000372) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00000372) "rundll32.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00000372) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00000372) "rundll32.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00000372) "rundll32.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00000372) "rundll32.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00000372) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00000372) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00000372) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00000372) "rundll32.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00000372) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00000372) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00000372)2b:T9a6c,Found reference to API (Indicator: "RegEnumKeyExW"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "RegDeleteKeyW"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "RegSetValueExW"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "RegCreateKeyExW"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "RegDeleteValueW"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "RegQueryValueExW"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "IsTextUnicode"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "RegOpenKeyExW"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "RegCloseKey"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "GetDeviceCaps"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "GetStockObject"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "DeleteObject"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "CreateCompatibleDC"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "CreateSolidBrush"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "DeleteDC"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "SelectObject"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "TlsFree"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "WriteConsoleW"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "GetOEMCP"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "GetCurrentThread"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "ReadFile"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "SetLastError"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "RtlPcToFileHeader"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "WriteFile"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "SetEndOfFile"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "MultiByteToWideChar"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "GetProcessHeap"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "SetConsoleCtrlHandler"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "GetTimeFormatW"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "GetCurrentProcessId"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "IsValidLocale"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "FindFirstFileExW"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "CreateFileMappingW"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "LocalAlloc"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "RaiseException"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "DeleteCriticalSection"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "GetModuleHandleExW"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "LoadLibraryExW"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "ExitProcess"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "FlushFileBuffers"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "HeapAlloc"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "HeapSize"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "GetStdHandle"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "TerminateProcess"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "EnumSystemLocalesW"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "GetACP"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "TlsAlloc"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "RtlVirtualUnwind"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "RtlUnwind"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "GetCurrentProcess"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "FreeLibrary"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "RtlCaptureContext"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "IsDebuggerPresent"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "InterlockedFlushSList"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "LocalFree"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "LeaveCriticalSection"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "GetCommandLineW"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "GetCurrentThreadId"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "IsValidCodePage"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "TlsSetValue"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "InitializeSListHead"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "TlsGetValue"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "GetCommandLineA"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "ReadConsoleW"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "GetCPInfo"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "GetUserDefaultLCID"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "FindNextFileW"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "GetFileSizeEx"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "CloseHandle"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "GetFileSize"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "CompareStringOrdinal"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "MapViewOfFile"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "GetDateFormatW"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "EnterCriticalSection"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "CreateFileA"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "RtlLookupFunctionEntry"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "GetModuleHandleW"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "InterlockedPushEntrySList"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "SetEnvironmentVariableW"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "SetFilePointerEx"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "LCMapStringW"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "GetConsoleMode"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "GetProcAddress"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "GetLocaleInfoW"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "GetStringTypeExW"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "MulDiv"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "GetLastError"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "FindClose"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "HeapReAlloc"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "GetFileType"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "HeapFree"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "OutputDebugStringW"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "WideCharToMultiByte"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "SetFilePointer"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "UnmapViewOfFile"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "GetModuleFileNameW"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "GetStringTypeW"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "EncodePointer"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "GetStartupInfoW"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "SetStdHandle"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "CompareStringW"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "CreateFileW"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "LoadLibraryA"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "SysAllocStringLen"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "SysStringLen"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "SysFreeString"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "SysAllocString"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "LoadCursorW"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "DrawFrameControl"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "GetClientRect"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "FillRect"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "SetTimer"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "SetCapture"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "ShowWindow"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "ReleaseCapture"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "SystemParametersInfoW"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "GetSystemMetrics"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "GetCursorPos"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "UpdateLayeredWindow"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "MapWindowPoints"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "BeginPaint"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "DefWindowProcW"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "GetKeyState"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "GetWindowRect"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "GetKeyboardState"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "OffsetRect"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "UnregisterClassW"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "GetDC"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "SetCursor"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "IsWindowVisible"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "PtInRect"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "EnableWindow"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "SetWindowPos"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "InvalidateRect"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "LoadStringW"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "DestroyWindow"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "ReleaseDC"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "RegisterClassW"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "IsWindow"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "IsWindowEnabled"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "KillTimer"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "CreateWindowExW"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "GetSysColor"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "GetWindowDC"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "LoadImageW"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "GetSysColorBrush"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "MoveWindow"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "CoCreateInstance"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "FlsAlloc"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "FlsFree"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "FlsGetValue"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "FlsSetValue"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "InitializeCriticalSectionEx"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "AreFileApisANSI"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "CompareStringEx"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "EnumSystemLocalesEx"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "GetActiveWindow"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "GetDateFormatEx"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "GetEnabledXStateFeatures"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "GetLastActivePopup"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "GetLocaleInfoEx"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "GetProcessWindowStation"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "GetTimeFormatEx"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "GetUserDefaultLocaleName"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "GetUserObjectInformationW"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "GetXStateFeaturesMask"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "IsValidLocaleName"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "LCMapStringEx"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "LCIDToLocaleName"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "LocaleNameToLCID"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "LocateXStateFeature"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "MessageBoxA"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "MessageBoxW"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "SetThreadStackGuarantee"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API (Indicator: "OleUninitialize"; Source: "00000000-00004740.00000000.113627.81594000.00000002.mdmp") Found reference to API (Indicator: "OleInitialize"; Source: "00000000-00004740.00000000.113627.81594000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00004740.00000000.113627.81594000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00004740.00000000.113627.81594000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00004740.00000000.113627.81594000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00004740.00000000.113627.81594000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00004740.00000000.113627.81594000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00004740.00000000.113627.81594000.00000002.mdmp") Found reference to API (Indicator: "CharNextW"; Source: "00000000-00004740.00000000.113627.81594000.00000002.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00004740.00000000.113627.81594000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00004740.00000000.113627.81594000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00004740.00000000.113627.81594000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00004740.00000000.113627.81594000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00004740.00000000.113627.81594000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00004740.00000000.113627.81594000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00004740.00000000.113627.81594000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00004740.00000000.113627.81594000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00004740.00000000.113627.81594000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00004740.00000000.113627.81594000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00004740.00000000.113627.81594000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00004740.00000000.113627.81594000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00004740.00000000.113627.81594000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00004740.00000000.113627.81594000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00004740.00000000.113627.81594000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00004740.00000000.113627.81594000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00004740.00000000.113627.81594000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00004740.00000000.113627.81594000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00004740.00000000.113627.81594000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00004740.00000000.113627.81594000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004740.00000000.113627.81594000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00004740.00000000.113627.81594000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004740.00000000.113627.81594000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00004740.00000000.113627.81594000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00004740.00000000.113627.81594000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00004740.00000000.113627.81594000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00004740.00000000.113627.81594000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00004740.00000000.113627.81594000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00004740.00000000.113627.81594000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00004740.00000000.113627.81594000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00004740.00000000.113627.81594000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00004740.00000000.113627.81594000.00000002.mdmp") Found reference to API (Indicator: "lstrlenW"; Source: "00000000-00004740.00000000.113627.81594000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00004740.00000000.113627.81594000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpW"; Source: "00000000-00004740.00000000.113627.81594000.00000002.mdmp") Found reference to API (Indicator: "Wow64EnableWow64FsRedirection"; Source: "00000000-00004740.00000000.113627.81594000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process2"; Source: "00000000-00004740.00000000.113627.81594000.00000002.mdmp") Found reference to API (Indicator: "GetSystemWow64Directory2W"; Source: "00000000-00004740.00000000.113627.81594000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00004740.00000000.113627.81594000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00004740.00000000.113627.81594000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00004740.00000000.113627.81594000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00004740.00000000.113627.81594000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00004740.00000000.113627.81594000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00004740.00000000.113627.81594000.00000002.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00004740.00000000.113627.81594000.00000002.mdmp") Found reference to API (Indicator: "VirtualQuery"; Source: "00000000-00004740.00000000.113627.81594000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00004740.00000000.113627.81594000.00000002.mdmp") Found reference to API (Indicator: "CryptEncrypt"; Source: "00000000-00006916.00000000.113959.A13C0000.00000004.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "RtlDllShutdownInProgress"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "LoadIconW"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "TranslateMessage"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageW"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "RegisterClassW"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "DestroyWindow"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "CreateWindowExW"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "GetWindow"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "DefWindowProcW"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "LoadCursorW"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process2"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "CreateSemaphoreExW"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSemaphore"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "GetSystemWow64Directory2W"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeSecurity"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "AttachConsole"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringW"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "OpenSemaphoreW"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockShared"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "FreeConsole"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexExW"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockShared"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "CLSIDFromString"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "DebugBreak"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "CharNextW"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "Wow64EnableWow64FsRedirection"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "CreateActCtxW"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "ActivateActCtx"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "DeactivateActCtx"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "ReleaseActCtx"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "QueryActCtxW"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "PathIsRelativeW"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "NtQuerySystemInformation"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "RtlImageNtHeader"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "NtQueryInformationToken"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "NtOpenProcessToken"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "NtClose"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API (Indicator: "DelayLoadFailureHook"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp")2c:T6e5,"regsvr32.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffd57dd0000 "regsvr32.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffd57dd0000 "regsvr32.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffd57dd0000 "regsvr32.exe" loaded module "KERNEL32" at base 7ffd5b7c0000 "regsvr32.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffd2b4a0000 "regsvr32.exe" loaded module "EXT-MS-WIN-COM-OLE32-L1-1-0.DLL" at base 7ffd58ec0000 "regsvr32.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffd56260000 "regsvr32.exe" loaded module "C:\28978E987BC59E75CA22562924EAB93355CF679E.DLL" at base 51d0000 "regsvr32.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 7ffd591a0000 "rundll32.exe" loaded module "KERNEL32" at base 7ffd5b7c0000 "rundll32.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ffd57dd0000 "rundll32.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ffd57dd0000 "rundll32.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ffd57dd0000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7ffd5b870000 "rundll32.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffd57dd0000 "rundll32.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffd57dd0000 "rundll32.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffd57dd0000 "rundll32.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffd2b4a0000 "rundll32.exe" loaded module "C:\28978E987BC59E75CA22562924EAB93355CF679E.DLL" at base 7ffd29720000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffd56260000 "rundll32.exe" loaded module "C:\28978E987BC59E75CA22562924EAB93355CF679E.DLL" at base 7ffd29bb00002d:T69d,"regsvr32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "regsvr32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "regsvr32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "regsvr32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "regsvr32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "regsvr32.