24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 4a:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T48a,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Agent Sample c5cb97fbe424… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample c5cb97fbe424…. Malware family: Trojan.Agent. Threat score 100/100. 20/25 AV engines flagged this file. 10 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99","keywords":["Malicious","Trojan.Agent","malware analysis","sandbox report","threat intelligence","c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99"],"about":{"@type":"SoftwareApplication","name":"Client.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Agent","antivirusDetections":{"malicious":20,"total":25},"behavioralIndicators":{"malicious":10,"suspicious":18},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:Tb6d,Found reference to API "Bundle already contains a key with a keyId for the passed in ring." (Indicator: "read"; Source: "sample.bin"), Found reference to API "Cannot register new digest OIDs after the data stream is opened" (Indicator: "open"; Source: "sample.bin"), Found reference to API "ReadString" (Indicator: "read"; Source: "sample.bin"), Found reference to API "WriteUInt64" (Indicator: "write"; Source: "sample.bin"), Found reference to API "PBEwithMD5and256bitAES-CBC-OpenSSL" (Indicator: "open"; Source: "sample.bin"), Found reference to API "Timestamp could not be parsed" (Indicator: "time"; Source: "sample.bin"), Found reference to API "Timestamp could not be parsed" (Indicator: "times"; Source: "sample.bin"), Found reference to API "Cannot write a " (Indicator: "write"; Source: "sample.bin"), Found reference to API "countSmallPrimes must be >= 30 for security reasons" (Indicator: "security"; Source: "sample.bin"), Found reference to API "Cannot configure new digests after the data stream is opened" (Indicator: "open"; Source: "sample.bin"), Found reference to API "created badly formatted response!" (Indicator: "creat"; Source: "sample.bin"), Found reference to API "Log created on " (Indicator: "creat"; Source: "sample.bin"), Found reference to API "CreateBuilder" (Indicator: "creat"; Source: "sample.bin"), Found reference to API "BraveSoftware\Brave-Browser\User Data\Local State" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "exception reading compressed stream." (Indicator: "read"; Source: "sample.bin"), Found reference to API "Cannot use ReadInput() in blocking mode! Use Stream instead." (Indicator: "read"; Source: "sample.bin"), Found reference to API "RenamePath No permission" (Indicator: "rename"; Source: "sample.bin"), Found reference to API "Validation already attempted for round 3 payload for " (Indicator: "read"; Source: "sample.bin"), Found reference to API "The writer is in an incomplete state" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "The writer is in an incomplete state" (Indicator: "write"; Source: "sample.bin"), Found reference to API "EXPORTER-Token-Binding" (Indicator: "bind"; Source: "sample.bin"), Found reference to API "error creating signature." (Indicator: "creat"; Source: "sample.bin"), Found reference to API "unknown object passed to Time" (Indicator: "time"; Source: "sample.bin"), Found reference to API ".bcl.TimeSpan" (Indicator: "time"; Source: "sample.bin"), Found reference to API ".bcl.TimeSpan" (Indicator: "times"; Source: "sample.bin"), Found reference to API "Cannot rename value: Error writing to the registry" (Indicator: "rename"; Source: "sample.bin"), Found reference to API "ThrowCannotCreateInstance" (Indicator: "creat"; Source: "sample.bin"), Found reference to API "dateTime" (Indicator: "time"; Source: "sample.bin")26:T46a,Found string "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" (Indicator: "software\microsoft\windows\currentversion\run"; in Source: "sample.bin"), Found string "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run" (Indicator: "software\wow6432node\microsoft\windows\currentversion\run"; in