26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 3a:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T495,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious BrResMon.Generic Sample bc822ed93473… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample bc822ed93473…. Malware family: BrResMon.Generic. Threat score 100/100. 20/26 AV engines flagged this file. 7 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5","keywords":["Malicious","BrResMon.Generic","malware analysis","sandbox report","threat intelligence","bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5"],"about":{"@type":"SoftwareApplication","name":"uw5hc20zr4z37g.exe","applicationCategory":["peexe","executable"],"identifier":"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"BrResMon.Generic","antivirusDetections":{"malicious":20,"total":26},"behavioralIndicators":{"malicious":7,"suspicious":14},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T1d8e,"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e8d49c008cd49c00226e637500007c04000000002d6e6375071795782d000000ecb72f7610d59c000000a00258dabe02b8b2bd021e0000008000000050d49c000000a002d4d49c0070c8647573b2600dfeffffff2d000000d0cc3e7627000000a4d49c00856a65751c236a75e4d49c00f85f657508000000bb696475b26964756f1795782d000000ecb72f7627000000d0cc3e76b8d49c002d000000d0cc3e7627000000e8d49c00856a65751c236a7530d59c007e8a3d76ee8c3d76738a3d76efa5d93e2d000000ecb72f7627000000d0cc3e762c117c04c0107c04efa5d93ef8d49c00fc527b76e4d59c00e0843d76e7813c48feffffff738a3d76 (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff0000000018c32b0538cf7d77cc36bd0284c32b05010000008036bd02cc36bd028036bd02040000000400000000e0cc740010000084c32b05010000008036bd02cd977d779c977d77b8870bb6b50fc3748036bd0200007d7700000000741fa16f0000000080eec9740100000000000000f8e2cc74000000000400000080a912744840cb74f8e2cc7488c32b0580e84f749008be0280e84f7484c32b050000000080e84f7400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000008662c6029c62c602 (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000096ccc602aeccc602 (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000008662c6029a62c602 (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000002e00c7024600c702 (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000660dc7027c0dc702 (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000060dc7021e0dc702 (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000f610c7020e11c702 (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003672)28:T648,"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\cmd.exe" /C mkdir %WINDIR%\SysWOW64\fkutbjme\" - (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\cmd.exe" /C move /Y "%TEMP%\wiqntgmk.exe" %WINDIR%\SysWOW64\fkutbjme\" - (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\sc.exe" create fkutbjme binPath= "%WINDIR%\SysWOW64\fkutbjme\wiqntgmk.exe /d\"C:\bc822ed934731c6843e138a7b5" - (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\sc.exe" description fkutbjme "wifi internet conection"" - (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\sc.exe" start fkutbjme" - (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow prog" - (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "CreateProcessA" with parameter ""%USERPROFILE%\nwcnlas.exe" /d"C:\bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe"" - (UID: 00000000-00003672)29:T1238,"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "LoadLibrary" with a parameter msimg32.dll (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "LoadLibrary" with a parameter dbghelp.dll (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "LoadLibrary" with a parameter msvcr100.dll (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003672) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002252) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002252) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002252) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002252) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007808) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007808) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007808) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007808) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005380) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005380) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005380) "sc.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005380) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007960) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007960) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007960) "sc.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007960) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006108) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006108) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006108) "sc.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006108) "nwcnlas.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000264) "nwcnlas.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000264) "nwcnlas.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000264) "nwcnlas.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000264)2a:Td00d,"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter GlobalAlloc (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter Module32First (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter VirtualFree (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter GetVersionExA (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter TerminateProcess (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter SetErrorMode (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter StackWalk64 (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter GetVolumeInformationA (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter GetComputerNameA (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter GetTickCount (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter GetModuleHandleA (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter lstrcmpiA (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter lstrlenA (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter lstrcpynA (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter InterlockedExchange (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter GetOverlappedResult (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter DisconnectNamedPipe (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter ConnectNamedPipe (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter CreateNamedPipeA (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableA (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter DeleteFileA (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter IsBadWritePtr (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter IsBadCodePtr (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter lstrcpyA (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter lstrcmpA (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter IsBadReadPtr (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter WriteProcessMemory (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter VirtualAllocEx (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter SetFileAttributesA (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter GetDiskFreeSpaceA (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter GetWindowsDirectoryA (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter GetFileAttributesExA (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter CreateProcessA (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter GetTempPathA (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter SystemTimeToFileTime (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter GetSystemTime (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter DeviceIoControl (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter GetModuleFileNameA (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter SetThreadContext (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter lstrcatA (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter CreateThread (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter GetDriveTypeA (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter GetCommandLineA (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter SetUnhandledExceptionFilter (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter InterlockedIncrement (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter GetLocalTime (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter FileTimeToLocalFileTime (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter FileTimeToSystemTime (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter InterlockedDecrement (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter HeapSize (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter GetSystemTimeAsFileTime (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter MultiByteToWideChar (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter lstrlenW (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter GetStartupInfoW (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter GetProcessHeap (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter HeapAlloc (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter HeapReAlloc (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter HeapFree (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter CreateEventA (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter GetSystemDirectoryA (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter wsprintfA (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter CharToOemA (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidA (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter CreateProcessWithLogonW (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter RegCreateKeyExA (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter StartServiceCtrlDispatcherA (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter RegisterServiceCtrlHandlerA (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter SetServiceStatus (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter RegDeleteValueA (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter RegGetKeySecurity (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter RegSetKeySecurity (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter RegSetValueExA (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter GetLengthSid (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter GetFileSecurityA (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter GetSecurityDescriptorOwner (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorOwner (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter SetFileSecurityA (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter GetSecurityDescriptorDacl (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter GetAce (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter DeleteAce (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter RegEnumKeyA (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter RegOpenKeyExA (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter RegEnumValueA (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter LookupAccountNameW (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter LookupAccountNameA (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter GetUserNameA (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter ShellExecuteA (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter ShellExecuteExW (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter atexit (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter GetSystemWow64DirectoryA (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "GetProcAddress" with a parameter _allmul (UID: 00000000-00003672) "cmd.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002252) "cmd.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002252) "cmd.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002252) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002252) "cmd.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002252) "cmd.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002252) "cmd.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00002252) "cmd.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00002252) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00002252) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00002252) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00002252) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00002252) "cmd.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00002252) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00002252) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00002252) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00002252) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00002252) "cmd.