24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 78:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T509,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_90% Sample aef25409e344… — Score 88/100 — Hybrid Analysis","description":"Malicious verdict for sample aef25409e344…. Malware family: Win/malicious_confidence_90%. Threat score 88/100. 9/26 AV engines flagged this file. 7 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/aef25409e3448752746dfefad04b29225f2b8c6bbd2d991e3115a4069e97504e","keywords":["Malicious","Win/malicious_confidence_90%","malware analysis","sandbox report","threat intelligence","aef25409e3448752746dfefad04b29225f2b8c6bbd2d991e3115a4069e97504e"],"about":{"@type":"SoftwareApplication","name":"aef25409e3448752746dfefad04b29225f2b8c6bbd2d991e3115a4069e97504e.bin","applicationCategory":["peexe","executable","compressed","sfx","rar"],"identifier":"aef25409e3448752746dfefad04b29225f2b8c6bbd2d991e3115a4069e97504e","additionalType":"Malicious sample"},"threatScore":88,"malwareFamily":"Win/malicious_confidence_90%","antivirusDetections":{"malicious":9,"total":26},"behavioralIndicators":{"malicious":7,"suspicious":9},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:Tcfb,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "aef25409e3448752746dfefad04b29225f2b8c6bbd2d991e3115a4069e97504e.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "aef25409e3448752746dfefad04b29225f2b8c6bbd2d991e3115a4069e97504e.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "aef25409e3448752746dfefad04b29225f2b8c6bbd2d991e3115a4069e97504e.bin") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "aef25409e3448752746dfefad04b29225f2b8c6bbd2d991e3115a4069e97504e.bin") Found reference to API "WaitForMultipleObjects error %d, GetLastError %d" (Indicator: "WaitForMultipleObjects"; File: "aef25409e3448752746dfefad04b29225f2b8c6bbd2d991e3115a4069e97504e.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000964.00000000.182374.00D5F000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000964.00000000.182374.00D5F000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001260.00000000.182697.00D5F000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001260.00000000.182697.00D5F000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001792.00000000.183021.00D5F000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001792.00000000.183021.00D5F000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004332.00000000.176763.0119E000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004332.00000000.176763.0119E000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004692.00000000.179429.01471000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00004692.00000000.179429.01471000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004692.00000000.179429.01471000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00004692.00000000.179429.01471000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00004692.00000000.179429.01471000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00004864.00000000.171955.40017000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00004864.00000000.171955.40017000.00000002.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00004864.00000000.171955.40017000.00000002.mdmp")26:T568,Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "aef25409e3448752746dfefad04b29225f2b8c6bbd2d991e3115a4069e97504e.