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "regsvr32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "regsvr32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "regsvr32.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "") "regsvr32.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "regsvr32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "regsvr32.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "regsvr32.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "") "regsvr32.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: ""; Value: "")2e:Tb35,"regsvr32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "regsvr32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "regsvr32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "regsvr32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "regsvr32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "regsvr32.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "regsvr32.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "regsvr32.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "regsvr32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "regsvr32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "regsvr32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "regsvr32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "regsvr32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "regsvr32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "regsvr32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "AGGRESSIVEMTATESTING"; Value: "") "regsvr32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "regsvr32.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "ENABLEPERPROCESSSYSTEMDPI"; Value: "") "regsvr32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "REGSVR32"; Value: "") "regsvr32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "regsvr32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "regsvr32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "")2f:T674,Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "28978E987BC59E75CA22562924EAB93355CF679E") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00004740.00000000.113627.81594000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00004740.00000000.113627.81594000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004740.00000000.113627.81594000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00007188.00000000.113956.47468000.00000002.mdmp")30:T50e,Found string "\Device\HarddiskVolume2\Windows\System32\rundll32.exe" (Indicator: "\Device\"; Source: "00000000-00000372.00000000.113962.C8BB0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\regsvr32.exe" (Indicator: "\Device\"; Source: "00000000-00004740.00000000.113627.03400000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\rundll32.exe" (Indicator: "\Device\"; Source: "00000000-00005420.00000000.113623.56BE0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\rundll32.exe" (Indicator: "\Device\"; Source: "00000000-00006916.00000000.113959.A13C0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\rundll32.exe" (Indicator: "\Device\"; Source: "00000000-00007188.00000000.113956.961A0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\rundll32.exe" (Indicator: "\Device\"; Source: "00000000-00007344.00000000.113959.983D0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\rundll32.exe" (Indicator: "\Device\"; Source: "00000000-00007356.00000000.113625.BDA70000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\rundll32.exe" (Indicator: "\Device\"; Source: "00000000-00008188.00000000.113624.5C620000.00000004.mdmp")31:T975,"regsvr32.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{D2291A80-84D8-4641-9AB2-BDD1472C846B}"; Key: "(DEFAULT)"; Value: "Sample IME"), "regsvr32.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{D2291A80-84D8-4641-9AB2-BDD1472C846B}\INPROCSERVER32"; Key: "(DEFAULT)"; Value: "%WINDIR%\System32\regsvr32.exe"), "regsvr32.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{D2291A80-84D8-4641-9AB2-BDD1472C846B}\INPROCSERVER32"; Key: "THREADINGMODEL"; Value: "Apartment"), "regsvr32.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CTF\TIP\{D2291A80-84D8-4641-9AB2-BDD1472C846B}\LANGUAGEPROFILE\0X00000804\{83955C0E-2C09-47A5-BCF3-F2B98E11EE8B}"; Key: "DESCRIPTION"; Value: "Sample IME"), "regsvr32.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CTF\TIP\{D2291A80-84D8-4641-9AB2-BDD1472C846B}\LANGUAGEPROFILE\0X00000804\{83955C0E-2C09-47A5-BCF3-F2B98E11EE8B}"; Key: "ICONFILE"; Value: "%WINDIR%\System32\regsvr32.exe"), "regsvr32.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CTF\TIP\{D2291A80-84D8-4641-9AB2-BDD1472C846B}\LANGUAGEPROFILE\0X00000804\{83955C0E-2C09-47A5-BCF3-F2B98E11EE8B}"; Key: "ICONINDEX"; Value: "F4FFFFFF00"), "regsvr32.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CTF\TIP\{D2291A80-84D8-4641-9AB2-BDD1472C846B}\LANGUAGEPROFILE\0X00000804\{83955C0E-2C09-47A5-BCF3-F2B98E11EE8B}"; Key: "ENABLE"; Value: "0100000000"), "regsvr32.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CTF\TIP\{D2291A80-84D8-4641-9AB2-BDD1472C846B}\LANGUAGEPROFILE\0X00000804\{83955C0E-2C09-47A5-BCF3-F2B98E11EE8B}"; Key: "HIDDENINSETTINGUI"; Value: "0000000000"), "regsvr32.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CTF\TIP\{D2291A80-84D8-4641-9AB2-BDD1472C846B}\LANGUAGEPROFILE\0X00000804\{83955C0E-2C09-47A5-BCF3-F2B98E11EE8B}"; Key: "SUBITEMINSETTINGUI"; Value: "0000000000"), "rundll32.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{D2291A80-84D8-4641-9AB2-BDD1472C846B}"; Key: "(DEFAULT)"; Value: "Sample IME"), "rundll32.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{D2291A80-84D8-4641-9AB2-BDD1472C846B}\INPROCSERVER32"; Key: "(DEFAULT)"; Value: "%WINDIR%\System32\rundll32.exe"), "rundll32.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{D2291A80-84D8-4641-9AB2-BDD1472C846B}\INPROCSERVER32"; Key: "THREADINGMODEL"; Value: "Apartment")32:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAA////////////////////AP///////////////////wD///////////////////8A////8A//////8A//////AP////AP//////AP/////wD////wD//////wD/////8A////8A//////8A//////AP////AP//////AP/////wD////wD//////wD/////8A//9/8A/3AAAAAAAAAAf/AP/3D/AP9wAAAAAAAAAH/wD/9wfwD//////wD/////8A//8A8A//////8A//////AP//cIAP93////AP/////wD///BwD3AP///wD/////8A///3AAcA9wAAAAAAAP//AP///wAAf/cAAAAAAAD//wD///9wD//////wD/////8A////cA//////8A//////AP///4AP//////AP/////wD/9wAAAADwAAAAAAAAf/8A//cAAAAA8AAAAAAAAH//AP////AP////iP9wf////wD////wD///+AD/8Aj///8A////8A////AI//gA////AP////AP//9wf///cH///wD////wD///h/////eP//8A////////////////////AP///////////////////wD///////////////////8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==33:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAA////////////////////AP///////////////////wD///////////////////8A////8A//////8A//////AP////AP//////AP/////wD////wD//////wD/////8A////8A//////8A//////AP////AP//////AP/////wD////wD//////wD/////8A//9/8A/3AAAAAAAAAAf/AP/3D/AP9wAAAAAAAAAH/wD/9wfwD//////wD/////8A//8A8A//////8A//////AP//cIAP93////AP/////wD///BwD3AP///wD/////8A///3AAcA9wAAAAAAAP//AP///wAAf/cAAAAAAAD//wD///9wD//////wD/////8A////cA//////8A//////AP///4AP//////AP/////wD/9wAAAADwAAAAAAAAf/8A//cAAAAA8AAAAAAAAH//AP////AP////iP9wf////wD////wD///+AD/8Aj///8A////8A////AI//gA////AP////AP//9wf///cH///wD////wD///h/////eP//8A////////////////////AP///////////////////wD///////////////////8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==34:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAA////////////////////AP///////////////////wD///////////////////8A////8A//////8A//////AP////AP//////AP/////wD////wD//////wD/////8A////8A//////8A//////AP////AP//////AP/////wD////wD//////wD/////8A//9/8A/3AAAAAAAAAAf/AP/3D/AP9wAAAAAAAAAH/wD/9wfwD//////wD/////8A//8A8A//////8A//////AP//cIAP93////AP/////wD///BwD3AP///wD/////8A///3AAcA9wAAAAAAAP//AP///wAAf/cAAAAAAAD//wD///9wD//////wD/////8A////cA//////8A//////AP///4AP//////AP/////wD/9wAAAADwAAAAAAAAf/8A//cAAAAA8AAAAAAAAH//AP////AP////iP9wf////wD////wD///+AD/8Aj///8A////8A////AI//gA////AP////AP//9wf///cH///wD////wD///h/////eP//8A////////////////////AP///////////////////wD///////////////////8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==35:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAA////////////////////AP///////////////////wD///////////////////8A////8A//////8A//////AP////AP//////AP/////wD////wD//////wD/////8A////8A//////8A//////AP////AP//////AP/////wD////wD//////wD/////8A//9/8A/3AAAAAAAAAAf/AP/3D/AP9wAAAAAAAAAH/wD/9wfwD//////wD/////8A//8A8A//////8A//////AP//cIAP93////AP/////wD///BwD3AP///wD/////8A///3AAcA9wAAAAAAAP//AP///wAAf/cAAAAAAAD//wD///9wD//////wD/////8A////cA//////8A//////AP///4AP//////AP/////wD/9wAAAADwAAAAAAAAf/8A//cAAAAA8AAAAAAAAH//AP////AP////iP9wf////wD////wD///+AD/8Aj///8A////8A////AI//gA////AP////AP//9wf///cH///wD////wD///h/////eP//8A////////////////////AP///////////////////wD///////////////////8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==36:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAA////////////////////AP///////////////////wD///////////////////8A////8A//////8A//////AP////AP//////AP/////wD////wD//////wD/////8A////8A//////8A//////AP////AP//////AP/////wD////wD//////wD/////8A//9/8A/3AAAAAAAAAAf/AP/3D/AP9wAAAAAAAAAH/wD/9wfwD//////wD/////8A//8A8A//////8A//////AP//cIAP93////AP/////wD///BwD3AP///wD/////8A///3AAcA9wAAAAAAAP//AP///wAAf/cAAAAAAAD//wD///9wD//////wD/////8A////cA//////8A//////AP///4AP//////AP/////wD/9wAAAADwAAAAAAAAf/8A//cAAAAA8AAAAAAAAH//AP////AP////iP9wf////wD////wD///+AD/8Aj///8A////8A////AI//gA////AP////AP//9wf///cH///wD////wD///h/////eP//8A////////////////////AP///////////////////wD///////////////////8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==37:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAA////////////////////AP///////////////////wD///////////////////8A////8A//////8A//////AP////AP//////AP/////wD////wD//////wD/////8A////8A//////8A//////AP////AP//////AP/////wD////wD//////wD/////8A//9/8A/3AAAAAAAAAAf/AP/3D/AP9wAAAAAAAAAH/wD/9wfwD//////wD/////8A//8A8A//////8A//////AP//cIAP93////AP/////wD///BwD3AP///wD/////8A///3AAcA9wAAAAAAAP//AP///wAAf/cAAAAAAAD//wD///9wD//////wD/////8A////cA//////8A//////AP///4AP//////AP/////wD/9wAAAADwAAAAAAAAf/8A//cAAAAA8AAAAAAAAH//AP////AP////iP9wf////wD////wD///+AD/8Aj///8A////8A////AI//gA////AP////AP//9wf///cH///wD////wD///h/////eP//8A////////////////////AP///////////////////wD///////////////////8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==38:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAA////////////////////AP///////////////////wD///////////////////8A////8A//////8A//////AP////AP//////AP/////wD////wD//////wD/////8A////8A//////8A//////AP////AP//////AP/////wD////wD//////wD/////8A//9/8A/3AAAAAAAAAAf/AP/3D/AP9wAAAAAAAAAH/wD/9wfwD//////wD/////8A//8A8A//////8A//////AP//cIAP93////AP/////wD///BwD3AP///wD/////8A///3AAcA9wAAAAAAAP//AP///wAAf/cAAAAAAAD//wD///9wD//////wD/////8A////cA//////8A//////AP///4AP//////AP/////wD/9wAAAADwAAAAAAAAf/8A//cAAAAA8AAAAAAAAH//AP////AP////iP9wf////wD////wD///+AD/8Aj///8A////8A////AI//gA////AP////AP//9wf///cH///wD////wD///h/////eP//8A////////////////////AP///////////