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00002252) "cmd.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00002252) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00002252) "cmd.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00002252) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00002252) "cmd.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00002252) "cmd.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00002252) "cmd.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00002252) "cmd.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00002252) "cmd.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002252) "cmd.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00002252) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002252) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002252) "cmd.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00002252) "cmd.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002252) "cmd.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00002252) "cmd.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002252) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00002252) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00002252) "cmd.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00002252) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00002252) "cmd.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00002252) "cmd.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002252) "cmd.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002252) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002252) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002252) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00002252) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00002252) "cmd.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007808) "cmd.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007808) "cmd.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007808) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007808) "cmd.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007808) "cmd.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007808) "cmd.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007808) "cmd.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007808) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007808) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007808) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007808) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007808) "cmd.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007808) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007808) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007808) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007808) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007808) "cmd.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007808) "cmd.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007808) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007808) "cmd.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007808) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007808) "cmd.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007808) "cmd.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007808) "cmd.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007808) "cmd.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007808) "cmd.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007808) "cmd.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007808) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007808) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007808) "cmd.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007808) "cmd.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007808) "cmd.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007808) "cmd.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007808) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007808) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007808) "cmd.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007808) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007808) "cmd.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007808) "cmd.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007808) "cmd.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007808) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007808) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007808) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007808) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007808) "sc.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005380) "sc.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005380) "sc.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005380) "sc.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005380) "sc.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005380) "sc.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005380) "sc.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005380) "sc.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005380) "sc.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005380) "sc.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005380) "sc.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005380) "sc.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005380) "sc.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005380) "sc.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005380) "sc.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005380) "sc.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005380) "sc.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005380) "sc.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005380) "sc.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005380) "sc.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005380) "sc.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005380) "sc.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005380) "sc.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005380) "sc.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005380) "sc.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005380) "sc.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005380) "sc.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005380) "sc.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005380) "sc.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005380) "sc.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005380) "sc.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005380) "sc.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005380) "sc.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005380) "sc.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005380) "sc.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005380) "sc.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005380) "sc.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005380) "sc.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005380) "sc.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005380) "sc.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005380) "sc.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005380) "sc.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005380) "sc.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005380) "sc.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005380) "sc.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005380) "sc.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007960) "sc.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007960) "sc.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007960) "sc.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007960) "sc.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007960) "sc.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007960) "sc.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007960) "sc.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007960) "sc.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007960) "sc.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007960) "sc.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007960) "sc.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007960) "sc.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007960) "sc.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007960) "sc.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007960) "sc.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007960) "sc.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007960) "sc.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007960) "sc.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007960) "sc.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007960) "sc.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007960) "sc.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007960) "sc.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007960) "sc.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007960) "sc.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007960) "sc.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007960) "sc.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007960) "sc.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007960) "sc.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007960) "sc.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007960) "sc.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007960) "sc.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007960) "sc.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007960) "sc.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007960) "sc.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007960) "sc.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007960) "sc.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007960) "sc.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007960) "sc.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007960) "sc.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007960) "sc.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007960) "sc.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007960) "sc.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007960) "sc.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007960) "sc.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007960) "sc.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006108) "sc.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006108) "sc.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006108) "sc.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006108) "sc.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006108) "sc.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006108) "sc.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006108) "sc.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006108) "sc.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006108) "sc.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006108) "sc.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006108) "sc.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006108) "sc.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006108) "sc.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006108) "sc.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006108) "sc.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006108) "sc.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006108) "sc.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006108) "sc.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006108) "sc.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006108) "sc.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006108) "sc.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006108) "sc.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006108) "sc.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006108) "sc.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006108) "sc.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006108) "sc.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006108) "sc.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006108) "sc.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006108) "sc.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006108) "sc.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006108) "sc.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006108) "sc.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006108) "sc.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006108) "sc.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006108) "sc.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006108) "sc.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006108) "sc.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006108) "sc.