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "aef25409e3448752746dfefad04b29225f2b8c6bbd2d991e3115a4069e97504e.bin") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "aef25409e3448752746dfefad04b29225f2b8c6bbd2d991e3115a4069e97504e.bin") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "aef25409e3448752746dfefad04b29225f2b8c6bbd2d991e3115a4069e97504e.bin") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004692.00000000.179429.01471000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00004692.00000000.179429.01471000.00000002.mdmp") Found reference to API "LoadLibraryShim" (Indicator: "LoadLibrary"; Source: "00000000-00004864.00000000.171955.40017000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004864.00000000.171955.40017000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00004864.00000000.171955.40017000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00004864.00000000.171955.40017000.00000002.mdmp")27:Te26,Found reference to API "ChangeServiceConfig2" (Indicator: "ChangeServiceConfig"; File: "00000000-00001916.00000000.180756.00D51000.00000020.mdmp") Found reference to API "ChangeServiceConfig" (Indicator: "ChangeServiceConfig"; File: "00000000-00001916.00000000.180756.00D51000.00000020.mdmp") Found reference to API "ChangeServiceConfig2 (delayed autostart flag)" (Indicator: "ChangeServiceConfig"; File: "00000000-00001916.00000000.180756.00D51000.00000020.mdmp") Found reference to API "ControlServiceEx" (Indicator: "ControlService"; File: "00000000-00001916.00000000.180756.00D51000.00000020.mdmp") Found reference to API "ControlService" (Indicator: "ControlService"; File: "00000000-00001916.00000000.180756.00D51000.00000020.mdmp") Found reference to API "ChangeServiceConfigW" (Indicator: "ChangeServiceConfig"; File: "00000000-00001916.00000000.180756.00D51000.00000020.mdmp") Found reference to API "ControlServiceExW" (Indicator: "ControlService"; File: "00000000-00001916.00000000.180756.00D51000.00000020.mdmp") Found reference to API "ChangeServiceConfig2W" (Indicator: "ChangeServiceConfig"; File: "00000000-00001916.00000000.180756.00D51000.00000020.mdmp") Found reference to API "[SC] ChangeServiceConfig SUCCESS" (Indicator: "ChangeServiceConfig"; Source: "00000000-00001260.00000000.182697.03520000.00000004.mdmp") Found reference to API "[SC] ChangeServiceConfig SUCCESS" (Indicator: "ChangeServiceConfig"; Source: "00000000-00001328.00000000.182050.033F0000.00000004.mdmp") Found reference to API "ChangeServiceConfig SUCCESS" (Indicator: "ChangeServiceConfig"; Source: "00000000-00001916.00000000.180756.00C40000.00000004.mdmp") Found reference to API "[SC] ChangeServiceConfig SUCCESS" (Indicator: "ChangeServiceConfig"; Source: "00000000-00001916.00000000.180756.00C40000.00000004.mdmp") Found reference to API "ControlServiceEx" (Indicator: "ControlService"; Source: "00000000-00001916.00000000.180756.00D51000.00000020.mdmp") Found reference to API "ControlService" (Indicator: "ControlService"; Source: "00000000-00001916.00000000.180756.00D51000.00000020.mdmp") Found reference to API "ChangeServiceConfig2 (delayed autostart flag)" (Indicator: "ChangeServiceConfig"; Source: "00000000-00001916.00000000.180756.00D51000.00000020.mdmp") Found reference to API "ChangeServiceConfig" (Indicator: "ChangeServiceConfig"; Source: "00000000-00001916.00000000.180756.00D51000.00000020.mdmp") Found reference to API "ChangeServiceConfig2" (Indicator: "ChangeServiceConfig"; Source: "00000000-00001916.00000000.180756.00D51000.00000020.mdmp") Found reference to API "ChangeServiceConfigW" (Indicator: "ChangeServiceConfig"; Source: "00000000-00001916.00000000.180756.00D51000.00000020.mdmp") Found reference to API "ControlServiceExW" (Indicator: "ControlService"; Source: "00000000-00001916.00000000.180756.00D51000.00000020.mdmp") Found reference to API "ChangeServiceConfig2W" (Indicator: "ChangeServiceConfig"; Source: "00000000-00001916.00000000.180756.00D51000.00000020.mdmp") Found reference to API "ControlService FAILED 1062:" (Indicator: "ControlService"; Source: "00000000-00002916.00000000.181080.03370000.00000004.mdmp") Found reference to API "ChangeServiceConfigA" (Indicator: "ChangeServiceConfig"; Source: "00000000-00004864.00000000.171955.40017000.00000002.mdmp") Found reference to API "ControlService" (Indicator: "ControlService"; Source: "00000000-00004864.00000000.171955.40017000.00000002.mdmp") Found reference to API "[SC] ChangeServiceConfig SUCCESS" (Indicator: "ChangeServiceConfig"; Source: "00000000-00006176.00000000.181403.02F10000.00000004.mdmp")28:T581,Found reference to API "EnumQueryServicesStatus:OpenService" (Indicator: "OpenService"; File: "00000000-00001916.00000000.180756.00D51000.00000020.mdmp") Found reference to API "StartService: OpenService" (Indicator: "OpenService"; File: "00000000-00001916.00000000.180756.00D51000.00000020.mdmp") Found reference to API "OpenService" (Indicator: "OpenService"; File: "00000000-00001916.00000000.180756.00D51000.00000020.mdmp") Found reference to API "artService: OpenService" (Indicator: "OpenService"; File: "00000000-00001916.00000000.180756.00D51000.00000020.mdmp") Found reference to API "OpenServiceW" (Indicator: "OpenService"; File: "00000000-00001916.00000000.180756.00D51000.00000020.mdmp") Found reference to API "EnumQueryServicesStatus:OpenService" (Indicator: "OpenService"; Source: "00000000-00001916.00000000.180756.00D51000.00000020.mdmp") Found reference to API "OpenService" (Indicator: "OpenService"; Source: "00000000-00001916.00000000.180756.00D51000.00000020.mdmp") Found reference to API "StartService: OpenService" (Indicator: "OpenService"; Source: "00000000-00001916.00000000.180756.00D51000.00000020.mdmp") Found reference to API "OpenServiceW" (Indicator: "OpenService"; Source: "00000000-00001916.00000000.180756.00D51000.00000020.mdmp") Found reference to API "OpenServiceA" (Indicator: "OpenService"; Source: "00000000-00004864.00000000.171955.40017000.00000002.mdmp")29:T101f,"" (Indicator: "vmtoolsd.exe"; Source: "00000000-00001792.00000000.183021.00810000.00000004.mdmp") file/memory contains long string with (Indicator: "vmtoolsd.exe"; Source: "00000000-00001916.00000000.180756.00C40000.00000004.mdmp, 00000000-00001916.00000000.180756.02F50000.00000004.mdmp") file/memory contains long string with (Indicator: "vmtoolsd.exe"; Source: "00000000-00001916.00000000.180756.02F50000.00000004.mdmp") file/memory contains long string with (Indicator: "vmtoolsd.exe"; Source: "00000000-00002900.00000000.175467.00A40000.00000004.mdmp, 00000000-00002900.00000000.175467.00D70000.00000004.mdmp") file/memory contains long string with (Indicator: "vmtoolsd.exe"; Source: "00000000-00002900.00000000.175467.00D70000.00000004.mdmp")30:T49b,Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatus"; File: "00000000-00004692.00000000.179429.013C1000.00000020.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatusEx"; File: "00000000-00004692.00000000.179429.013C1000.00000020.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatus"; Source: "00000000-00004692.00000000.179429.01471000.00000002.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatusEx"; Source: "00000000-00004692.00000000.179429.01471000.00000002.mdmp") Found reference to API "GetDiskFreeSpaceW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00004692.00000000.179429.01471000.00000002.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00004692.00000000.179429.01471000.00000002.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpaceEx"; Source: "00000000-00004692.00000000.179429.01471000.00000002.mdmp") Found reference to API "GlobalMemoryStatus" (Indicator: "GlobalMemoryStatus"; Source: "00000000-00004692.00000000.179429.01471000.00000002.mdmp")31:T599,Found system information discovery API: "ExpandEnvironmentStringsW" in file "aef25409e3448752746dfefad04b29225f2b8c6bbd2d991e3115a4069e97504e.bin" Found system information discovery API: "GetSystemInfo" in file "aef25409e3448752746dfefad04b29225f2b8c6bbd2d991e3115a4069e97504e.bin" Found system information discovery API: "GetEnvironmentStringsW" in file "aef25409e3448752746dfefad04b29225f2b8c6bbd2d991e3115a4069e97504e.bin" Found system information discovery API: "GetNativeSystemInfo" in file "00000000-00004692.00000000.179429.013C1000.00000020.mdmp" Found system information discovery API: "RtlNtStatusToDosError" in "00000000-00000964.00000000.182374.00D5F000.00000002.mdmp" Found