////////wD///////////////////8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==39:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAA////////////////////AP///////////////////wD///////////////////8A////8A//////8A//////AP////AP//////AP/////wD////wD//////wD/////8A////8A//////8A//////AP////AP//////AP/////wD////wD//////wD/////8A//9/8A/3AAAAAAAAAAf/AP/3D/AP9wAAAAAAAAAH/wD/9wfwD//////wD/////8A//8A8A//////8A//////AP//cIAP93////AP/////wD///BwD3AP///wD/////8A///3AAcA9wAAAAAAAP//AP///wAAf/cAAAAAAAD//wD///9wD//////wD/////8A////cA//////8A//////AP///4AP//////AP/////wD/9wAAAADwAAAAAAAAf/8A//cAAAAA8AAAAAAAAH//AP////AP////iP9wf////wD////wD///+AD/8Aj///8A////8A////AI//gA////AP////AP//9wf///cH///wD////wD///h/////eP//8A////////////////////AP///////////////////wD///////////////////8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"aeebcd8c8b15645d7e71b68ac05e21e9a4c94f832c64044725d870b87b9573c7","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790349345053,"unified_at":"2026-09-25T15:15:45.053Z","metadata":{"hashes":{"sha256":"aeebcd8c8b15645d7e71b68ac05e21e9a4c94f832c64044725d870b87b9573c7","sha1":"28978e987bc59e75ca22562924eab93355cf679e","md5":"447557d5236f1b97be0314b317ca9fff","sha512":"ebdf4b684a3e96a8f2b0072615d7f16fb19904c52e28c5b0fd6c7f69d15a904392bb09abed83c6040df6dc0f32b69a5d2f8cc68e0930b921e2368a27a0ebdea4","ssdeep":"12288:oWujjXB8pkTnyDjVBRxQ1UdiG/Mclbvc/Z:oWujFl2JFQ1Udi2MKc/Z","ssdeep_chunks":["12288:oWujjXB","12288:WujjXB8","12288:ujjXB8p","12288:jjXB8pk","12288:jXB8pkT","12288:XB8pkTn","12288:B8pkTny","12288:8pkTnyD","12288:pkTnyDj","12288:kTnyDjV","12288:TnyDjVB","12288:nyDjVBR","12288:yDjVBRx","12288:DjVBRxQ","12288:jVBRxQ1","12288:VBRxQ1U","12288:BRxQ1Ud","12288:RxQ1Udi","12288:xQ1UdiG","12288:Q1UdiG/","12288:1UdiG/M","12288:UdiG/Mc","12288:diG/Mcl","12288:iG/Mclb","12288:G/Mclbv","12288:/Mclbvc","12288:Mclbvc/","12288:clbvc/Z","24576:oWujjXB","24576:WujjXB8","24576:ujjXB8p","24576:jjXB8pk","24576:jXB8pkT","24576:XB8pkTn","24576:B8pkTny","24576:8pkTnyD","24576:pkTnyDj","24576:kTnyDjV","24576:TnyDjVB","24576:nyDjVBR","24576:yDjVBRx","24576:DjVBRxQ","24576:jVBRxQ1","24576:VBRxQ1U","24576:BRxQ1Ud","24576:RxQ1Udi","24576:xQ1UdiG","24576:Q1UdiG/","24576:1UdiG/M","24576:UdiG/Mc","24576:diG/Mcl","24576:iG/Mclb","24576:G/Mclbv","24576:/Mclbvc","24576:Mclbvc/","24576:clbvc/Z","12288:oWujFl2","12288:WujFl2J","12288:ujFl2JF","12288:jFl2JFQ","12288:Fl2JFQ1","12288:l2JFQ1U","12288:2JFQ1Ud","12288:JFQ1Udi","12288:FQ1Udi2","12288:Q1Udi2M","12288:1Udi2MK","12288:Udi2MKc","12288:di2MKc/","12288:i2MKc/Z"],"imphash":"655221b6bcad7b5b0b9766142cbc257a"},"file_info":{"file_name":"28978E987BC59E75CA22562924EAB93355CF679E","file_type":["pedll","64bits","executable"],"file_type_id":"64-bit dll","file_size":828416,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1763016362000,"last_seen":1770899970000,"last_multi_scan":1770899970000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["analysis","wanacrypt0r","wannacry","wcry","evasive"]},"stats":{"av":{"malicious_count":12,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":51},"sandbox_signatures":{"informative_count":115,"suspicious_count":12,"malicious_count":1,"total":128},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Loader","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win64.NukeSped","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/AVI.Agent.nvykl","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.76907938","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Trojan.Agent-1388735","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.76907938 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win64/NukeSped.TL trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005cb2071 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"malicious","threat_name":"Trojan-NukeSped.j","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W64/ABTrojan.OKFW-7528","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.NukeSped.Win64.588","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"suspicious","value":"Contains ability to retrieve the fully qualified path of module"},{"type":"informative","value":"Contains ability to create/open files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Able to import GetCommandLine API, which retrieves the command line string for the current process"}],"sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve class object from a DLL object handler"}],"sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Writes registry keys"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"suspicious","value":"Contains ability to update the user profile"},{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"tactic":"Privilege Escalation","technique":"Thread Local Storage","attack_id":"T1055.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/005","identifiers":[{"type":"suspicious","value":"Found TLS callbacks"}],"sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to query local/system time as file time"}],"sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"YARA signature match - RC4 Encryption"},{"type":"informative","value":"YARA signature match – ROR algorithm"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match - AES encryption"}],"sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file contains unusual section name"}],"sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Contains ability to detect sandbox (imports API)"}],"sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"tactic":"Defense Evasion","technique":"Rundll32","attack_id":"T1218.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1218/011","identifiers":[{"type":"informative","value":"Executes a DLL using Rundll32 process"}],"sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"},{"type":"informative","value":"Able to read the PEB (Process Environment Block) structure"}],"sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"},{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"tactic":"Defense Evasion","technique":"Regsvr32","attack_id":"T1218.010","attack_id_wiki":"https://attack.mitre.org/techniques/T1218/010","identifiers":[{"type":"informative","value":"Executes a DLL using Regsvr32 process"}],"sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"},{"type":"suspicious","value":"Contains ability to retrieve keyboard strokes"}],"sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Touches files"}],"sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Contains ability to query the system locale"}],"sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"suspicious","value":"Contains ability to read monitor info"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"suspicious","value":"Contains ability to retrieve the specified system metric or system configuration setting"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Found registry location strings in memory"}],"sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Attempts to call internet-related API for network communication"}],"sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"suspicious","value":"Contains ability to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$25","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"NtOpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00007188.00000000.113956.47468000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"28978E987BC59E75CA22562924EAB93355CF679E\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"28978E987BC59E75CA22562924EAB93355CF679E\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"28978E987BC59E75CA22562924EAB93355CF679E\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00004740.00000000.113627.81594000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004740.00000000.113627.81594000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004740.00000000.113627.81594000.00000002.mdmp\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00007188.00000000.113956.47468000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007188.00000000.113956.47468000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"28978E987BC59E75CA22562924EAB93355CF679E\")\n Found reference to API \"\" (Indicator: \"RegSetValue\"; Source: \"00000000-00004740.00000000.113627.03400000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"RegSetValue\"; Source: \"00000000-00004740.00000000.113627.03400000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"RegSetValue\"; Source: \"00000000-00004740.00000000.113627.03400000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"RegSetValue\"; Source: \"00000000-00004740.00000000.113627.03400000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$26","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"28978E987BC59E75CA22562924EAB93355CF679E\")\n Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; File: \"28978E987BC59E75CA22562924EAB93355CF679E\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"28978E987BC59E75CA22562924EAB93355CF679E\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"28978E987BC59E75CA22562924EAB93355CF679E\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"28978E987BC59E75CA22562924EAB93355CF679E\")\n Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"28978E987BC59E75CA22562924EAB93355CF679E\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$27","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption\n Matched sigs: YARA signature match - RC4 Encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption\n Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: YARA signature match - RC4 Encryption","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption\n Matched sigs: YARA signature match - RC4 Encryption","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"Found XOR loop in file \"sample.bin\" at offset 192304; code bytes = 30d0\n Found XOR loop in file \"sample.bin\" at offset 10429; code bytes = 33c1\n Found XOR loop in file \"sample.bin\" at offset 10449; code bytes = 33c1\n Found XOR loop in file \"sample.bin\" at offset 10472; code bytes = 33c1\n Found XOR loop in file \"sample.bin\" at offset 10897; code bytes = 33c1\n Found XOR loop in file \"sample.bin\" at offset 11306; code bytes = 33c1\n Found XOR loop in file \"sample.bin\" at offset 133274; code bytes = 33c1\n Found XOR loop in file \"sample.bin\" at offset 133408; code bytes = 33c1\n Found XOR loop in file \"sample.bin\" at offset 306932; code bytes = 8030\n Found XOR loop in file \"sample.bin\" at offset 564734; code bytes = 8030\n Found XOR loop in file \"sample.bin\" at offset 631231; code bytes = 8030","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00007188.00000000.113956.47468000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"etUserNameW\" (Source: \"00000000-00007188.00000000.113956.961A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00007188.00000000.113956.47468000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"28978E987BC59E75CA22562924EAB93355CF679E\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"28978E987BC59E75CA22562924EAB93355CF679E\")\n Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; File: \"28978E987BC59E75CA22562924EAB93355CF679E\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004740.00000000.113627.81594000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00007188.00000000.113956.47468000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"EnumSystemLocalesW\" (Indicator: \"EnumSystemLocales\"; File: \"28978E987BC59E75CA22562924EAB93355CF679E\")\n Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; File: \"28978E987BC59E75CA22562924EAB93355CF679E\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; File: \"28978E987BC59E75CA22562924EAB93355CF679E\")\n Found reference to API \"EnumSystemLocalesEx\" (Indicator: \"EnumSystemLocales\"; File: \"28978E987BC59E75CA22562924EAB93355CF679E\")\n Found reference to API \"GetLocaleInfoEx\" (Indicator: \"GetLocaleInfo\"; File: \"28978E987BC59E75CA22562924EAB93355CF679E\")\n Found reference to API \"GetUserDefaultLocaleName\" (Indicator: \"GetUserDefaultLocaleName\"; File: \"28978E987BC59E75CA22562924EAB93355CF679E\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetTimeFormatW\" (Indicator: \"GetTimeFormat\"; File: \"28978E987BC59E75CA22562924EAB93355CF679E\")\n Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; File: \"28978E987BC59E75CA22562924EAB93355CF679E\")\n Found reference to API \"GetDateFormatEx\" (Indicator: \"GetDateFormat\"; File: \"28978E987BC59E75CA22562924EAB93355CF679E\")\n Found reference to API \"GetTimeFormatEx\" (Indicator: \"GetTimeFormat\"; File: \"28978E987BC59E75CA22562924EAB93355CF679E\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetEnvironmentStringsW\" in file \"28978E987BC59E75CA22562924EAB93355CF679E\"\n Found system information discovery API: \"ExpandEnvironmentStringsW\" in file \"28978E987BC59E75CA22562924EAB93355CF679E\"\n Found system information discovery API: \"GetMonitorInfoW\" in file \"28978E987BC59E75CA22562924EAB93355CF679E\"\n Found system information discovery API: \"GetUserObjectInformationW\" in file \"28978E987BC59E75CA22562924EAB93355CF679E\"\n Found system information discovery API: \"GetSystemInfo\" in \"00000000-00004740.00000000.113627.81594000.00000002.mdmp\"\n Found system information discovery API: \"NtQuerySystemInformation\" in \"00000000-00007188.00000000.113956.47468000.00000002.mdmp\"\n Found system information discovery API: \"RtlNtStatusToDosError\" in \"00000000-00007188.00000000.113956.47468000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"SendMessageW\" (Indicator: \"sendmessage\"; File: \"28978E987BC59E75CA22562924EAB93355CF679E\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"regsvr32.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00004740)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"regsvr32.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00004740)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$28","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process2\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00004740.00000000.113627.81594000.00000002.mdmp\")\n Found reference to API \"IsWow64Process2\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00007188.00000000.113956.47468000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindNextFileW@KERNEL32.dll at 55305-4162-0000000180058CCD","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"28978E987BC59E75CA22562924EAB93355CF679E\")\n Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"28978E987BC59E75CA22562924EAB93355CF679E\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00004740.00000000.113627.81594000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00007188.00000000.113956.47468000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"GetSystemTimeAsFileTime@KERNEL32.dll at 55305-4270-000000018005CF08\n GetSystemTimeAsFileTime@KERNEL32.dll at 55305-5261-00000001800214D1","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.dll at 55305-4270-000000018005CF08\n GetSystemTimeAsFileTime@KERNEL32.dll at 55305-5261-00000001800214D1","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"EnumSystemLocalesW@KERNEL32.dll at 55305-4217-000000018005BDB7\n EnumSystemLocalesW@KERNEL32.dll at 55305-4219-000000018005BEBD\n EnumSystemLocalesW@KERNEL32.dll at 55305-4220-000000018005BF39\n GetLocaleInfoW@KERNEL32.dll at 55305-4269-000000018005CEA8\n GetUserDefaultLCID@KERNEL32.dll at 55305-4273-000000018005D009\n GetLocaleInfoW@KERNEL32.dll at 55305-4377-0000000180065D96\n EnumSystemLocalesW@KERNEL32.dll at 55305-4379-0000000180065FAE\n GetLocaleInfoW@KERNEL32.dll at 55305-4380-0000000180066091\n GetLocaleInfoW@KERNEL32.dll at 55305-4382-00000001800664B4\n GetLocaleInfoW@KERNEL32.dll at 55305-4383-00000001800662D9\n GetLocaleInfoW@KERNEL32.dll at 55305-4385-0000000180066458\n EnumSystemLocalesW@KERNEL32.dll at 55305-4386-00000001800665E2\n GetLocaleInfoW@KERNEL32.dll at 55305-4389-00000001800663E0\n EnumSystemLocalesW@KERNEL32.dll at 55305-4392-0000000180065EAC\n EnumSystemLocalesW@KERNEL32.dll at 55305-5365-0000000180065E28","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"regsvr32.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"rundll32.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"28978E987BC59E75CA22562924EAB93355CF679E\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00004740.00000000.113627.81594000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00007188.00000000.113956.47468000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"28978E987BC59E75CA22562924EAB93355CF679E\")\n Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"28978E987BC59E75CA22562924EAB93355CF679E\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00004740.00000000.113627.81594000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00007188.00000000.113956.47468000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; File: \"28978E987BC59E75CA22562924EAB93355CF679E\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"28978E987BC59E75CA22562924EAB93355CF679E\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyExW\" in file \"28978E987BC59E75CA22562924EAB93355CF679E\"\n Found registry modification API: \"\" in \"00000000-00004740.00000000.113627.03400000.00000004.mdmp\"\n Found registry modification API: \"\" in \"00000000-00004740.00000000.113627.03400000.00000004.mdmp\"\n Found registry modification API: \"\" in \"00000000-00004740.00000000.113627.03400000.00000004.mdmp\"\n Found registry modification API: \"\" in \"00000000-00004740.00000000.113627.03400000.00000004.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"General","name":"Able to read the PEB (Process Environment Block) structure","description":"\"sample.bin\" can read 64 bit PEB structure (dword ptr gs:[00000060h]) (Offset: 70632)","origin":"Binary File","mitre_attack_id":"T1027.007","relevance":3,"id":"binary-30","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"\" (Indicator: \"MoveFileA\"; Source: \"00000000-00004740.00000000.113627.03400000.00000004.mdmp\")\n Found string \"\" (Indicator: \"MoveFileW\"; Source: \"00000000-00004740.00000000.113627.03400000.00000004.mdmp\")\n Found string \"\" (Indicator: \"MoveFileExA\"; Source: \"00000000-00004740.00000000.113627.03400000.00000004.mdmp\")\n Found string \"\" (Indicator: \"MoveFileExW\"; Source: \"00000000-00004740.00000000.113627.03400000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"Found string \"GetCommandLineW\" (Source: \"00000000-00004740.00000000.113627.81594000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00007188.00000000.113956.47468000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$29","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2a","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00004740.00000000.113627.81594000.00000002.mdmp\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00007188.00000000.113956.47468000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; File: \"28978E987BC59E75CA22562924EAB93355CF679E\")\n Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; File: \"28978E987BC59E75CA22562924EAB93355CF679E\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"28978E987BC59E75CA22562924EAB93355CF679E\")\n Found reference to API \"\" (Indicator: \"CreateFile\"; Source: \"00000000-00004740.00000000.113627.03400000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"CreateFile\"; Source: \"00000000-00004740.00000000.113627.03400000.00000004.mdmp\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00004740.00000000.113627.81594000.00000002.mdmp\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00007188.00000000.113956.47468000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"SetTimer at 55305-2402-0000000180005330","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"28978E987BC59E75CA22562924EAB93355CF679E\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00004740.00000000.113627.81594000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: 28978E987BC59E75CA22562924EAB93355CF679E)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryExW@KERNEL32.dll at 55305-2929-000000018000CC40\n LoadLibraryExW@KERNEL32.dll at 55305-4255-000000018005C89B","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"\" (Indicator: \"MoveFile\"; Source: \"00000000-00004740.00000000.113627.03400000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"MoveFile\"; Source: \"00000000-00004740.00000000.113627.03400000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"MoveFile\"; Source: \"00000000-00004740.00000000.113627.03400000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"MoveFile\"; Source: \"00000000-00004740.00000000.113627.03400000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"28978E987BC59E75CA22562924EAB93355CF679E\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"28978E987BC59E75CA22562924EAB93355CF679E\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004740.00000000.113627.81594000.00000002.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00007188.00000000.113956.47468000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"28978E987BC59E75CA22562924EAB93355CF679E\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00004740.00000000.113627.81594000.00000002.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00007188.00000000.113956.47468000.00000002.mdmp\")\n Found reference to API \"NtOpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00007188.00000000.113956.47468000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"28978E987BC59E75CA22562924EAB93355CF679E\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"28978E987BC59E75CA22562924EAB93355CF679E\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00004740.00000000.113627.81594000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00007188.00000000.113956.47468000.00000002.mdmp\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00007188.00000000.113956.47468000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"28978E987BC59E75CA22562924EAB93355CF679E\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"\"28978E987BC59E75CA22562924EAB93355CF679E\" contains export function called \"DllCanUnloadNow\" at ordinal 1\n \"28978E987BC59E75CA22562924EAB93355CF679E\" contains export function called \"DllGetClassObject\" at ordinal 2\n \"28978E987BC59E75CA22562924EAB93355CF679E\" contains export function called \"DllRegisterServer\" at ordinal 3\n \"28978E987BC59E75CA22562924EAB93355CF679E\" contains export function called \"DllUnregisterServer\" at ordinal 4\n \"28978E987BC59E75CA22562924EAB93355CF679E\" contains export function called \"OnSessionChange\" at ordinal 5\n \"28978E987BC59E75CA22562924EAB93355CF679E\" contains export function called \"Refresh\" at ordinal 6\n \"28978E987BC59E75CA22562924EAB93355CF679E\" contains export function called \"StartComponent\" at ordinal 7\n \"28978E987BC59E75CA22562924EAB93355CF679E\" contains export function called \"StopComponent\" at ordinal 8","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"e\\Software\\C\" in Source: 00000000-00007356.00000000.113625.BDA70000.00000004.mdmp\n \"e\\Software\\C\" in Source: 00000000-00008188.00000000.113624.5C620000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process rundll32.