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006108) "sc.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006108) "sc.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006108) "sc.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006108) "sc.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006108) "sc.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006108) "sc.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006108) "nwcnlas.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00000264) "nwcnlas.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00000264) "nwcnlas.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00000264) "nwcnlas.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000264) "nwcnlas.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00000264) "nwcnlas.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00000264) "nwcnlas.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00000264) "nwcnlas.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00000264) "nwcnlas.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00000264) "nwcnlas.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00000264) "nwcnlas.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00000264) "nwcnlas.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00000264) "nwcnlas.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00000264) "nwcnlas.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00000264) "nwcnlas.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00000264) "nwcnlas.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00000264) "nwcnlas.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00000264) "nwcnlas.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00000264) "nwcnlas.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00000264) "nwcnlas.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00000264) "nwcnlas.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00000264) "nwcnlas.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00000264) "nwcnlas.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00000264) "nwcnlas.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00000264) "nwcnlas.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00000264) "nwcnlas.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00000264) "nwcnlas.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00000264) "nwcnlas.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00000264) "nwcnlas.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00000264) "nwcnlas.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00000264) "nwcnlas.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00000264) "nwcnlas.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00000264) "nwcnlas.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00000264) "nwcnlas.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00000264) "nwcnlas.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00000264) "nwcnlas.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00000264) "nwcnlas.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00000264) "nwcnlas.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00000264) "nwcnlas.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00000264) "nwcnlas.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00000264) "nwcnlas.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00000264) "nwcnlas.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00000264) "nwcnlas.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00000264) "nwcnlas.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00000264) "nwcnlas.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00000264) "nwcnlas.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00000264) "nwcnlas.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00000264)2b:T6876,Found reference to API (Indicator: "AreAnyAccessesGranted"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "GetThreadPriority"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "GlobalSize"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "FindFirstVolumeMountPointA"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "GetCurrentThreadId"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "HeapCreate"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "GetModuleFileNameA"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "SetFileAttributesW"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "RaiseException"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "GetCurrentProcessId"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "WideCharToMultiByte"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "DeleteFileA"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "lstrcpyA"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "GetModuleHandleW"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "HeapReAlloc"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "TlsAlloc"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "EnumResourceLanguagesA"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "Sleep"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "InterlockedExchange"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "GetACP"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "RtlUnwind"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "GetConsoleAliasesLengthW"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "IsDebuggerPresent"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "AddAtomA"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "CreateHardLinkA"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "GetFileType"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "SetLastError"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "LocalAlloc"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "GetTickCount"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "SetComputerNameA"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "GetComputerNameA"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "InterlockedIncrement"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "GetStartupInfoW"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "GetStdHandle"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "LoadLibraryW"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "GetOEMCP"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "EnterCriticalSection"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "TlsGetValue"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "ExitProcess"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "TransmitCommChar"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "HeapAlloc"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "SetConsoleMode"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "TerminateProcess"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "GetLastError"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "GetProcAddress"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "DeleteCriticalSection"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "CreateJobObjectW"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "LCMapStringA"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "VirtualFree"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "GetCommConfig"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "VirtualAlloc"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "InterlockedDecrement"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "GetCPInfo"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "WriteConsoleOutputCharacterW"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "ResetWriteWatch"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "SetSystemTime"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "FlushInstructionCache"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "WriteFile"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "LeaveCriticalSection"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "GetStringTypeA"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "GetConsoleAliasA"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "HeapFree"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "QueryDosDeviceW"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "TlsFree"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "WriteConsoleA"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "GetLocaleInfoA"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "LCMapStringW"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "IsValidCodePage"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "FindFirstChangeNotificationW"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "GetStartupInfoA"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "MultiByteToWideChar"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "BackupRead"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "TlsSetValue"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "HeapSize"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "GetModuleHandleA"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "GetModuleFileNameW"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "GetCurrentProcess"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "InterlockedExchangeAdd"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "LoadLibraryA"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "RemoveDirectoryW"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "GetCommandLineW"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "SetHandleCount"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "SetComputerNameExW"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "GlobalFindAtomA"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "GetStringTypeW"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "CharLowerBuffW"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "EncodePointer"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "DecodePointer"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "FlsFree"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "FlsSetValue"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "FlsGetValue"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "FlsAlloc"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "GetProcessWindowStation"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "GetUserObjectInformationA"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "GetLastActivePopup"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "GetActiveWindow"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "MessageBoxA"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "GetProcessWindowStation"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "GetUserObjectInformationA"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "GetActiveWindow"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "GetComputerNameA"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "FindFirstChangeNotificationW"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleOutputCharacterW"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleAliasesLengthW"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleAliasA"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "GlobalSize"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "CreateJobObjectW"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "CreateHardLinkA"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "GetCommConfig"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "GlobalFindAtomA"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleMode"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "EnumResourceLanguagesA"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "SetComputerNameExW"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "FlushInstructionCache"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "InterlockedExchange"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "BackupRead"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "SetComputerNameA"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleA"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "InterlockedExchangeAdd"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "TransmitCommChar"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryW"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "QueryDosDeviceW"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "AddAtomA"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "SetSystemTime"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "FindFirstVolumeMountPointA"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "GetThreadPriority"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "ResetWriteWatch"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesW"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "lstrcpyA"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "CharLowerBuffW"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "AreAnyAccessesGranted"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "SetHandleCount"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoA"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "InterlockedIncrement"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "InterlockedDecrement"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "HeapCreate"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringA"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeA"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoA"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API (Indicator: "CryptEncrypt"; Source: "00000000-00000264.00000001.165830.02DF0000.00000004.mdmp") Found reference to API (Indicator: "CryptExportKey"; Source: "00000000-00000264.00000001.165830.02DF0000.00000004.mdmp") Found reference to API (Indicator: "CryptExportKey"; Source: "00000000-00003672.00000001.163123.02BD0000.00000004.mdmp") Found reference to API (Indicator: "CryptEncrypt"; Source: "00000000-00003672.00000001.163123.02BD0000.00000004.mdmp")2c:T154c,"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74b20000 "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74b20000 "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74b20000 "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" loaded module "KERNEL32" at base 776c0000 "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 733e0000 "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" loaded module "KERNEL32.DLL" at base 776c0000 "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" loaded module "MSIMG32.DLL" at base 73350000 "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" loaded module "WS2_32.DLL" at base 77650000 "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 776c0000 "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" loaded module "API-MS-WIN-CORE-FILE-L1-2-1.DLL" at base 74b20000 "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" loaded module "DBGHELP.DLL" at base 731c0000 "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" loaded module "USER32.DLL" at base 76070000 "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" loaded module "ADVAPI32.DLL" at base 759e0000 "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" loaded module "SHELL32.DLL" at base 762d0000 "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" loaded module "OLEAUT32.DLL" at base 741d0000 "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" loaded module "MSVCR100.DLL" at base 73100000 "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" loaded module "NTDLL.DLL" at base 77790000 "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73c60000 "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" loaded module "RPCRT4.DLL" at base 75920000 "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" loaded module "%WINDIR%\SYSWOW64\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 72e20000 "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 743e0000 "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73700000 "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 72cf0000 "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 762d0000 "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 73aa0000 "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" loaded module "MSISO.DLL" at base 72c90000 "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" loaded module "SSPICLI.DLL" at base 741b0000 "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 74b20000 "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74100000 "cmd.exe" loaded module "KERNEL32" at base 776c0000 "cmd.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 74b20000 "cmd.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 74b20000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 74b20000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 74a00000 "cmd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74b20000 "cmd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74b20000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74b20000 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 733e0000 "sc.exe" loaded module "KERNEL32" at base 776c0000 "sc.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 74b20000 "sc.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 74b20000 "sc.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 74b20000 "sc.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 74a00000 "sc.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74b20000 "sc.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74b20000 "sc.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74b20000 "sc.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 733e0000 "sc.exe" loaded module "RPCRT4.DLL" at base 75920000 "nwcnlas.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74b20000 "nwcnlas.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74b20000 "nwcnlas.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74b20000 "nwcnlas.exe" loaded module "KERNEL32" at base 776c0000 "nwcnlas.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 733e00002d:T17e9,"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" touched "Network" (Path: "HKCU\WOW6432NODE\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" touched "Recycle Bin" (Path: "HKCU\WOW6432NODE\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" touched "Control Panel" (Path: "HKCU\WOW6432NODE\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" touched "UsersFiles" (Path: "HKCU\WOW6432NODE\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" touched "UsersLibraries" (Path: "HKCU\WOW6432NODE\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" touched "CLSID_SearchFolder" (Path: "HKCU\WOW6432NODE\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\WOW6432NODE\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" touched "Public Folder" (Path: "HKCU\WOW6432NODE\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\WOW6432NODE\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" touched "This Device" (Path: "HKCU\WOW6432NODE\CLSID\{5B934B42-522B-4C34-BBFE-37A3EF7B9C90}\SHELLFOLDER") "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" touched "CLSID_AppInstanceFolder" (Path: "HKCU\WOW6432NODE\CLSID\{64693913-1C21-4F30-A98F-4E52906D3B56}\SHELLFOLDER") "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\WOW6432NODE\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" touched "CLSID_SearchHome" (Path: "HKCU\WOW6432NODE\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" touched "CLSID_StartMenuLauncherProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{98F275B4-4FFF-11E0-89E2-7B86DFD72085}\SHELLFOLDER") "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" touched "CLSID_StartMenuCommandingProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{A00EE528-EBD9-48B8-944A-8942113D46AC}\SHELLFOLDER") "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" touched "Other Users Folder" (Path: "HKCU\WOW6432NODE\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\WOW6432NODE\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" touched "Games Explorer" (Path: "HKCU\WOW6432NODE\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER") "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" touched "StreamBackedFolder" (Path: "HKCU\WOW6432NODE\CLSID\{EDC978D6-4D53-4B2F-A265-5805674BE568}\SHELLFOLDER") "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" touched "Computers and Devices" (Path: "HKCU\WOW6432NODE\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" touched "Removable Drives" (Path: "HKCU\WOW6432NODE\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\SHELLFOLDER") "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" touched "Private Profile Object" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{75847177-F077-4171-BD2C-A6BB2164FBD0}\INPROCSERVER32") "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" touched "Sync root manager" (Path: "HKCU\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" touched "ExecuteAssociation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{1649D1CF-DEAF-4A68-ABE8-5C9F68572FD1}\INPROCSERVER32") "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" touched "Security Manager" (Path: "HKCU\WOW6432NODE\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS")2e:T8b3,Observed system executable string:"%WINDIR%\SysWOW64\cmd.exe" [Source: 00000000-00003672-00000BC0-1551237443] Observed system executable string:"%WINDIR%\SysWOW64\sc.exe" [Source: 00000000-00003672-00000BC0-1551569632] Observed system executable string:"%WINDIR%\SysWOW64\netsh.exe" [Source: 00000000-00003672-00000BC0-1552671213] Observed system executable string:"%WINDIR%\System32\cmd.exe" [Source: 00000000-00003672-00000C46-94052476774] Observed system executable string:""%WINDIR%\System32\cmd.exe" /C mkdir %WINDIR%\SysWOW64\fkutbjme\" [Source: 00000000-00003672-00000C46-94052476774] Observed system executable string:""%WINDIR%\System32\cmd.exe" /C move /Y "%TEMP%\wiqntgmk.exe" %WINDIR%\SysWOW64\fkutbjme\" [Source: 00000000-00003672-00000C46-94741043176] Observed system executable string:"%WINDIR%\System32\sc.exe" [Source: 00000000-00003672-00000C46-95538940976] Observed system executable string:""%WINDIR%\System32\sc.exe" create fkutbjme binPath= "%WINDIR%\SysWOW64\fkutbjme\wiqntgmk.exe /d\"C:\bc822ed934731c6843e138a7b5" [Source: 00000000-00003672-00000C46-95538940976] Observed system executable string:"create fkutbjme binPath= "%WINDIR%\SysWOW64\fkutbjme\wiqntgmk.exe /d\"C:\bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe\"" type= own start= auto DisplayName= "wifi support"" [Source: 00000000-00003672-00000C70-95550215656] Observed system executable string:""%WINDIR%\System32\sc.exe" description fkutbjme "wifi internet conection"" [Source: 00000000-00003672-00000C46-96349235792] Observed system executable string:""%WINDIR%\System32\sc.exe" start fkutbjme" [Source: 00000000-00003672-00000C46-97181852544] Observed system executable string:"%WINDIR%\System32\netsh.exe" [Source: 00000000-00003672-00000C46-98183649348] Observed system executable string:""%WINDIR%\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow prog" [Source: 00000000-00003672-00000C46-98183649348] Observed system executable string:"advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul" [Source: 00000000-00003672-00000C70-98213724144]2f:T6a7,"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}"; Key: ""; Value: "") "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}\PROPERTIES"; Key: ""; Value: "") "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME"; Key: ""; Value: "") "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-100000000000}\"; Key: ""; Value: "") "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-501F00000000}\"; Key: ""; Value: "") "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: ""; Value: "") "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: ""; Value: "") "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE"; Key: ""; Value: "")30:T12e0,"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-100000000000}"; Key: "DATA"; Value: "") "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-100000000000}"; Key: "GENERATION"; Value: "") "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-501F00000000}"; Key: "DATA"; Value: "") "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-501F00000000}"; Key: "GENERATION"; Value: "") "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOPROPERTIESMYCOMPUTER"; Value: "") "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOPROPERTIESMYCOMPUTER"; Value: "") "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOPROPERTIESRECYCLEBIN"; Value: "") "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOPROPERTIESRECYCLEBIN"; Value: "") "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOCONTROLPANEL"; Value: "") "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOCONTROLPANEL"; Value: "") "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOSETFOLDERS"; Value: "") "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOSETFOLDERS"; Value: "") "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOINTERNETICON"; Value: "") "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOINTERNETICON"; Value: "") "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE"; Key: "VALIDATEREGITEMS"; Value: "") "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE"; Key: "MONITORREGISTRY"; Value: "") "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOCOMMONGROUPS"; Value: "") "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOCOMMONGROUPS"; Value: "") "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: "MAXRPCSIZE"; Value: "") "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME"; Value: "") "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "OOBEINPROGRESS"; Value: "") "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "SYSTEMSETUPINPROGRESS"; Value: "") "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: "IDLETIMERWINDOW"; Value: "")31:T69d,"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" trying to touch file "C:\Windows\System32\WOW64LOG.DLL" "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" trying to touch file "C:\Windows\SysWOW64\apphelp.dll" "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" trying to touch file "C:\bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" trying to touch file "C:\Windows\SysWOW64\ntdll.dll" "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" trying to touch file "C:\Windows\SysWOW64\kernel32.dll" "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" trying to touch file "C:\Windows\SysWOW64\KernelBase.dll" "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" trying to touch file "C:\Windows\SysWOW64\win32u.dll" "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" trying to touch file "C:\Windows\SysWOW64\ucrtbase.dll" "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" trying to touch file "C:\Windows\SysWOW64\msvcp_win.dll" "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" trying to touch file "C:\Windows\SysWOW64\gdi32full.dll" "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" trying to touch file "C:\Windows\SysWOW64\gdi32.dll" "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" trying to touch file "C:\Windows\SysWOW64\user32.dll"32:Tb49,"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" trying to access non-existent file "C:\FLTLIB.DLL" "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" trying to access non-existent file "C:\MSIMG32.DLL" "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" trying to access non-existent file "C:\msimg32.dll" "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" trying to access non-existent file "C:\DBGHELP.DLL" "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" trying to access non-existent file "C:\dbghelp.dll" "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" trying to access non-existent file "C:\MSVCR100.DLL" "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" trying to access non-existent file "C:\msvcr100.dll" "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" trying to access non-existent file "C:\PROPSYS.DLL" "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" trying to access non-existent file "C:\PROPSYS.dll" "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" trying to access non-existent file "C:\CLDAPI.DLL" "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" trying to access non-existent file "C:\CLDAPI.dll" "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" trying to access non-existent file "C:\AEPIC.DLL" "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" trying to access non-existent file "C:\AEPIC.dll" "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" trying to access non-existent file "C:\BCRYPT.DLL" "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" trying to access non-existent file "C:\bcrypt.dll" "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" trying to access non-existent file "C:\EDPUTIL.DLL" "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" trying to access non-existent file "C:\edputil.dll" "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" trying to access non-existent file "C:\URLMON.DLL" "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" trying to access non-existent file "C:\urlmon.dll"33:T41e,"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" trying to access non-existent file "\Device\NamedPipe\rwgfnvyq" "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" trying to access non-existent file "C:\Windows\SysWOW64\cmd.exe:ZONE.IDENTIFIER" "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" trying to access non-existent file "C:\Windows\System32\cmd.exe:Zone.Identifier" "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" trying to access non-existent file "C:\Windows\SysWOW64\sc.exe:ZONE.IDENTIFIER" "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" trying to access non-existent file "C:\Windows\System32\sc.exe:Zone.Identifier" "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" trying to access non-existent file "C:\Windows\SysWOW64\netsh.exe:ZONE.IDENTIFIER" "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" trying to access non-existent file "C:\Windows\System32\netsh.exe:Zone.Identifier"34:Te48,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00000264.00000000.163909.02DF0000.00000004.mdmp, 00000000-00000264.00000001.165830.02DF0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00000264.00000000.163909.02DF0000.00000004.mdmp, 00000000-00000264.00000001.165830.02DF0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00000264.00000000.163909.02DF0000.00000004.mdmp, 00000000-00000264.00000001.165830.02DF0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00000264.00000000.163909.02DF0000.00000004.mdmp, 00000000-00000264.00000001.165830.02DF0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00000264.00000000.163909.02DF0000.00000004.mdmp, 00000000-00000264.00000001.165830.02DF0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00000264.00000000.163909.02DF0000.00000004.mdmp, 00000000-00000264.00000001.165830.02DF0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00000264.00000000.163909.02DF0000.00000004.mdmp, 00000000-00000264.00000001.165830.02DF0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00000264.00000000.163909.02DF0000.00000004.mdmp, 00000000-00000264.00000001.165830.02DF0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00003672.00000000.161203.02BD0000.00000004.mdmp, 00000000-00003672.00000001.163123.02BD0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00003672.00000000.161203.02BD0000.00000004.mdmp, 00000000-00003672.00000001.163123.02BD0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00003672.00000000.161203.02BD0000.00000004.mdmp, 00000000-00003672.00000001.163123.02BD0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00003672.00000000.161203.02BD0000.00000004.mdmp, 00000000-00003672.00000001.163123.02BD0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00003672.00000000.161203.02BD0000.00000004.mdmp, 00000000-00003672.00000001.163123.02BD0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00003672.00000000.161203.02BD0000.00000004.mdmp, 00000000-00003672.00000001.163123.02BD0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00003672.00000000.161203.02BD0000.00000004.mdmp, 00000000-00003672.00000001.163123.02BD0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00003672.00000000.161203.02BD0000.00000004.mdmp, 00000000-00003672.00000001.163123.02BD0000.00000004.mdmp")35:T5d0,Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00000264.00000001.165830.0041E000.00000002.mdmp")36:T5f3,"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\CMD.EXE"; Value: "") "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\SC.EXE"; Value: "") "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\NWCNLAS.EXE"; Value: "") "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\NETSH.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "sc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "")37:T554,"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\cmd.exe" /C mkdir %WINDIR%\SysWOW64\fkutbjme\" - (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\cmd.exe" /C move /Y "%TEMP%\wiqntgmk.exe" %WINDIR%\SysWOW64\fkutbjme\" - (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\sc.exe" create fkutbjme binPath= "%WINDIR%\SysWOW64\fkutbjme\wiqntgmk.exe /d\"C:\bc822ed934731c6843e138a7b5" - (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\sc.exe" description fkutbjme "wifi internet conection"" - (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\sc.exe" start fkutbjme" - (UID: 00000000-00003672) "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow prog" - (UID: 00000000-00003672)38:T4b7,Spawned process "bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe" (UID: 00000000-00003672) Spawned process "cmd.exe" with commandline "/C mkdir %WINDIR%\\SysWOW64\\fkutbjme\\" (UID: 00000000-00002252) Spawned process "cmd.exe" with commandline "/C move /Y "%TEMP%\\wiqntgmk.exe" %WINDIR%\\SysWOW64\\fkutbjme\\" (UID: 00000000-00007808) Spawned process "sc.exe" with commandline "create fkutbjme binPath= "%WINDIR%\\SysWOW64\\fkutbjme\\wiqntgmk.exe /d\\"C:\\bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe\\"" type= own start= auto DisplayName= "wifi support"" (UID: 00000000-00005380) Spawned process "sc.exe" with commandline "description fkutbjme "wifi internet conection"" (UID: 00000000-00007960) Spawned process "sc.exe" with commandline "start fkutbjme" (UID: 00000000-00006108) Spawned process "netsh.exe" with commandline "advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\\SysWOW64\\svchost.exe" enable=yes>nul" (UID: 00000000-00007068) Spawned process "nwcnlas.exe" with commandline "/d"C:\\bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe"" (UID: 00000000-00000264)39:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB3d3d3d3dwAAAAB3d3d3d3d3d3d3d3d3cAAHd3d3d3d3d3d3d3d3d3dwB3d3d3d3d3d3d3d3d3d3d3AHd3d3d3d3d3d3d3d3d3dwd3d3d3d3d3d3d3d3d3dwAHd3d3d3d3d3d3d3d3d3cAd3d3d3d3d3d3d3d3d3d3AHd3d3d3d3d3d3d3d3d3d3AHd3d3d3d3d3d3d3d3d3dwd3d3d3d3d3d3d3d3d3d3AAd3d3d3d3d3d3d3d3d3dwAHd3d3d3d3d3d3d3d3d3d3B3d3d3d3d3d3d3d3d3d3AHd3d3d3d3d3d3d3d3d3dwAAd3d3d3d3d3d3d3d3d3cAd3d3d3d3d3d3d3d3d3d3AHd3d3d3d3d3d3d3d3d3dwAHd3d3d3d3d3d3d3d3d3dwB3d3d3d3d3d3d3d3d3d3B3d3d3d3d3d3d3d3d3d3d3cHd3d3d3d3d3d3d3d3d3dwB3d3d3d3d3d3d3d3d3d3cHd3d3d3d3d3d3d3d3d3dwB3d3d3d3d3d3d3d3d3cAAAd3d3d3d3d3d3d3d3d3d3AAd3d3d3d3d3d3d3d3d3dwB3d3d3d3d3d3d3d3d3d3cAd3d3d3d3d3d3d3d3d3d3AHcHd3d3d3d3d3d3d3d3d3D////////////wAH+AAAAPAAAAAwAAAADAAAAAgAAAA4AAAAMAAAADAAAAAYAAAAEAAAADgAAAA4AAAACAAAADAAAAA8AAAAMAAAADAAAAA4AAAAGAAAACAAAAAIAAAAGAAAABAAAAAwAAAB8AAAADgAAAAwAAAAMAAAADIAAAAQ==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791292118222,"unified_at":"2026-10-06T13:08:38.222Z","metadata":{"hashes":{"sha256":"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5","sha1":"d66c729c5d5b49c0e02f8f692425a6d4743f58cf","md5":"a520a1746783fd618b1f805ce48b313f","sha512":"04e948f7e1df4856d65e30abfcca3a9ff7417f3e572df32b98d268bd982f87d97fc0a4a955ebe6e75de13d1d0e22132269e4c74124927385010feb00bd34066e","ssdeep":"6144:IfULzEiwjQjbSnDuWi+Ygh5pUTQYJkge:hXEiwjhn4gh5Wtkv","ssdeep_chunks":["6144:IfULzEi","6144:fULzEiw","6144:ULzEiwj","6144:LzEiwjQ","6144:zEiwjQj","6144:EiwjQjb","6144:iwjQjbS","6144:wjQjbSn","6144:jQjbSnD","6144:QjbSnDu","6144:jbSnDuW","6144:bSnDuWi","6144:SnDuWi+","6144:nDuWi+Y","6144:DuWi+Yg","6144:uWi+Ygh","6144:Wi+Ygh5","6144:i+Ygh5p","6144:+Ygh5pU","6144:Ygh5pUT","6144:gh5pUTQ","6144:h5pUTQY","6144:5pUTQYJ","6144:pUTQYJk","6144:UTQYJkg","6144:TQYJkge","12288:IfULzEi","12288:fULzEiw","12288:ULzEiwj","12288:LzEiwjQ","12288:zEiwjQj","12288:EiwjQjb","12288:iwjQjbS","12288:wjQjbSn","12288:jQjbSnD","12288:QjbSnDu","12288:jbSnDuW","12288:bSnDuWi","12288:SnDuWi+","12288:nDuWi+Y","12288:DuWi+Yg","12288:uWi+Ygh","12288:Wi+Ygh5","12288:i+Ygh5p","12288:+Ygh5pU","12288:Ygh5pUT","12288:gh5pUTQ","12288:h5pUTQY","12288:5pUTQYJ","12288:pUTQYJk","12288:UTQYJkg","12288:TQYJkge","6144:hXEiwjh","6144:XEiwjhn","6144:Eiwjhn4","6144:iwjhn4g","6144:wjhn4gh","6144:jhn4gh5","6144:hn4gh5W","6144:n4gh5Wt","6144:4gh5Wtk","6144:gh5Wtkv"],"imphash":"090041695468dcbe4eb2f63f21330c94"},"file_info":{"file_name":"uw5hc20zr4z37g.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":244736,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1704315607000,"last_seen":1748775832000,"last_multi_scan":1748775832000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["criminal","spambot","tofsee"]},"stats":{"av":{"malicious_count":20,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":59},"sandbox_signatures":{"informative_count":100,"suspicious_count":14,"malicious_count":7,"total":121},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.RedLine","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Kryptik.hvvy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1371585","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.BrResMon.280","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Packer.pkr_ce1a-9980177-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.BrResMon.280 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/Tofsee.BJ trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Gen.dd!n","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"HVM:Trojan/MalBehav.gen!A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005a23a61 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Lockbit-FSWW!A520A1746783","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Tofsee.kgolac","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Krypt-VK","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Kryptik.LGA.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Genus.UUX","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.Trojan.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware_40.8","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Tofsee.Win32.4051","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"BrResMon.