system information discovery API: "RtlNtStatusToDosError" in "00000000-00001260.00000000.182697.00D5F000.00000002.mdmp" Found system information discovery API: "RtlNtStatusToDosError" in "00000000-00001792.00000000.183021.00D5F000.00000002.mdmp" Found system information discovery API: "GetNativeSystemInfo" in "00000000-00004692.00000000.179429.01471000.00000002.mdmp" Found system information discovery API: "GetSystemInfo" in "00000000-00004692.00000000.179429.01471000.00000002.mdmp" Found system information discovery API: "NtQuerySystemInformation" in "00000000-00004864.00000000.171955.40017000.00000002.mdmp" Found system information discovery API: "GetMonitorInfoA" in "00000000-00004864.00000000.171955.40017000.00000002.mdmp"32:T59d,Found reference to API "SendMessageW" (Indicator: "sendmessage"; File: "aef25409e3448752746dfefad04b29225f2b8c6bbd2d991e3115a4069e97504e.bin") Found reference to API "FindWindowExW" (Indicator: "findwindow"; File: "aef25409e3448752746dfefad04b29225f2b8c6bbd2d991e3115a4069e97504e.bin") Found reference to API "PostMessageW" (Indicator: "postmessage"; File: "aef25409e3448752746dfefad04b29225f2b8c6bbd2d991e3115a4069e97504e.bin") Found reference to API "2291657572,6556,110,,EnumWindows,user32.dll,"00:44:42.906",RX=0,PX=0" (Indicator: "enumwindows"; Source: "00000000-00004864.00000000.171955.02440000.00000004.mdmp") Found reference to API "SendMessageA" (Indicator: "sendmessage"; Source: "00000000-00004864.00000000.171955.40017000.00000002.mdmp") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00004864.00000000.171955.40017000.00000002.mdmp") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; Source: "00000000-00004864.00000000.171955.40017000.00000002.mdmp") Found reference to API "PostMessageA" (Indicator: "postmessage"; Source: "00000000-00004864.00000000.171955.40017000.00000002.mdmp") Found reference to API "SendMessageTimeoutA" (Indicator: "sendmessage"; Source: "00000000-00004864.00000000.171955.40017000.00000002.mdmp") Found reference to API "FindWindowA" (Indicator: "findwindow"; Source: "00000000-00004864.00000000.171955.40017000.00000002.mdmp")33:T78c,"nulColor 0fset "SCRIPT_RUNNING_FLAG=%TEMP%\script_running_%RANDOM%.tmp"if exist "%SCRIPT_RUNNING_FLAG%" exit /becho.> "%SCRIPT_RUNNING_FLAG%"set "Arch=" & set "ArgNsudo=" & set "MainFolder1=" & set "MainFolder2=" & set "ProcList=" & set "NumberWin="SetLocal EnableDelayedExpansioncd /d "%~dp0saked"set "Arch=x64" & (If "%PROCESSOR_ARCHITECTURE%"=="x86" if not defined PROCESSOR_ARCHITEW6432 set Arch=x86)reg query "HKU\S-1-5-19" >nul 2>&1 || ( nircmd elevate "%~f0" del "%SCRIPT_RUNNING_FLAG%" 2>nul exitif defined WT_SESSION ( reg add "HKCU\Console\%%%%Startup" /v "DelegationConsole" /t REG_SZ /d "{B23D10C0-E52E-411E-9D5B-C09FDF709C7D}" /f >nul reg add "HKCU\Console\%%%%Startup" /v "DelegationTerminal" /t REG_SZ /d "{B23D10C0-E52E-411E-9D5B-C09FDF709C7D}" /f >nulreg add "HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /v "AppsUseLightTheme" /t reg_dword /d 0 /f >nul 2>&1set "Version=15.0"set "DateProgram=28.03.25"Mode 79,49for /f "tokens=4 delims=[] " %%v in ('ver') do set "NumberWin=%%v"reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" | find /i "0x0" >nul 2>&1 && set "ArgNsudo=C" || set "ArgNsudo=E"for /f "skip=3 tokens=1" %%a in ('tasklist') do set "ProcList=!ProcList! %%a "for %%p in (SmartScreen MsMpEng SgrmBroker MsSense NisSrv MpCmdRun MPSigStub SecurityHealthSystray SecurityHealthService SecurityHealthHost MpDefenderCoreService) do (if "!ProcList!"