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\SM0:8188:120:WilError_01\"\n Process rundll32.exe created mutex with name \"SM0:8188:120:WilError_01\"\n Process rundll32.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\SM0:7356:120:WilError_01\"\n Process rundll32.exe created mutex with name \"SM0:7356:120:WilError_01\"","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"General","name":"Executes a DLL using Regsvr32 process","description":"Process \"regsvr32.exe\" with commandline \"/s \"C:\\\\28978E987BC59E75CA22562924EAB93355CF679E.dll\"\" (UID: 00000000-00004740)","origin":"Monitored Target","mitre_attack_id":"T1218.010","relevance":1,"id":"target-329","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"General","name":"Executes a DLL using Rundll32 process","description":"Process \"rundll32.exe\" with commandline \"\"C:\\\\28978E987BC59E75CA22562924EAB93355CF679E.dll\",#1\" (UID: 00000000-00005420)\n Process \"rundll32.exe\" with commandline \"\"C:\\\\28978E987BC59E75CA22562924EAB93355CF679E.dll\",#4\" (UID: 00000000-00008188)\n Process \"rundll32.exe\" with commandline \"\"C:\\\\28978E987BC59E75CA22562924EAB93355CF679E.dll\",#3\" (UID: 00000000-00007356)\n Process \"rundll32.exe\" with commandline \"\"C:\\\\28978E987BC59E75CA22562924EAB93355CF679E.dll\",#6\" (UID: 00000000-00006916)\n Process \"rundll32.exe\" with commandline \"\"C:\\\\28978E987BC59E75CA22562924EAB93355CF679E.dll\",#7\" (UID: 00000000-00007188)\n Process \"rundll32.exe\" with commandline \"\"C:\\\\28978E987BC59E75CA22562924EAB93355CF679E.dll\",#5\" (UID: 00000000-00007344)\n Process \"rundll32.exe\" with commandline \"\"C:\\\\28978E987BC59E75CA22562924EAB93355CF679E.dll\",#8\" (UID: 00000000-00000372)","origin":"Monitored Target","mitre_attack_id":"T1218.011","relevance":1,"id":"target-400","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"28978E987BC59E75CA22562924EAB93355CF679E\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"\"e\\Software\\C\" in Source: 00000000-00007356.00000000.113625.BDA70000.00000004.mdmp\n \"e\\Software\\C\" in Source: 00000000-00008188.00000000.113624.5C620000.00000004.mdmp","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$2c","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"regsvr32.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 58D20000\n \"regsvr32.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 57720000\n \"rundll32.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 58D20000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"regsvr32.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 5B6A0000\n \"rundll32.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 5B6A0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a000000000040c7f457fd7f0000@ntdll.dll\"\n \"220023000000000018c7f457fd7f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"28978E987BC59E75CA22562924EAB93355CF679E\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"28978E987BC59E75CA22562924EAB93355CF679E\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"regsvr32.exe\" touched \"TF_InputProcessorProfiles\" (Path: \"HKCU\\CLSID\\{33C53A50-F456-4884-B049-85FD643ECFED}\")\n \"regsvr32.exe\" touched \"TF_CategoryMgr\" (Path: \"HKCU\\CLSID\\{A4B544A1-438D-4B41-9325-869523E2D6C7}\\TREATAS\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"28978E987BC59E75CA22562924EAB93355CF679E\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"28978E987BC59E75CA22562924EAB93355CF679E\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"28978E987BC59E75CA22562924EAB93355CF679E\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"28978E987BC59E75CA22562924EAB93355CF679E\" file has an entrypoint instructions - \"mov\tqword ptr [rsp + 8], rbx,mov\tqword ptr [rsp + 0x10], rsi,push\trdi,sub\trsp, 0x20,mov\trdi, r8,mov\tebx, edx,mov\trsi, rcx,cmp\tedx, 1,jne\t0x1800211f9,call\t0x1800214b0,mov\tr8, rdi,mov\tedx, ebx,mov\trcx, rsi,mov\trbx, qword ptr [rsp + 0x30],mov\trsi, qword ptr [rsp + 0x38],add\trsp, 0x20,pop\trdi,jmp\t0x180021080,int3\t,int3\t,int3\t,and\tqword ptr [rcx + 0x10], 0,lea\trax, [rip + 0x54834],mov\tqword ptr [rcx], rax,mov\trax, rcx,mov\tqword ptr [rcx + 8], rdx,ret\t,int3\t,sub\trsp, 0x48,lea\trcx, [rsp + 0x20],\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"28978E987BC59E75CA22562924EAB93355CF679E\" has high imagebase \"0x180000000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\System32\\regsvr32.exe\" [Source: 00000000-00004740-00000BC1-770384498]\n Observed system executable string:\"%WINDIR%\\System32\\rundll32.exe\" [Source: 00000000-00007356-00000BC1-770153921]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"rundll32.exe\" (UID: 00000000-00005420) was launched with new environment variables: \"PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"rundll32.exe\" (UID: 00000000-00005420) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"rundll32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"rundll32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"rundll32.exe\" with commandline \"\"C:\\\\28978E987BC59E75CA22562924EAB93355CF679E.dll\",#1\" (UID: 00000000-00005420)\n Spawned process \"rundll32.exe\" with commandline \"\"C:\\\\28978E987BC59E75CA22562924EAB93355CF679E.dll\",#4\" (UID: 00000000-00008188)\n Spawned process \"rundll32.exe\" with commandline \"\"C:\\\\28978E987BC59E75CA22562924EAB93355CF679E.dll\",#3\" (UID: 00000000-00007356)\n Spawned process \"rundll32.exe\" with commandline \"\"C:\\\\28978E987BC59E75CA22562924EAB93355CF679E.dll\",#6\" (UID: 00000000-00006916)\n Spawned process \"rundll32.exe\" with commandline \"\"C:\\\\28978E987BC59E75CA22562924EAB93355CF679E.dll\",#7\" (UID: 00000000-00007188)\n Spawned process \"rundll32.exe\" with commandline \"\"C:\\\\28978E987BC59E75CA22562924EAB93355CF679E.dll\",#5\" (UID: 00000000-00007344)\n Spawned process \"rundll32.exe\" with commandline \"\"C:\\\\28978E987BC59E75CA22562924EAB93355CF679E.dll\",#8\" (UID: 00000000-00000372)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"rundll32.exe\" with commandline \"\"C:\\\\28978E987BC59E75CA22562924EAB93355CF679E.dll\",#1\" (UID: 00000000-00005420)\n Spawned process \"rundll32.exe\" with commandline \"\"C:\\\\28978E987BC59E75CA22562924EAB93355CF679E.dll\",#4\" (UID: 00000000-00008188)\n Spawned process \"rundll32.exe\" with commandline \"\"C:\\\\28978E987BC59E75CA22562924EAB93355CF679E.dll\",#3\" (UID: 00000000-00007356)\n Spawned process \"rundll32.exe\" with commandline \"\"C:\\\\28978E987BC59E75CA22562924EAB93355CF679E.dll\",#6\" (UID: 00000000-00006916)\n Spawned process \"rundll32.exe\" with commandline \"\"C:\\\\28978E987BC59E75CA22562924EAB93355CF679E.dll\",#7\" (UID: 00000000-00007188)\n Spawned process \"rundll32.exe\" with commandline \"\"C:\\\\28978E987BC59E75CA22562924EAB93355CF679E.dll\",#5\" (UID: 00000000-00007344)\n Spawned process \"rundll32.exe\" with commandline \"\"C:\\\\28978E987BC59E75CA22562924EAB93355CF679E.dll\",#8\" (UID: 00000000-00000372)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"28978E987BC59E75CA22562924EAB93355CF679E\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"28978E987BC59E75CA22562924EAB93355CF679E\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004740.00000000.113627.81594000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004740.00000000.113627.81594000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007188.00000000.113956.47468000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$2d","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"regsvr32.exe\" queries basic process information of the \"C:\\Windows\\System32\\regsvr32.exe\" (UID: 4740)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$2e","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to detect sandbox (imports API)\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Contains ability to delay the execution of current thread\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"regsvr32.exe\" trying to touch file \"C:\\Windows\\System32\\apphelp.dll\"\n \"regsvr32.exe\" trying to touch file \"C:\\Windows\\System32\\regsvr32.exe\"\n \"regsvr32.exe\" trying to touch file \"C:\\Windows\\System32\\ntdll.dll\"\n \"regsvr32.exe\" trying to touch file \"C:\\Windows\\System32\\kernel32.dll\"\n \"regsvr32.exe\" trying to touch file \"C:\\Windows\\System32\\KernelBase.dll\"\n \"regsvr32.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"regsvr32.exe\" trying to touch file \"C:\\Windows\\System32\\AcLayers.dll\"\n \"regsvr32.exe\" trying to touch file \"C:\\Windows\\System32\\sfc.dll\"\n \"regsvr32.exe\" trying to touch file \"C:\\Windows\\System32\\winspool.drv\"\n \"regsvr32.exe\" trying to touch file \"C:\\Windows\\System32\\IPHLPAPI.DLL\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"regsvr32.exe\" trying to access non-existent file \"C:\\ProgramData\\Microsoft\\DeviceSync\\INTELLISENSE_WINRT_DEVICESYNC.CAB\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\28978E987BC59E75CA22562924EAB93355CF679E.DLL.MANIFEST\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\28978E987BC59E75CA22562924EAB93355CF679E.dll.manifest\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\28978E987BC59E75CA22562924EAB93355CF679E.DLL.123.MANIFEST\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\28978E987BC59E75CA22562924EAB93355CF679E.DLL.124.MANIFEST\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\ProgramData\\Microsoft\\DeviceSync\\INTELLISENSE_WINRT_DEVICESYNC.CAB\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"1.0.0.1\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://www.w3.org/2001/xmlschema-instance\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RC4 Encryption","description":"YARA signature for RC4 encryption matched on file \"sample.bin\"\n YARA signature for RC4 encryption matched on process \"00000000-00004740\"","origin":"YARA Signature","mitre_attack_id":"T1027","id":"yara-104","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – ROR algorithm","description":"YARA signature matched on R0R instruction used in file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":1,"id":"yara-209","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: 28978E987BC59E75CA22562924EAB93355CF679E]","origin":"Static Parser","mitre_attack_id":"T1059.003","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegEnumKeyExW\" in file \"28978E987BC59E75CA22562924EAB93355CF679E\"\n Found registry query API: \"RegOpenKeyW\" in file \"28978E987BC59E75CA22562924EAB93355CF679E\"\n Found registry query API: \"RegQueryValueExW\" in file \"28978E987BC59E75CA22562924EAB93355CF679E\"\n Found registry query API: \"RegOpenKeyExW\" in file \"28978E987BC59E75CA22562924EAB93355CF679E\"\n Found registry query API: \"\" in \"00000000-00004740.00000000.113627.03400000.00000004.mdmp\"\n Found registry query API: \"\" in \"00000000-00004740.00000000.113627.03400000.00000004.mdmp\"\n Found registry query API: \"RegQueryValueExW\" in \"00000000-00004740.00000000.113627.81594000.00000002.mdmp\"\n Found registry query API: \"RegOpenKeyExW\" in \"00000000-00004740.00000000.113627.81594000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"MapVirtualKeyW\" (Indicator: \"MapVirtualKey\"; File: \"28978E987BC59E75CA22562924EAB93355CF679E\")\n Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; File: \"28978E987BC59E75CA22562924EAB93355CF679E\")\n Found reference to API \"GetKeyboardState\" (Indicator: \"GetKeyboardState\"; File: \"28978E987BC59E75CA22562924EAB93355CF679E\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"regsvr32.