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"malicious","value":"Calls an API typically used to execute an application"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"}],"sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"malicious","value":"Starts service using SC.exe"}],"sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"suspicious","value":"Contains ability to retrieve the contents of the STARTUPINFO structure"},{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Imports system security related APIs"}],"sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Contains ability to enumerate volumes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify System Firewall","attack_id":"T1562.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/004","identifiers":[{"type":"informative","value":"Detects NETSH process execution"},{"type":"malicious","value":"Modifies firewall settings"}],"sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"}],"sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"}],"sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"tactic":"Discovery","technique":"Internet Connection Discovery","attack_id":"T1016.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1016/001","identifiers":[{"type":"informative","value":"Contains ability to check internet connectivity"},{"type":"informative","value":"Able to check internet connectivity using ping command"}],"sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"}],"sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"malicious","value":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve information about MS-DOS device names (API string)"},{"type":"informative","value":"Queries volume information"},{"type":"suspicious","value":"Calls an API typically used to find and list the Windows drive types"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"}],"sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Loads the debugger/analysis tool module"}],"sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Tries to move files"}],"sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"suspicious","value":"Tries to access/write temporary files"}],"sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Attempts to call internet-related API for network communication"}],"sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"}],"sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"suspicious","value":"Contains ability to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"00000000-00000264.00000001.165830.0041E000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00000264.00000001.165830.0041E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to inject code into another process (API string)","description":"Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00000264.00000001.165830.0041E000.00000002.mdmp\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; Source: \"00000000-00000264.00000001.165830.0041E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00000264.00000001.165830.0041E000.00000002.mdmp\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00000264.00000001.165830.0041E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00000264.00000000.163909.02DF0000.00000004.mdmp, 00000000-00000264.00000001.165830.02DF0000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00003672.00000000.161203.02BD0000.00000004.mdmp, 00000000-00003672.00000001.163123.02BD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Loads the debugger/analysis tool module","description":"\"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe\" loaded module \"%WINDIR%\\SysWOW64\\dbghelp.dll\" at 731C0000","origin":"Loaded Module","mitre_attack_id":"T1518.001","relevance":3,"id":"module-16","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5\")\n Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 39333-281-00401965\n SetUnhandledExceptionFilter@KERNEL32.dll at 39333-964-00402D09","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"Assembly shows XOR instruction xor eax\n ebp in Stream UID: 39333-281-00401965\n Assembly shows XOR instruction xor eax\n ebp in Stream UID: 39333-293-00403D87\n Assembly shows XOR instruction xor ecx\n ebp in Stream UID: 39333-293-00403D87\n Assembly shows XOR instruction xor eax\n ebp in Stream UID: 39333-295-004063E3\n Assembly shows XOR instruction xor ecx\n ebp in Stream UID: 39333-295-004063E3\n Assembly shows XOR instruction xor eax\n ebp in Stream UID: 39333-297-0040403A\n Assembly shows XOR instruction xor ecx\n ebp in Stream UID: 39333-297-0040403A","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Found potential IP address in binary/memory","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00003672-00000C2B-1549436190\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00000264.00000001.165830.0041E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; File: \"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5\")\n Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00000264.00000001.165830.0041E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00000264.00000000.163909.02DF0000.00000004.mdmp, 00000000-00000264.00000001.165830.02DF0000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00003672.00000000.161203.02BD0000.00000004.mdmp, 00000000-00003672.00000001.163123.02BD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00003672)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00003672)\n \"nwcnlas.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00000264)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00003672)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe\" called \"GetForegroundWindow\" (UID: 00000000-00003672)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00003672)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$27","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe\" called \"GetVersionExA\" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff0c00000000000000b0de9c00000000000400000000000000000000000000000028c7c074da015f720c000000b4de9c00f1c6c074ffffffff0c000000b0de9c00040000000004000001000000c4de9c00210e770400000000 (UID: 00000000-00003672)\n \"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe\" called \"GetVersionExA\" with parameter 9c0000000600000002000000f02300000200000000ffffffd4e79c00a344d9710600000080db727738ec9c00b344d971296a40000000000000000000000000000000000000000000000000002802000000000000000000000000000008e89c0062385f722802000008e89c00616b400028020000f8224100c07c717738ec9c0000009001004cb80000020000080000007b118e00 (UID: 00000000-00003672)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate volumes (API string)","description":"Found reference to API \"FindFirstVolumeMountPointA\" (Indicator: \"FindFirstVolume\"; File: \"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5\")\n Found reference to API \"FindFirstVolumeMountPointA\" (Indicator: \"FindFirstVolumeMountPoint\"; File: \"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5\")\n Found reference to API \"FindFirstVolumeMountPointA\" (Indicator: \"FindFirstVolume\"; Source: \"00000000-00000264.00000001.165830.0041E000.00000002.mdmp\")\n Found reference to API \"FindFirstVolumeMountPointA\" (Indicator: \"FindFirstVolumeMountPoint\"; Source: \"00000000-00000264.00000001.165830.0041E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1006","relevance":1,"id":"string-194","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00000264.00000001.165830.0041E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"sc.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"nwcnlas.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00000264.00000001.165830.0041E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"GetUserObjectInformationA\" (Indicator: \"GetUserObjectInformation\"; File: \"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5\")\n Found reference to API \"GetUserObjectInformationA\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00000264.00000001.165830.0041E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00000264.00000001.165830.0041E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; File: \"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5\")\n Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; Source: \"00000000-00000264.00000001.165830.0041E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5\")\n Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; File: \"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe\" queries volume information of \"C:\\\" at 00000000-00003672-00000C17-1550197571\n \"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe\" queries volume information of \"C:\\\" at 00000000-00003672-00000C17-1550197988\n \"cmd.exe\" queries volume information of \"C:\\\" at 00000000-00007808-00000C17-1553819451","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe\" queries volume information of \"C:\\\" at 00000000-00003672-00000C17-1550197571\n \"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe\" queries volume information of \"C:\\\" at 00000000-00003672-00000C17-1550197988\n \"cmd.exe\" queries volume information of \"C:\\\" at 00000000-00007808-00000C17-1553819451","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"sc.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")\n \"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\SC.EXE\")\n \"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\NETSH.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"$28","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$29","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2a","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"C:\\jasagarizuz\\belacoxobomo\\16 zejat\\havoyanuwod vez\\hayagucego.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00000264.00000001.165830.0041E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00000264.00000001.165830.0041E000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00000264.00000001.165830.0041E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3672:168:WilStaging_02\"\n \"\\BaseNamedObjects\\SyncRootManager\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3672:64:WilError_01\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\SM0:3672:168:WilStaging_02\"\n \"Local\\SM0:3672:64:WilError_01\"\n \"SM0:3672:168:WilStaging_02\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"SM0:3672:64:WilError_01\"\n \"Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\SM0:3672:168:WilStaging_02\"\n \"\\Sessions\\1\\BaseNamedObjects\\SM0:3672:64:WilError_01\"","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$2c","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 74A30000\n \"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73530000\n \"cmd.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 74A30000\n \"sc.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 74A30000\n \"netsh.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 74A30000\n \"netsh.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73530000\n \"nwcnlas.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 74A30000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75920000\n \"cmd.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75920000\n \"sc.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75920000\n \"netsh.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75920000\n \"nwcnlas.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75920000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"\n \"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$2d","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5\" file has an entrypoint instructions - \"call\t0x403c5c,jmp\t0x401ae4,mov\tedi, edi,push\tebp,mov\tebp, esp,mov\teax, dword ptr [ebp + 8],push\tesi,mov\tesi, ecx,mov\tbyte ptr [esi + 0xc], 0,test\teax, eax,jne\t0x401ce1,call\t0x40375f,mov\tdword ptr [esi + 8], eax,mov\tecx, dword ptr [eax + 0x6c],mov\tdword ptr [esi], ecx,mov\tecx, dword ptr [eax + 0x68],mov\tdword ptr [esi + 4], ecx,mov\tecx, dword ptr [esi],cmp\tecx, dword ptr [0x4218a8],je\t0x401cad,mov\tecx, dword ptr [0x4217c4],test\tdword ptr [eax + 0x70], ecx,jne\t0x401cad,call\t0x404684,mov\tdword ptr [esi], eax,mov\teax, dword ptr [esi + 4],cmp\teax, dword ptr [0x4216c8],je\t0x401cce,mov\teax, dword ptr [esi + 8],mov\tecx, dword ptr [0x4217c4],test\tdword ptr [eax + 0x70], ecx,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".data\" is \"0x42007c\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"$2e","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"cmd.exe\" (UID: 00000000-00002252) was launched with new environment variables: \"USERDNSDOMAIN=\"DESKTOP-FVVF82A\", PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"cmd.exe\" (UID: 00000000-00002252) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"sc.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"nwcnlas.