=="!ProcList:%%p.exe =!" (set "%%~pP=0a") else (set "%%~pP=0c"))set "ListWDServ=WinDefend MDCoreSvc WdNisSvc Sense wscsvc SgrmBroker SecurityHealthService webthreatdefsvc webthreatdefusersvc WdNisDrv WdBoot WdFilter SgrmAgent MsSecWfp MsSecFlt MsSecCore"for %%x in (%ListWDServ%) do reg query "HKLM\System\CurrentControlSet\Services\%%~x" >nul 2>&1 && set "%%~x=0c" || set "%%~x=0a"if exist "%AllUsersProfile%\Microsoft\Windows Defender" (set "MainFolder1=04") else (set "MainFolder1=0a")if exist "%SystemDrive%\Program Files\Windows Defender" (set "MainFolder2=04") else (set "MainFolder2=0a")set PathTask=%SystemRoot%\System32\Tasks\Microsoft\Windows\Windows Defenderif not exist "%PathTask%\Windows Defender Cache Maintenance" (set "Maintenance=0a") else (set "Maintenance=0c")if not exist "%PathTask%\Windows Defender Scheduled Scan" (set "Scan=0a") else (set "Scan=0c")if not exist "%PathTask%\Windows Defender Verification" (set "Verification=0a") else (set "Verification=0c")if not exist "%PathTask%\Windows Defender Cleanup" (set "Cleanup=0a") else (set "Cleanup=0c"):StartProcessRemovever | findstr /c:"6.1.7601" >nul 2>&1 && goto :SkipUnlockerreg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion" /v "ProductName" | find /i "Windows 7" >nul 2>&1 && goto :SkipUnlockerset "a=7"set "b=z" set "c=x"set "d=-aoa"set "e=-bso0"set "f=-bsp1"set "g=same.zip"set "h=stucha"set "i=mika.exe"%a%%b% %c% %d% %e% %f% "%g%" -p"%h%" "%i%" >nul%i% /CurrentDiskSize:StartUnlockerAndSkipBackupfor %%S in (wuauserv dosvc bits UsoSvc WaaSMedicSvc) do ( sc stop %%S >nul 2>&1 sc config %%S start= disabled >nul 2>&1 taskkill /f /im mika.exe >nul 2>&1 start "" /min mika.exe /DelWD echo.> "%DEFENDER_REMOVED_FLAG%"del "%SCRIPT_RUNNING_FLAG%" 2>nulexit /b" (Indicator: ""del ") in Source: 6ItlIvLOz.bat6d:Tf1b,Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "aef25409e3448752746dfefad04b29225f2b8c6bbd2d991e3115a4069e97504e.bin") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; File: "aef25409e3448752746dfefad04b29225f2b8c6bbd2d991e3115a4069e97504e.bin") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; File: "aef25409e3448752746dfefad04b29225f2b8c6bbd2d991e3115a4069e97504e.bin") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; File: "00000000-00006368.00000001.173430.012F1000.00000020.mdmp") Found reference to API "SeBackupPrivilege" (Indicator: "SeBackupPrivilege"; File: "00000000-00004332.00000000.176763.01151000.00000020.mdmp") Found reference to API "SeImpersonatePrivilege" (Indicator: "SeImpersonatePrivilege"; Source: "00000000-00003068.00000000.173846.03570000.00000004.mdmp") Found reference to API "SeImpersonatePrivilege" (Indicator: "SeImpersonate"; Source: "00000000-00003068.00000000.173846.03570000.00000004.mdmp") Found reference to API "SeBackupPrivilege" (Indicator: "SeBackupPrivilege"; Source: "00000000-00003068.00000000.173846.03570000.00000004.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00003068.00000000.173846.03570000.00000004.mdmp") Found reference to API "SeLoadDriverPrivilege" (Indicator: "SeLoadDriverPrivilege"; Source: "00000000-00003068.00000000.173846.03570000.00000004.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00003068.00000000.173846.03570000.00000004.mdmp") Found reference to API "SeBackupPrivilege" (Indicator: "SeBackupPrivilege"; Source: "00000000-00004332.00000000.176763.01151000.00000020.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00004332.00000000.176763.0119E000.00000002.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00004332.00000000.176763.0119E000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00004692.00000000.179429.01471000.00000002.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00004692.00000000.179429.01471000.00000002.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00004864.00000000.171955.40017000.00000002.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00004864.00000000.171955.40017000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00004864.00000000.171955.40017000.00000002.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00004864.00000000.171955.40017000.00000002.