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"rundll32.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"Found reference to API \"CreateCompatibleDC\" (Indicator: \"CreateCompatibleDC\"; File: \"28978E987BC59E75CA22562924EAB93355CF679E\")\n Found reference to API \"GetDC\" (Indicator: \"GetDC\"; File: \"28978E987BC59E75CA22562924EAB93355CF679E\")\n Found reference to API \"GetWindowDC\" (Indicator: \"GetWindowDC\"; File: \"28978E987BC59E75CA22562924EAB93355CF679E\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to detect sandbox (imports API)","description":"Found GetCursorPos() in an import section (Source: 28978E987BC59E75CA22562924EAB93355CF679E)","origin":"Static Parser","mitre_attack_id":"T1497","relevance":1,"id":"static-132","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; File: \"28978E987BC59E75CA22562924EAB93355CF679E\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; File: \"28978E987BC59E75CA22562924EAB93355CF679E\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"28978E987BC59E75CA22562924EAB93355CF679E\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00004740.00000000.113627.81594000.00000002.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00007188.00000000.113956.47468000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"28978E987BC59E75CA22562924EAB93355CF679E\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"28978E987BC59E75CA22562924EAB93355CF679E\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004740.00000000.113627.81594000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00007188.00000000.113956.47468000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00007188.00000000.113956.47468000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"28978E987BC59E75CA22562924EAB93355CF679E\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00004740.00000000.113627.81594000.00000002.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00007188.00000000.113956.47468000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve class object from a DLL object handler","description":"\"28978E987BC59E75CA22562924EAB93355CF679E\" contains export function called \"DllGetClassObject\" at ordinal 2","origin":"Static Parser","mitre_attack_id":"T1559.001","relevance":1,"id":"static-177","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetFileSizeEx\" (Indicator: \"GetFileSize\"; File: \"28978E987BC59E75CA22562924EAB93355CF679E\")\n Found reference to API \"GetFileSize\" (Indicator: \"GetFileSize\"; File: \"28978E987BC59E75CA22562924EAB93355CF679E\")\n Found reference to API \"GetSystemDirectoryW\" (Indicator: \"GetSystemDirectory\"; Source: \"00000000-00004740.00000000.113627.81594000.00000002.mdmp\")\n Found reference to API \"GetSystemDirectoryW\" (Indicator: \"GetSystemDirectory\"; Source: \"00000000-00007188.00000000.113956.47468000.00000002.mdmp\")\n Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; Source: \"00000000-00007188.00000000.113956.47468000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"28978E987BC59E75CA22562924EAB93355CF679E\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"28978E987BC59E75CA22562924EAB93355CF679E\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00004740.00000000.113627.81594000.00000002.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00007188.00000000.113956.47468000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; File: \"28978E987BC59E75CA22562924EAB93355CF679E\")\n Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; File: \"28978E987BC59E75CA22562924EAB93355CF679E\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00007188.00000000.113956.47468000.00000002.mdmp\")\n Found reference to API \"NtQueryInformationToken\" (Indicator: \"NtQueryInformationToken\"; Source: \"00000000-00007188.00000000.113956.47468000.00000002.mdmp\")\n Found reference to API \"NtOpenProcessToken\" (Indicator: \"NtOpenProcessToken\"; Source: \"00000000-00007188.00000000.113956.47468000.00000002.mdmp\")\n Found reference to API \"NtOpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00007188.00000000.113956.47468000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; File: \"28978E987BC59E75CA22562924EAB93355CF679E\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteKeyW\" in file \"28978E987BC59E75CA22562924EAB93355CF679E\"\n Found registry deletion API: \"RegDeleteValueW\" in file \"28978E987BC59E75CA22562924EAB93355CF679E\"\n Found registry deletion API: \"\" in \"00000000-00004740.00000000.113627.03400000.00000004.mdmp\"\n Found registry deletion API: \"\" in \"00000000-00004740.00000000.113627.03400000.00000004.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"Found string \"NtOpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00007188.00000000.113956.47468000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$30","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"\" (Indicator: \"DeleteFile\"; Source: \"00000000-00004740.00000000.113627.03400000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"DeleteFile\"; Source: \"00000000-00004740.00000000.113627.03400000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00004740.00000000.113627.03400000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00004740.00000000.113627.03400000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; File: \"28978E987BC59E75CA22562924EAB93355CF679E\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"\" (Indicator: \"AccessCheck\"; Source: \"00000000-00004740.00000000.113627.03400000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"SetFileSecurityW\"; Source: \"00000000-00004740.00000000.113627.03400000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"28978E987BC59E75CA22562924EAB93355CF679E\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"28978E987BC59E75CA22562924EAB93355CF679E\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; File: \"28978E987BC59E75CA22562924EAB93355CF679E\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00004740.00000000.113627.81594000.00000002.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00007188.00000000.113956.47468000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00007188.00000000.113956.47468000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"28978E987BC59E75CA22562924EAB93355CF679E\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00007188.00000000.113956.47468000.00000002.mdmp\")\n Found reference to API \"CreateMutexExW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00007188.00000000.113956.47468000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"28978E987BC59E75CA22562924EAB93355CF679E\" has section name .text with entropy \"6.441202888180439\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Contains ability to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"CryptEncrypt\" (Indicator: \"CryptEncrypt\"; Source: \"00000000-00006916.00000000.113959.A13C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":2,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to read monitor info","description":"GetMonitorInfoW@USER32.dll at 55305-2703-0000000180004F20","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-62","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the specified system metric or system configuration setting","description":"GetSystemMetrics@USER32.dll at 55305-2650-00000001800092A0\n GetSystemMetrics@USER32.dll at 55305-2652-0000000180008FC0\n GetSystemMetrics@USER32.dll at 55305-2660-0000000180008080\n GetSystemMetrics@USER32.dll at 55305-2844-00000001800095A1\n GetSystemMetrics@USER32.dll at 55305-3121-000000018001A8C0\n GetSystemMetrics@USER32.dll at 55305-3122-000000018001A920","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-122","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"suspicious","category":"Network Related","name":"Attempts to call internet-related API for network communication","description":"\"regsvr32.exe\" called \"NtRequestWaitReplyPort\" with parameters (UID: 00000000-00004740)\n \"regsvr32.exe\" called \"NtConnectPort\" with parameters (UID: 00000000-00004740)\n \"rundll32.exe\" called \"NtRequestWaitReplyPort\" with parameters (UID: 00000000-00005420)\n \"rundll32.exe\" called \"NtConnectPort\" with parameters (UID: 00000000-00005420)\n \"rundll32.exe\" called \"NtRequestWaitReplyPort\" with parameters (UID: 00000000-00008188)\n \"rundll32.exe\" called \"NtConnectPort\" with parameters (UID: 00000000-00008188)\n \"rundll32.exe\" called \"NtRequestWaitReplyPort\" with parameters (UID: 00000000-00007356)","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-291","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Contains ability to update the user profile","description":"SystemParametersInfoW@USER32.dll at 55305-2602-000000018000F780\n SystemParametersInfoW@USER32.dll at 55305-2703-0000000180004F20\n SystemParametersInfoW@USER32.dll at 55305-2965-000000018000F409","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1098","relevance":5,"id":"stream-123","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve keyboard strokes","description":"MapVirtualKeyW@USER32.dll at 55305-2462-0000000180017250\n GetKeyState@USER32.dll at 55305-3056-000000018001706A\n MapVirtualKeyW@USER32.dll at 55305-3063-000000018001773D","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1056.001","relevance":8,"id":"stream-12","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module","description":"GetModuleFileNameW@KERNEL32.dll at 55305-4503-000000018006CE93","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-131","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"suspicious","category":"System Security","name":"Writes registry keys","description":"$31","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Found TLS callbacks","description":"\"28978E987BC59E75CA22562924EAB93355CF679E\" has a TLS callback with entrypoint at 0x80020a70\n \"28978E987BC59E75CA22562924EAB93355CF679E\" has a TLS callback with entrypoint at 0x1\n \"28978E987BC59E75CA22562924EAB93355CF679E\" has a TLS callback with entrypoint at 0x800208e0","origin":"Static Parser","mitre_attack_id":"T1055.005","relevance":10,"id":"static-17","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegEnumKeyExW\n RegDeleteKeyW\n RegCreateKeyExW\n RegOpenKeyW\n RegDeleteValueW\n RegOpenKeyExW\n