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"cmd.exe\" with commandline \"/C mkdir %WINDIR%\\\\SysWOW64\\\\fkutbjme\\\\\" (UID: 00000000-00002252)\n Spawned process \"cmd.exe\" with commandline \"/C move /Y \"%TEMP%\\\\wiqntgmk.exe\" %WINDIR%\\\\SysWOW64\\\\fkutbjme\\\\\" (UID: 00000000-00007808)\n Spawned process \"sc.exe\" with commandline \"create fkutbjme binPath= \"%WINDIR%\\\\SysWOW64\\\\fkutbjme\\\\wiqntgmk ...\" (UID: 00000000-00005380), Spawned process \"sc.exe\" with commandline \"description fkutbjme \"wifi internet conection\"\" (UID: 00000000-00007960), Spawned process \"sc.exe\" with commandline \"start fkutbjme\" (UID: 00000000-00006108), Spawned process \"netsh.exe\" with commandline \"advfirewall firewall add rule name=\"Host-process for services of ...\" (UID: 00000000-00007068)\n Spawned process \"nwcnlas.exe\" with commandline \"/d\"C:\\\\bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd951 ...\" (UID: 00000000-00000264)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"cmd.exe\" with commandline \"/C mkdir %WINDIR%\\\\SysWOW64\\\\fkutbjme\\\\\" (UID: 00000000-00002252)\n Spawned process \"cmd.exe\" with commandline \"/C move /Y \"%TEMP%\\\\wiqntgmk.exe\" %WINDIR%\\\\SysWOW64\\\\fkutbjme\\\\\" (UID: 00000000-00007808)\n Spawned process \"sc.exe\" with commandline \"create fkutbjme binPath= \"%WINDIR%\\\\SysWOW64\\\\fkutbjme\\\\wiqntgmk ...\" (UID: 00000000-00005380), Spawned process \"sc.exe\" with commandline \"description fkutbjme \"wifi internet conection\"\" (UID: 00000000-00007960), Spawned process \"sc.exe\" with commandline \"start fkutbjme\" (UID: 00000000-00006108), Spawned process \"netsh.exe\" with commandline \"advfirewall firewall add rule name=\"Host-process for services of ...\" (UID: 00000000-00007068)\n Spawned process \"nwcnlas.exe\" with commandline \"/d\"C:\\\\bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd951 ...\" (UID: 00000000-00000264)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"General","name":"Tries to move files","description":"Process \"cmd.exe\" with commandline \"/C move /Y \"%TEMP%\\\\wiqntgmk.exe\" %WINDIR%\\\\SysWOW64\\\\fkutbjme\\\\\" (UID: 00000000-00007808)","origin":"Monitored Target","mitre_attack_id":"T1570","relevance":3,"id":"target-302","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\wiqntgmk.exe\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00000264.00000001.165830.0041E000.00000002.mdmp\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00000264.00000001.165830.0041E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"qtmxxghh.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows 4 sections\"- [targetUID: N/A]\n \"nwcnlas.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows 4 sections\"- Location: [%USERPROFILE%\\nwcnlas.exe]- [targetUID: 00000000-00003672]\n \"wiqntgmk.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows 4 sections\"- Location: [%TEMP%\\wiqntgmk.exe]- [targetUID: 00000000-00003672]\n \"8335.bat\" has type \"DOS batch file ASCII text with CRLF line terminators\"- [targetUID: N/A]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$2f","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe\" queries basic process information of the \"C:\\bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe\" (UID: 3672)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$30","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe\" reads file \"c:\\bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe\"\n \"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe\" reads file \"c:\\users\\%osuser%\\desktop\\desktop.ini\"\n \"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe\" reads file \"c:\\users\\%osuser%\\documents\\desktop.ini\"\n \"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe\" reads file \"c:\\users\\%osuser%\\music\\desktop.ini\"\n \"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe\" reads file \"c:\\users\\%osuser%\\pictures\\desktop.ini\"\n \"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe\" reads file \"c:\\users\\%osuser%\\videos\\desktop.ini\"\n \"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe\" reads file \"c:\\users\\%osuser%\\downloads\\desktop.ini\"\n \"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe\" reads file \"c:\\users\\%osuser%\\onedrive\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$31","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$32","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$33","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\wiqntgmk.exe\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"Network Related","name":"Able to check internet connectivity using ping command","description":"Found string \"@echo off:next_trydel \"C:\\Users\\HAPUBWS\\nwcnlas.exe\">nulif exist \"C:\\Users\\HAPUBWS\\nwcnlas.exe\" (ping 127.0.0.1 >nulgoto next_trydel %0\" (Indicator: \"ping 127\"; File: \"8335.bat\")","origin":"File/Memory","mitre_attack_id":"T1016.001","relevance":1,"id":"string-5070","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"Network Related","name":"Contains ability to check internet connectivity","description":"Found string \"@echo off:next_trydel \"C:\\Users\\HAPUBWS\\nwcnlas.exe\">nulif exist \"C:\\Users\\HAPUBWS\\nwcnlas.exe\" (ping 127.0.0.1 >nulgoto next_trydel %0\" (Indicator: \"ping 127.0.0.1\"; File: \"8335.bat\")","origin":"File/Memory","mitre_attack_id":"T1016.001","relevance":1,"id":"string-573","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"Network Related","name":"Detects NETSH process execution","description":"Process \"netsh.exe\" with commandline \"advfirewall firewall add rule name=\"Host-process for services of Windows\" dir=in action=allow program=\"%WINDIR%\\\\SysWOW64\\\\svchost.exe\" enable=yes>nul\" (UID: 00000000-00007068)","origin":"Monitored Target","mitre_attack_id":"T1562.004","relevance":2,"id":"target-186","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"24.91.30.10\"\n Potential IP \"127.0.0.1\" found in string \"@echo off:next_trydel \"C:\\Users\\HAPUBWS\\nwcnlas.exe\">nulif exist \"C:\\Users\\HAPUBWS\\nwcnlas.exe\" (ping 127.0.0.1 >nulgoto next_trydel %0\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"kt7.il\"\n Pattern match: \"http://www.w3.org/2001/xmlschema-instance\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"8\"\n \"th32ProcessID\": \"0\"}\n \"cmd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"sc.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"nwcnlas.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00000264.00000001.165830.0041E000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00000264.00000001.165830.0041E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00000264.00000001.165830.0041E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; File: \"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5\")\n Found reference to API \"InterlockedExchangeAdd\" (Indicator: \"InterlockedExchange\"; File: \"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5\")\n Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00000264.00000001.165830.0041E000.00000002.mdmp\")\n Found reference to API \"InterlockedExchangeAdd\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00000264.00000001.165830.0041E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about MS-DOS device names (API string)","description":"Found reference to API \"QueryDosDeviceW\" (Indicator: \"QueryDosDevice\"; File: \"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5\")\n Found reference to API \"QueryDosDeviceW\" (Indicator: \"QueryDosDevice\"; Source: \"00000000-00000264.00000001.165830.0041E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-227","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameA\" (Indicator: \"GetComputerName\"; File: \"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5\")\n Found reference to API \"GetComputerNameA\" (Indicator: \"GetComputerName\"; Source: \"00000000-00000264.00000001.165830.0041E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00000264.00000001.165830.0041E000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00000264.00000001.165830.0041E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00000264.00000001.165830.0041E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; File: \"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5\")\n Found reference to API \"GetUserObjectInformationA\" (Indicator: \"GetUserObjectInformation\"; File: \"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5\")\n Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; Source: \"00000000-00000264.00000001.165830.0041E000.00000002.mdmp\")\n Found reference to API \"GetUserObjectInformationA\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00000264.00000001.165830.0041E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; File: \"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; File: \"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00000264.00000001.165830.0041E000.00000002.mdmp\")\n Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; Source: \"00000000-00000264.00000001.165830.0041E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5\")\n Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00000264.00000001.165830.0041E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"AreAnyAccessesGranted\" (Indicator: \"AreAnyAccessesGranted\"; File: \"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5\")\n Found reference to API \"AreAnyAccessesGranted\" (Indicator: \"AreAnyAccessesGranted\"; Source: \"00000000-00000264.00000001.165830.0041E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; File: \"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00000264.00000001.165830.0041E000.00000002.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00000264.00000001.165830.0041E000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00000264.00000001.165830.0041E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00000264.00000001.165830.0041E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"Observed import api \"AreAnyAccessesGranted\" which can \"test whether any of a set of requested access rights has been granted\" [Source: bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5]","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$36","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"wiqntgmk.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows 4 sections\"- Location: [%TEMP%\\wiqntgmk.exe]- [targetUID: 00000000-00003672]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"sc.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"nwcnlas.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5\" has section name .text with entropy \"7.802520059106042\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Contains ability to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"CryptEncrypt\" (Indicator: \"CryptEncrypt\"; Source: \"00000000-00000264.00000001.165830.02DF0000.00000004.mdmp\")\n Found api reference \"CryptExportKey\" (Indicator: \"CryptExportKey\"; Source: \"00000000-00000264.00000001.165830.02DF0000.00000004.mdmp\")\n Found api reference \"CryptExportKey\" (Indicator: \"CryptExportKey\"; Source: \"00000000-00003672.00000001.163123.02BD0000.00000004.mdmp\")\n Found api reference \"CryptEncrypt\" (Indicator: \"CryptEncrypt\"; Source: \"00000000-00003672.00000001.163123.02BD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":2,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure","description":"GetStartupInfoW@KERNEL32.dll at 39333-1-00401C61","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1543","relevance":5,"id":"stream-133","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe\" reads file \"C:\\Users\\%OSUSER%\\Documents\\desktop.ini\"\n \"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe\" reads file \"C:\\Users\\%OSUSER%\\Music\\desktop.ini\"\n \"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe\" reads file \"C:\\Users\\%OSUSER%\\Pictures\\desktop.ini\"\n \"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe\" reads file \"C:\\Users\\%OSUSER%\\Videos\\desktop.ini\"\n \"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe\" reads file \"C:\\Users\\%OSUSER%\\Downloads\\desktop.ini\"\n \"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe\" reads file \"C:\\Users\\%OSUSER%\\OneDrive\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"qtmxxghh.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows 4 sections\"- [targetUID: N/A]\n \"nwcnlas.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows 4 sections\"- Location: [%USERPROFILE%\\nwcnlas.exe]- [targetUID: 00000000-00003672]\n \"wiqntgmk.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows 4 sections\"- Location: [%TEMP%\\wiqntgmk.exe]- [targetUID: 00000000-00003672]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"ZEONVDGY\"; Value: \"\"%USERPROFILE%\\nwcnlas.exe\"\")","origin":"Registry Access","mitre_attack_id":"T1547.001","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"\"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe\" wrote 3072 bytes starting with PE header signature to file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\wiqntgmk.exe\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...