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00006116.00000000.174818.00EF0000.00000004.mdmp") Found reference to API "SeImpersonatePrivilege" (Indicator: "SeImpersonatePrivilege"; Source: "00000000-00006116.00000000.174818.00EF0000.00000004.mdmp") Found reference to API "SeImpersonatePrivilege" (Indicator: "SeImpersonate"; Source: "00000000-00006116.00000000.174818.00EF0000.00000004.mdmp") Found reference to API "SeLoadDriverPrivilege" (Indicator: "SeLoadDriverPrivilege"; Source: "00000000-00006116.00000000.174818.00EF0000.00000004.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00006368.00000000.173381.00930000.00000004.mdmp, 00000000-00006368.00000001.173430.00930000.00000004.mdmp, 00000000-00006368.00000001.173430.012F1000.00000020.mdmp")6e:T7e0,Found reference to API "SetFileSecurityW" (Indicator: "SetFileSecurityW"; File: "aef25409e3448752746dfefad04b29225f2b8c6bbd2d991e3115a4069e97504e.bin") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "aef25409e3448752746dfefad04b29225f2b8c6bbd2d991e3115a4069e97504e.bin") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "aef25409e3448752746dfefad04b29225f2b8c6bbd2d991e3115a4069e97504e.bin") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "aef25409e3448752746dfefad04b29225f2b8c6bbd2d991e3115a4069e97504e.bin") Found reference to API "GetSecurityDescriptorControl" (Indicator: "GetSecurityDescriptorControl"; File: "00000000-00001916.00000000.180756.00D51000.00000020.mdmp") Found reference to API "GetSecurityDescriptorControl" (Indicator: "GetSecurityDescriptorControl"; Source: "00000000-00000964.00000000.182374.00D5F000.00000002.mdmp") Found reference to API "GetSecurityDescriptorControl" (Indicator: "GetSecurityDescriptorControl"; Source: "00000000-00001260.00000000.182697.00D5F000.00000002.mdmp") Found reference to API "GetSecurityDescriptorControl" (Indicator: "GetSecurityDescriptorControl"; Source: "00000000-00001792.00000000.183021.00D5F000.00000002.mdmp") Found reference to API "GetSecurityDescriptorControl" (Indicator: "GetSecurityDescriptorControl"; Source: "00000000-00001916.00000000.180756.00D51000.00000020.mdmp") Found reference to API "SetFileSecurityW" (Indicator: "SetFileSecurityW"; Source: "00000000-00004692.00000000.179429.01471000.00000002.mdmp") Found reference to API "GetFileSecurityW" (Indicator: "GetFileSecurityW"; Source: "00000000-00004692.00000000.179429.01471000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; Source: "00000000-00004864.00000000.171955.40017000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; Source: "00000000-00004864.00000000.171955.40017000.00000002.mdmp")6f:T508,Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "aef25409e3448752746dfefad04b29225f2b8c6bbd2d991e3115a4069e97504e.bin") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "aef25409e3448752746dfefad04b29225f2b8c6bbd2d991e3115a4069e97504e.bin") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "aef25409e3448752746dfefad04b29225f2b8c6bbd2d991e3115a4069e97504e.bin") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00000964.00000000.182374.00D5F000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00001260.00000000.182697.00D5F000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00001792.00000000.183021.00D5F000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00004332.00000000.176763.0119E000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00004332.00000000.176763.0119E000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00004864.00000000.171955.40017000.00000002.mdmp")70:Tf8b,Found reference to API "SeSecurityPrivilege" (Indicator: "SeSecurityPrivilege"; File: "aef25409e3448752746dfefad04b29225f2b8c6bbd2d991e3115a4069e97504e.bin") Found reference to API "SeRestorePrivilege" (Indicator: "SeRestorePrivilege"; File: "aef25409e3448752746dfefad04b29225f2b8c6bbd2d991e3115a4069e97504e.bin") Found reference to API "SeCreateSymbolicLinkPrivilege" (Indicator: "SeCreateSymbolicLinkPrivilege"; File: "aef25409e3448752746dfefad04b29225f2b8c6bbd2d991e3115a4069e97504e.bin") Found reference to API "SeLockMemoryPrivilege" (Indicator: "SeLockMemoryPrivilege"; File: "00000000-00004692.00000000.179429.013C1000.00000020.mdmp") Found reference to API "SeRestorePrivilege" (Indicator: "SeRestorePrivilege"; Source: "00000000-00003068.00000000.173846.03570000.00000004.mdmp") Found reference to API "SeChangeNotifyPrivilege" (Indicator: "SeChangeNotifyPrivilege"; Source: "00000000-00003068.00000000.173846.03570000.00000004.mdmp") Found reference to API "SeSecurityPrivilege" (Indicator: "SeSecurityPrivilege"; Source: "00000000-00003068.00000000.173846.03570000.00000004.mdmp") Found reference to API "SeIncreaseQuotaPrivilege" (Indicator: "SeIncreaseQuotaPrivilege"; Source: "00000000-00003068.00000000.173846.03570000.00000004.mdmp") Found reference to API "SeAssignPrimaryTokenPrivilege" (Indicator: "SeAssignPrimaryTokenPrivilege"; Source: "00000000-00003068.00000000.173846.03570000.00000004.mdmp") Found reference to API "SeTcbPrivilege" (Indicator: "SeTcbPrivilege"; Source: "00000000-00003068.00000000.173846.03570000.00000004.mdmp") Found reference to API "SeIncreaseBasePriorityPrivilege" (Indicator: "SeIncreaseBasePriorityPrivilege"; Source: "00000000-00003068.00000000.173846.03570000.00000004.mdmp") Found reference to API "SeSystemEnvironmentPrivilege" (Indicator: "SeSystemEnvironmentPrivilege"; Source: "00000000-00003068.00000000.173846.03570000.00000004.mdmp") Found reference to API "SeTakeOwnershipPrivilege" (Indicator: "SeTakeOwnershipPrivilege"; Source: "00000000-00003068.00000000.173846.03570000.00000004.mdmp") Found reference to API "SeRestorePrivilege" (Indicator: "SeRestorePrivilege"; Source: "00000000-00004332.00000000.176763.01151000.00000020.mdmp") Found reference to API "SeLockMemoryPrivilege" (Indicator: "SeLockMemoryPrivilege"; Source: "00000000-00004692.00000000.179429.01471000.00000002.mdmp") Found reference to API "SeCreateSymbolicLinkPrivilege" (Indicator: "SeCreateSymbolicLinkPrivilege"; Source: "00000000-00004692.00000000.179429.01471000.00000002.mdmp") Found reference to API "SeRestorePrivilege" (Indicator: "SeRestorePrivilege"; Source: "00000000-00004692.00000000.179429.01471000.00000002.mdmp") Found reference to API "SeSecurityPrivilege" (Indicator: "SeSecurityPrivilege"; Source: "00000000-00004692.00000000.179429.01471000.00000002.mdmp, 00000000-00004692.00000000.179429.036C0000.00000004.mdmp") Found reference to API "SeTcbPrivilege" (Indicator: "SeTcbPrivilege"; Source: "00000000-00004864.00000000.171955.40017000.00000002.mdmp") Found reference to API "SeAuditPrivilege" (Indicator: "SeAuditPrivilege"; Source: "00000000-00006116.00000000.174818.00EF0000.00000004.mdmp") Found reference to API "SeChangeNotifyPrivilege" (Indicator: "SeChangeNotifyPrivilege"; Source: "00000000-00006116.00000000.174818.00EF0000.00000004.mdmp") Found reference to API "SeCreateGlobalPrivilege" (Indicator: "SeCreateGlobalPrivilege"; Source: "00000000-00006116.00000000.174818.00EF0000.00000004.mdmp") Found reference to API "SeCreatePagefilePrivilege" (Indicator: "SeCreatePagefilePrivilege"; Source: "00000000-00006116.00000000.174818.00EF0000.00000004.mdmp") Found reference to API "SeCreatePermanentPrivilege" (Indicator: "SeCreatePermanentPrivilege"; Source: "00000000-00006116.00000000.174818.00EF0000.00000004.mdmp") Found reference to API "SeIncreaseBasePriorityPrivilege" (Indicator: "SeIncreaseBasePriorityPrivilege"; Source: "00000000-00006116.00000000.174818.00EF0000.00000004.mdmp")71:T4e6,"cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\CMD.EXE"; Value: "DC83EB1C97BBDC010000000000000000000000000200000000") "cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\CMD.EXE"; Value: "37AA5D2097BBDC010000000000000000000000000200000000") "cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\CMD.EXE"; Value: "L(qU") "mika.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "D10E565E97BBDC010000000000000000000000000200000000") "mika.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "405CCF6197BBDC010000000000000000000000000200000000")72:Tb20,"