RegCloseKey\n WriteFile\n FindFirstFileExW\n CreateFileMappingW\n GetModuleHandleExW\n LoadLibraryExW\n TerminateProcess\n UnhandledExceptionFilter\n IsDebuggerPresent\n GetCommandLineW\n GetCommandLineA\n FindNextFileW\n GetFileSizeEx\n GetFileSize\n MapViewOfFile\n CreateFileA\n GetModuleHandleW\n GetProcAddress\n OutputDebugStringW\n GetModuleFileNameW\n GetStartupInfoW\n CreateFileW\n LoadLibraryA\n GetCursorPos","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"PE file contains unusual section name","description":"\"28978E987BC59E75CA22562924EAB93355CF679E\" has a section named \"_RDATA\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-60","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]}],"incidents":[{"name":"Evasive","details_count":1,"details":[{"detail":"Able to check if a debugger is running"}],"sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]}]},"activity":{"stats":{"process_count":9,"spawned_processes_count":9,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":4,"imported_dlls_count":37,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":1,"files_deleted_count":0,"registry_keys_created_count":31,"registry_keys_modified_count":0,"registry_keys_deleted_count":2,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":33,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["analysis","wanacrypt0r","wannacry","wcry","evasive"],"sample_flags":["Multi-Process","User Comment"],"sandbox_reports":[{"id":"69157ea95aaed774b10900f1","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"submit_name":"28978E987BC59E75CA22562924EAB93355CF679E","analysis_start_time":"2025-11-13T06:46:03+00:00","indicators_count":{"informative":115,"suspicious":18,"malicious":1},"tags":["Multi-Process","User Comment"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}],"processes":[{"pid":4256,"ppid":0,"name":"","command_line":"","normalized_path":"","uid":"00000000-00004256"},{"pid":4740,"ppid":0,"name":"regsvr32.exe","command_line":"/s \"C:\\28978E987BC59E75CA22562924EAB93355CF679E.dll\"","sha256":"8eb386c10e619db1d74f95ae54083d61d2c3030e12de1bf288e5be59312cc1a5","normalized_path":"%WINDIR%\\System32\\regsvr32.exe","uid":"00000000-00004740","icon":"$32"},{"pid":5420,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\28978E987BC59E75CA22562924EAB93355CF679E.dll\",#1","sha256":"b1e6a7a3e2597e51836277a32b2bc61aa781c8f681d44dfddea618b32e2bf2a6","normalized_path":"%WINDIR%\\System32\\rundll32.exe","uid":"00000000-00005420","icon":"$33"},{"pid":8188,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\28978E987BC59E75CA22562924EAB93355CF679E.dll\",#4","sha256":"b1e6a7a3e2597e51836277a32b2bc61aa781c8f681d44dfddea618b32e2bf2a6","normalized_path":"%WINDIR%\\System32\\rundll32.exe","uid":"00000000-00008188","icon":"$34"},{"pid":7356,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\28978E987BC59E75CA22562924EAB93355CF679E.dll\",#3","sha256":"b1e6a7a3e2597e51836277a32b2bc61aa781c8f681d44dfddea618b32e2bf2a6","normalized_path":"%WINDIR%\\System32\\rundll32.exe","uid":"00000000-00007356","icon":"$35"},{"pid":6916,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\28978E987BC59E75CA22562924EAB93355CF679E.dll\",#6","sha256":"b1e6a7a3e2597e51836277a32b2bc61aa781c8f681d44dfddea618b32e2bf2a6","normalized_path":"%WINDIR%\\System32\\rundll32.exe","uid":"00000000-00006916","icon":"$36"},{"pid":7188,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\28978E987BC59E75CA22562924EAB93355CF679E.dll\",#7","sha256":"b1e6a7a3e2597e51836277a32b2bc61aa781c8f681d44dfddea618b32e2bf2a6","normalized_path":"%WINDIR%\\System32\\rundll32.exe","uid":"00000000-00007188","icon":"$37"},{"pid":7344,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\28978E987BC59E75CA22562924EAB93355CF679E.dll\",#5","sha256":"b1e6a7a3e2597e51836277a32b2bc61aa781c8f681d44dfddea618b32e2bf2a6","normalized_path":"%WINDIR%\\System32\\rundll32.exe","uid":"00000000-00007344","icon":"$38"},{"pid":372,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\28978E987BC59E75CA22562924EAB93355CF679E.dll\",#8","sha256":"b1e6a7a3e2597e51836277a32b2bc61aa781c8f681d44dfddea618b32e2bf2a6","normalized_path":"%WINDIR%\\System32\\rundll32.exe","uid":"00000000-00000372","icon":"$39"}],"all_imported_dlls":["kernel.appcore.dll","kernel32.dll","apphelp.dll","gdi32full.dll","rpcrt4.dll","bcryptprimitives.dll","imm32.dll","sechost.dll","cryptsp.dll","VxSSL64.dll","uxtheme.dll","dwmapi.dll","fltLib.dll","clbcatq.dll","AcLayers.dll","msvcrt.dll","msvcp_win.dll","ucrtbase.dll","sfc_os.dll","ole32.dll","28978E987BC59E75CA22562924EAB93355CF679E.dll","SHCore.dll","user32.dll","combase.dll","advapi32.dll","imagehlp.dll","ntdll.dll","KernelBase.dll","sfc.dll","msctf.dll","IPHLPAPI.DLL","oleaut32.dll","win32u.dll","gdi32.dll","shlwapi.dll","bcrypt.dll","ws2_32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\CLSID\\{D2291A80-84D8-4641-9AB2-BDD1472C846B}\\","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\CLSID\\{D2291A80-84D8-4641-9AB2-BDD1472C846B}\\INPROCSERVER32\\","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\CTF\\TIP\\{D2291A80-84D8-4641-9AB2-BDD1472C846B}\\LANGUAGEPROFILE\\0X00000804\\","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"key":"HKLMHKLM\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\CTF\\","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\CTF\\TIP\\","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\CTF\\TIP\\{D2291A80-84D8-4641-9AB2-BDD1472C846B}\\","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\CTF\\TIP\\{D2291A80-84D8-4641-9AB2-BDD1472C846B}\\LANGUAGEPROFILE\\","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\CTF\\TIP\\{D2291A80-84D8-4641-9AB2-BDD1472C846B}\\LANGUAGEPROFILE\\0X00000804\\{83955C0E-2C09-47A5-BCF3-F2B98E11EE8B}\\","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\CTF\\TIP\\{D2291A80-84D8-4641-9AB2-BDD1472C846B}\\CATEGORY\\CATEGORY\\{34745C63-B2F0-4784-8B67-5E12C8701A31}\\","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\CTF\\TIP\\{D2291A80-84D8-4641-9AB2-BDD1472C846B}\\CATEGORY\\","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\CTF\\TIP\\{D2291A80-84D8-4641-9AB2-BDD1472C846B}\\CATEGORY\\CATEGORY\\","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\CTF\\TIP\\{D2291A80-84D8-4641-9AB2-BDD1472C846B}\\CATEGORY\\CATEGORY\\{34745C63-B2F0-4784-8B67-5E12C8701A31}\\{D2291A80-84D8-4641-9AB2-BDD1472C846B}\\","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\CTF\\TIP\\{D2291A80-84D8-4641-9AB2-BDD1472C846B}\\CATEGORY\\ITEM\\{D2291A80-84D8-4641-9AB2-BDD1472C846B}\\","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\CTF\\TIP\\{D2291A80-84D8-4641-9AB2-BDD1472C846B}\\CATEGORY\\ITEM\\","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\CTF\\TIP\\{D2291A80-84D8-4641-9AB2-BDD1472C846B}\\CATEGORY\\ITEM\\{D2291A80-84D8-4641-9AB2-BDD1472C846B}\\{34745C63-B2F0-4784-8B67-5E12C8701A31}\\","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\CTF\\TIP\\{D2291A80-84D8-4641-9AB2-BDD1472C846B}\\CATEGORY\\CATEGORY\\{046B8C80-1647-40F7-9B21-B93B81AABC1B}\\","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\CTF\\TIP\\{D2291A80-84D8-4641-9AB2-BDD1472C846B}\\CATEGORY\\CATEGORY\\{046B8C80-1647-40F7-9B21-B93B81AABC1B}\\{D2291A80-84D8-4641-9AB2-BDD1472C846B}\\","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\CTF\\TIP\\{D2291A80-84D8-4641-9AB2-BDD1472C846B}\\CATEGORY\\ITEM\\{D2291A80-84D8-4641-9AB2-BDD1472C846B}\\{046B8C80-1647-40F7-9B21-B93B81AABC1B}\\","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\CTF\\TIP\\{D2291A80-84D8-4641-9AB2-BDD1472C846B}\\CATEGORY\\CATEGORY\\{49D2F9CF-1F5E-11D7-A6D3-00065B84435C}\\","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\CTF\\TIP\\{D2291A80-84D8-4641-9AB2-BDD1472C846B}\\CATEGORY\\CATEGORY\\{49D2F9CF-1F5E-11D7-A6D3-00065B84435C}\\{D2291A80-84D8-4641-9AB2-BDD1472C846B}\\","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\CTF\\TIP\\{D2291A80-84D8-4641-9AB2-BDD1472C846B}\\CATEGORY\\ITEM\\{D2291A80-84D8-4641-9AB2-BDD1472C846B}\\{49D2F9CF-1F5E-11D7-A6D3-00065B84435C}\\","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\CTF\\TIP\\{D2291A80-84D8-4641-9AB2-BDD1472C846B}\\CATEGORY\\CATEGORY\\{49D2F9CE-1F5E-11D7-A6D3-00065B84435C}\\","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\CTF\\TIP\\{D2291A80-84D8-4641-9AB2-BDD1472C846B}\\CATEGORY\\CATEGORY\\{49D2F9CE-1F5E-11D7-A6D3-00065B84435C}\\{D2291A80-84D8-4641-9AB2-BDD1472C846B}\\","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\CTF\\TIP\\{D2291A80-84D8-4641-9AB2-BDD1472C846B}\\CATEGORY\\ITEM\\{D2291A80-84D8-4641-9AB2-BDD1472C846B}\\{49D2F9CE-1F5E-11D7-A6D3-00065B84435C}\\","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\CTF\\TIP\\{D2291A80-84D8-4641-9AB2-BDD1472C846B}\\CATEGORY\\CATEGORY\\{364215D9-75BC-11D7-A6EF-00065B84435C}\\{D2291A80-84D8-4641-9AB2-BDD1472C846B}\\","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\CTF\\TIP\\{D2291A80-84D8-4641-9AB2-BDD1472C846B}\\CATEGORY\\ITEM\\{D2291A80-84D8-4641-9AB2-BDD1472C846B}\\{364215D9-75BC-11D7-A6EF-00065B84435C}\\","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\CTF\\TIP\\{D2291A80-84D8-4641-9AB2-BDD1472C846B}\\CATEGORY\\CATEGORY\\{CCF05DD7-4A87-11D7-A6E2-00065B84435C}\\{D2291A80-84D8-4641-9AB2-BDD1472C846B}\\","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\CTF\\TIP\\{D2291A80-84D8-4641-9AB2-BDD1472C846B}\\CATEGORY\\CATEGORY\\{13A016DF-560B-46CD-947A-4C3AF1E0E35D}\\{D2291A80-84D8-4641-9AB2-BDD1472C846B}\\","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\CTF\\TIP\\{D2291A80-84D8-4641-9AB2-BDD1472C846B}\\CATEGORY\\CATEGORY\\{25504FB4-7BAB-4BC1-9C69-CF81890F0EF5}\\{D2291A80-84D8-4641-9AB2-BDD1472C846B}\\","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\CLSID\\{D2291A80-84D8-4641-9AB2-BDD1472C846B}\\INPROCSERVER32\\","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\CLSID\\{D2291A80-84D8-4641-9AB2-BDD1472C846B}\\","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8188:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"name":"SM0:8188:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7356:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]},{"name":"SM0:7356:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69157ea95aaed774b10900f1"}]}]}},"report_ids":{"sandbox_job_ids":["69157ea95aaed774b10900f1"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Generic Sample aeebcd8c8b15… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample aeebcd8c8b15…. Malware family: Trojan.Generic. Threat score 100/100. 12/27 AV engines flagged this file. 1 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/aeebcd8c8b15645d7e71b68ac05e21e9a4c94f832c64044725d870b87b9573c7"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample aeebcd8c8b15… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample aeebcd8c8b15…. Malware family: Trojan.Generic. Threat score 100/100. 12/27 AV engines flagged this file. 1 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/aeebcd8c8b15645d7e71b68ac05e21e9a4c94f832c64044725d870b87b9573c7"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample aeebcd8c8b15… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample aeebcd8c8b15…. Malware family: Trojan.Generic. Threat score 100/100. 12/27 AV engines flagged this file. 1 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L3a","11",{}]]