\n \"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe\" wrote 3072 bytes starting with PE header signature to file \"C:\\Users\\%OSUSER%\\nwcnlas.exe\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"suspicious","category":"Network Related","name":"Attempts to call internet-related API for network communication","description":"\"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe\" called \"NtConnectPort\" with parameters (UID: 00000000-00003672)\n \"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe\" called \"NtRequestWaitReplyPort\" with parameters (UID: 00000000-00003672)\n \"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe\" called \"NtAlpcSendWaitReceivePort\" with parameters (UID: 00000000-00003672)\n \"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe\" called \"NtAlpcConnectPortEx\" with parameters (UID: 00000000-00003672)","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-291","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to find and list the Windows drive types","description":"\"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe\" called \"GetDriveTypeA\" with parameter C:\\ (UID: 00000000-00003672)","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-110","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Tries to access/write temporary files","description":"Process \"%WINDIR%\\SysWOW64\\cmd.exe\" with commandline \"/C move /Y \"%TEMP%\\\\wiqntgmk.exe\" %WINDIR%\\\\SysWOW64\\\\fkutbjme\\\\\" (UID: 00000000-00007808)","origin":"Monitored Target","mitre_attack_id":"T1074.001","relevance":5,"id":"target-423","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\wiqntgmk.exe\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\wiqntgmk.exe\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetModuleFileNameA\n DeleteFileA\n GetModuleHandleW\n Sleep\n IsDebuggerPresent\n GetTickCount\n GetComputerNameA\n GetStartupInfoW\n LoadLibraryW\n TerminateProcess\n GetProcAddress\n VirtualAlloc\n UnhandledExceptionFilter\n WriteFile\n GetStartupInfoA\n GetModuleHandleA\n GetModuleFileNameW\n LoadLibraryA\n GetCommandLineW","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"$37","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"malicious","category":"General","name":"Calls an API typically used to execute an application","description":"\"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe\" called \"ShellExecuteA\" with parameter cmd (UID: 00000000-00003672)\n \"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe\" called \"ShellExecuteA\" with parameter 7363 (UID: 00000000-00003672)\n \"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe\" called \"ShellExecuteA\" with parameter netsh (UID: 00000000-00003672)","origin":"API Call","mitre_attack_id":"T1106","relevance":10,"id":"api-117","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe\" wrote 00000004 bytes to a remote process \"C:\\Windows\\SysWOW64\\sc.exe\" (Handle: 636)\n \"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe\" wrote 00000004 bytes to a remote process \"C:\\Windows\\SysWOW64\\sc.exe\" (Handle: 1224)\n \"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe\" wrote 00000004 bytes to a remote process \"C:\\Windows\\SysWOW64\\sc.exe\" (Handle: 1264)\n \"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe\" wrote 00000004 bytes to a remote process \"C:\\Windows\\SysWOW64\\netsh.exe\" (Handle: 1228)\n \"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe\" wrote 00000004 bytes to a remote process \"C:\\Users\\%OSUSER%\\nwcnlas.exe\" (Handle: 1188)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"malicious","category":"System Security","name":"Modifies firewall settings","description":"Process \"netsh.exe\" with commandline \"advfirewall firewall add rule name=\"Host-process for services of Windows\" dir=in action=allow program=\"%WINDIR%\\\\SysWOW64\\\\svchost.exe\" enable=yes>nul\" (UID: 00000000-00007068)","origin":"Monitored Target","mitre_attack_id":"T1562.004","relevance":8,"id":"target-15","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"malicious","category":"System Security","name":"Starts service using SC.exe","description":"Process \"sc.exe\" with commandline \"start fkutbjme\" (UID: 00000000-00006108)","origin":"Monitored Target","mitre_attack_id":"T1569.002","relevance":10,"id":"target-303","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$38","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"name":"Persistence","details_count":4,"details":[{"detail":"Writes data to a remote process"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Spawns a lot of processes"},{"detail":"Modifies firewall settings"}],"sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"name":"Fingerprint","details_count":4,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Queries sensitive IE security settings"},{"detail":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]}]},"activity":{"stats":{"process_count":8,"spawned_processes_count":8,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":13,"imported_dlls_count":120,"dropped_files_count":0,"extracted_files_count":4,"files_written_count":3,"files_deleted_count":0,"registry_keys_created_count":3,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":3,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["criminal","spambot","tofsee"],"sample_flags":["Multi-Process","Extracted Files","TOR analysis"],"sandbox_reports":[{"id":"683c33983f59b3f78d05200c","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"submit_name":"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5","analysis_start_time":"2025-06-01T11:11:43+00:00","indicators_count":{"informative":100,"suspicious":31,"malicious":7},"tags":["Multi-Process","Extracted Files","TOR analysis"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}],"processes":[{"pid":3672,"ppid":0,"name":"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe","command_line":"","sha256":"bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5","normalized_path":"C:\\bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe","uid":"00000000-00003672","icon":"$39"},{"pid":2252,"ppid":3672,"name":"cmd.exe","command_line":"/C mkdir %WINDIR%\\SysWOW64\\fkutbjme\\","sha256":"4c3ea4c44aab74350355c419826b8c9e6172c3bd8f0bb5817ecf7be50b629051","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00003672","uid":"00000000-00002252"},{"pid":7808,"ppid":3672,"name":"cmd.exe","command_line":"/C move /Y \"%TEMP%\\wiqntgmk.exe\" %WINDIR%\\SysWOW64\\fkutbjme\\","sha256":"4c3ea4c44aab74350355c419826b8c9e6172c3bd8f0bb5817ecf7be50b629051","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00003672","uid":"00000000-00007808"},{"pid":5380,"ppid":3672,"name":"sc.exe","command_line":"create fkutbjme binPath= \"%WINDIR%\\SysWOW64\\fkutbjme\\wiqntgmk.exe /d\\\"C:\\bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe\\\"\" type= own start= auto DisplayName= \"wifi support\"","sha256":"4d1668fb5d66a972ac0fb7e3fea69003d7fa50116b8f21e5f277972f0177c042","normalized_path":"%WINDIR%\\SysWOW64\\sc.exe","parent_uid":"00000000-00003672","uid":"00000000-00005380"},{"pid":7960,"ppid":3672,"name":"sc.exe","command_line":"description fkutbjme \"wifi internet conection\"","sha256":"4d1668fb5d66a972ac0fb7e3fea69003d7fa50116b8f21e5f277972f0177c042","normalized_path":"%WINDIR%\\SysWOW64\\sc.exe","parent_uid":"00000000-00003672","uid":"00000000-00007960"},{"pid":6108,"ppid":3672,"name":"sc.exe","command_line":"start fkutbjme","sha256":"4d1668fb5d66a972ac0fb7e3fea69003d7fa50116b8f21e5f277972f0177c042","normalized_path":"%WINDIR%\\SysWOW64\\sc.exe","parent_uid":"00000000-00003672","uid":"00000000-00006108"},{"pid":7068,"ppid":3672,"name":"netsh.exe","command_line":"advfirewall firewall add rule name=\"Host-process for services of Windows\" dir=in action=allow program=\"%WINDIR%\\SysWOW64\\svchost.exe\" enable=yes>nul","sha256":"6b22dd9817e7fb63d45f675c08121d7051ed626efe65304603de8bf4b93b32cb","normalized_path":"%WINDIR%\\SysWOW64\\netsh.exe","parent_uid":"00000000-00003672","uid":"00000000-00007068"},{"pid":264,"ppid":3672,"name":"nwcnlas.exe","command_line":"/d\"C:\\bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5.exe\"","sha256":"132bc5c0cec9905ce0609fd88e11d5d2c686a122534aee1b9283d7b0feef6e6f","normalized_path":"%USERPROFILE%\\nwcnlas.exe","parent_uid":"00000000-00003672","uid":"00000000-00000264"}],"all_imported_dlls":["shell32.dll","uxtheme.dll","FWPUCLNT.DLL","fwpolicyiomgr.dll","eappprxy.dll","httpapi.dll","Wldap32.dll","wow64win.dll","combase.dll","profapi.dll","Windows.StateRepositoryPS.dll","atl.dll","ntasn1.dll","p2pnetsh.dll","kernel32.dll","mfc42u.dll","onex.dll","crypt32.dll","wlanapi.dll","clbcatq.dll","imagehlp.dll","apphelp.dll","sechost.dll","winipsec.dll","kernel.appcore.dll","msIso.dll","mprapi.dll","nshhttp.dll","cabinet.dll","SHCore.dll","ntmarta.dll","urlmon.dll","rasman.dll","netshell.dll","wlancfg.dll","fwcfg.dll","dbghelp.dll","dot3api.dll","activeds.dll","polstore.dll","eappcfg.dll","cryptsp.dll","edputil.dll","PeerDistSh.dll","dhcpcsvc6.dll","nlaapi.dll","devobj.dll","ktmw32.dll","wcmapi.dll","slc.dll","gpapi.dll","ucrtbase.dll","rpcrt4.dll","rasmontr.dll","wevtapi.dll","rmclient.dll","ws2_32.dll","dhcpcmonitor.dll","advapi32.dll","msvcp_win.dll","aepic.dll","VxSSL32.dll","cfgmgr32.dll","WiFiDisplay.dll","dmcmnutils.dll","ifmon.dll","userenv.dll","FirewallAPI.dll","msvcrt.dll","iertutil.dll","shlwapi.dll","wow64cpu.dll","imm32.dll","propsys.dll","gdi32.dll","IPHLPAPI.DLL","msvcp110_win.dll","wow64.dll","bcryptprimitives.dll","dhcpcsvc.dll","rpcnsh.dll","bcrypt.dll","authfwcfg.dll","winnsi.dll","rasapi32.dll","nsi.dll","dnsapi.dll","sspicli.dll","msimg32.dll","nshwfp.dll","mdmregistration.dll","KernelBase.dll","ncrypt.dll","P2P.dll","wshelper.dll","cryptbase.dll","windows.storage.dll","cldapi.dll","adsldpc.dll","winhttp.dll","msvcr100.dll","dot3cfg.dll","gdi32full.dll","fltLib.dll","powrprof.dll","whhelper.dll","mswsock.dll","hnetmon.dll","sppc.dll","ntdll.dll","win32u.dll","netiohlp.dll","nshipsec.dll","msasn1.dll","mprmsg.dll","oleaut32.dll","user32.dll","ole32.dll","OneCoreUAPCommonProxyStub.dll","fwbase.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"wiqntgmk.exe","sha256":"d3938ed26a952e9ae41cc25359e3e28f08c01130a3976a134ba87a748852eb96","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"name":"nwcnlas.exe","sha256":"7e96ab6c9da19e4d05aaa096bc0b568ef3940b9a4cc221a99e01b1b2eb7a567a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"name":"qtmxxghh.exe","sha256":"4edc9f6c9a8b4ccd71a626a6ccb06e3391abafb5b34138082ee99615e4b477ec","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"name":"8335.bat","sha256":"f5f3c21aca71da55fae3c0c06d6f2ced8f85ed4218eb2699ecd3e594019ae496","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]}],"files_written":[{"path":"%TEMP%\\wiqntgmk.exe","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"path":"%USERPROFILE%\\nwcnlas.exe","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\DESKTOP\\NAMESPACE\\\\","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\DESKTOP\\NAMESPACE\\\\","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\DESKTOP\\NAMESPACE\\DELEGATEFOLDERS\\\\","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3672:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"name":"\\BaseNamedObjects\\SyncRootManager","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3672:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"name":"Local\\SM0:3672:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"name":"Local\\SM0:3672:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"name":"SM0:3672:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"name":"SM0:3672:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3672:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3672:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"683c33983f59b3f78d05200c"}]}]}},"report_ids":{"sandbox_job_ids":["683c33983f59b3f78d05200c"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious BrResMon.Generic Sample bc822ed93473… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample bc822ed93473…. Malware family: BrResMon.Generic. Threat score 100/100. 20/26 AV engines flagged this file. 7 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5"}],["$","meta","4",{"property":"og:title","content":"Malicious BrResMon.Generic Sample bc822ed93473… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample bc822ed93473…. Malware family: BrResMon.Generic. Threat score 100/100. 20/26 AV engines flagged this file. 7 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/bc822ed934731c6843e138a7b5a0f643b6852ee233b0fb861040bd95111d09f5"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious BrResMon.Generic Sample bc822ed93473… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample bc822ed93473…. Malware family: BrResMon.Generic. Threat score 100/100. 20/26 AV engines flagged this file. 7 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L3a","11",{}]]