Source: "sample.bin"), Found string "SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" (Indicator: "software\microsoft\windows\currentversion\run"; in Source: "sample.bin"), Found string "SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" (Indicator: "software\microsoft\windows\currentversion\runonce"; in Source: "sample.bin"), Found string "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce" (Indicator: "software\wow6432node\microsoft\windows\currentversion\run"; in Source: "sample.bin"), Found string "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce" (Indicator: "software\wow6432node\microsoft\windows\currentversion\runonce"; in Source: "sample.bin"), Found string "Software\Microsoft\Windows\CurrentVersion\Run" (Indicator: "software\microsoft\windows\currentversion\run"; in Source: "sample.bin")27:Ta9f,Found string "error recovering GOST3410_94 public key" (Indicator: "public key"; Source: "sample.bin"), Found string "Public key of issuer certificate of CRL could not be retrieved." (Indicator: "public key"; Source: "sample.bin"), Found string "Infinity is not a valid public key for ECDHC" (Indicator: "public key"; Source: "sample.bin"), Found string "EOF encountered in middle of Ed448 public key" (Indicator: "public key"; Source: "sample.bin"), Found string "OID is not a valid CryptoPro public key parameter set" (Indicator: "public key"; Source: "sample.bin"), Found string "RSA parameters should be for a public key" (Indicator: "public key"; Source: "sample.bin"), Found string "Expected private key" (Indicator: "private key"; Source: "sample.bin"), Found string "Invalid y for GOST3410 public key" (Indicator: "public key"; Source: "sample.bin"), Found string "Attribute certificate issuer is also a public key certificate issuer." (Indicator: "public key"; Source: "sample.bin"), Found string "Expected a private key" (Indicator: "private key"; Source: "sample.bin"), Found string "algorithm identifier in public key not recognised: " (Indicator: "public key"; Source: "sample.bin"), Found string "ECDHC public key has wrong domain parameters" (Indicator: "public key"; Source: "sample.bin"), Found string "cannot extract MQV ephemeral public key: " (Indicator: "public key"; Source: "sample.bin"), Found string "error recovering GOST3410_2012 public key" (Indicator: "public key"; Source: "sample.bin"), Found string "Expected public key" (Indicator: "public key"; Source: "sample.bin"), Found string "[PRIVATE KEY LOCATION: "{0}"]" (Indicator: "private key"; Source: "sample.bin"), Found string "invalid length for GOST3410_2012 public key" (Indicator: "public key"; Source: "sample.bin"), Found string "EOF encountered in middle of Ed25519 private key" (Indicator: "private key"; Source: "sample.bin"), Found string "Expected RSA private key" (Indicator: "private key"; Source: "sample.bin"), Found string "Public key certificate for attribute certificate cannot be searched." (Indicator: "public key"; Source: "sample.bin"), Found string "Public key certificate specified in base certificate ID for attribute certificate cannot be found." (Indicator: "public key"; Source: "sample.bin"), Found string "invalid length for GOST3410_2001 public key" (Indicator: "public key"; Source: "sample.bin"), Found string "EOF encountered in middle of Ed448 private key" (Indicator: "private key"; Source: "sample.bin"), Found string "error recovering GOST3410_2001 public key" (Indicator: "public key"; Source: "sample.bin"), Found string " Trusted CA Public Key: " (Indicator: "public key"; Source: "sample.bin")28:T7df,Found string "SHA3-256WITHECDSA" (Indicator: "ecdsa"; Source: "sample.bin"), Found string "withCVC-ECDSA" (Indicator: "ecdsa"; Source: "sample.bin"), Found string "PBEwithMD5and256bitAES-CBC-OpenSSL" (Indicator: "aes"; Source: "sample.bin"), Found string "SHA-512WITHPLAIN-ECDSA" (Indicator: "ecdsa"; Source: "sample.bin"), Found string "can't mix ECDSA with anything but SHA family digests" (Indicator: "ecdsa"; Source: "sample.bin"), Found string "SHA-384WITHECDSA" (Indicator: "ecdsa"; Source: "sample.bin"), Found string "CVC-ECDSAWITHSHA384" (Indicator: "ecdsa"; Source: "sample.bin"), Found string "SHA1/ECDSA" (Indicator: "ecdsa"; Source: "sample.bin"), Found string "SHA-384withECDSA" (Indicator: "ecdsa"; Source: "sample.bin"), Found string "SHA-1/CVC-ECDSA" (Indicator: "ecdsa"; Source: "sample.bin"), Found string "ECDSAWITHSHA512" (Indicator: "ecdsa"; Source: "sample.bin"), Found string "PLAIN-ECDSAWITHSHA-256" (Indicator: "ecdsa"; Source: "sample.bin"), Found string "exception decoding URL safe base64 string: " (Indicator: "base64"; Source: "sample.bin"), Found string "invalid parameter passed to AES init - " (Indicator: "aes"; Source: "sample.bin"), Found string "SHA3-384WITHECDSA" (Indicator: "ecdsa"; Source: "sample.bin"), Found string "PLAIN-ECDSAWITHSHA-224" (Indicator: "ecdsa"; Source: "sample.bin"), Found string "SHA-1withCVC-ECDSA" (Indicator: "ecdsa"; Source: "sample.bin"), Found string "AESCMAC" (Indicator: "aes"; Source: "sample.bin"), Found string "SHA1WITHCVC-ECDSA" (Indicator: "ecdsa"; Source: "sample.bin"), Found string "PLAIN-ECDSAWITHSHA1" (Indicator: "ecdsa"; Source: "sample.bin"), Found string "SHA-256/ECDSA" (Indicator: "ecdsa"; Source: "sample.bin"), Found string "SHA256/CVC-ECDSA" (Indicator: "ecdsa"; Source: "sample.bin"), Found string "SHA-512/CVC-ECDSA" (Indicator: "ecdsa"; Source: "sample.bin"), Found string "SHA-384WITHPLAIN-ECDSA" (Indicator: "ecdsa"; Source: "sample.bin"), Found string "SHA224WITHPLAIN-ECDSA" (Indicator: "ecdsa"; Source: "sample.bin")29:T553,"BraveSoftware\Brave-Browser\User Data\Local State" (Indicator: "bravesoftware\brave-browser\user data") in Source: sample.bin, "Opera Software\Opera GX Stable\Login Data" (Indicator: "opera software\opera gx stable\login data") in Source: sample.bin, "Yandex\YandexBrowser\User Data\Default\Ya Passman Data" (Indicator: "yandex\yandexbrowser\user data") in Source: sample.bin, "Microsoft\Edge\User Data\Default\Login Data" (Indicator: "microsoft\edge\user data") in Source: sample.bin, "Yandex\YandexBrowser\User Data\Local State" (Indicator: "yandex\yandexbrowser\user data") in Source: sample.bin, "Google\Chrome\User Data\Default\Login Data" (Indicator: "google\chrome\user data") in Source: sample.bin, "Opera Software\Opera Stable\Login Data" (Indicator: "opera software\opera stable\login data") in Source: sample.bin, "Microsoft\Edge\User Data\Local State" (Indicator: "microsoft\edge\user data") in Source: sample.bin, "BraveSoftware\Brave-Browser\User Data\Default\Login Data" (Indicator: "bravesoftware\brave-browser\user data") in Source: sample.bin, "Mozilla\Firefox\Profiles" (Indicator: "mozilla\firefox\") in Source: sample.bin, "Google\Chrome\User Data\Local State" (Indicator: "google\chrome\user data") in Source: sample.bin, "Opera Software\Opera Stable\Local State" (Indicator: "opera software\opera stable\local state") in Source: sample.bin2a:T8a1,Found reference to "SHA512WITHXMSSMT" (Indicator: "SHA512"; Source: "sample.bin"), Found reference to "HMAC-SHA3-384" (Indicator: "HMAC"; Source: "sample.bin"), Found reference to "SHA512(256)" (Indicator: "SHA512"; Source: "sample.bin"), Found reference to "CVC-ECDSAWITHSHA384" (Indicator: "SHA384"; Source: "sample.bin"), Found reference to "SHA384WITHECNR" (Indicator: "SHA384"; Source: "sample.bin"), Found reference to "ECDSAWITHSHA512" (Indicator: "SHA512"; Source: "sample.bin"), Found reference to "RC2MAC" (Indicator: "RC2"; Source: "sample.bin"), Found reference to "HMAC-SHA384" (Indicator: "HMAC"; Source: "sample.bin"), Found reference to "HMAC-SHA384" (Indicator: "SHA384"; Source: "sample.bin"), Found reference to "PBEWITHHMACSHA" (Indicator: "HMAC"; Source: "sample.bin"), Found reference to "HMAC" (Indicator: "HMAC"; Source: "sample.bin"), Found reference to "RC2MAC/CFB8" (Indicator: "RC2"; Source: "sample.bin"), Found reference to "PBEWITHHMACSHA-224" (Indicator: "HMAC"; Source: "sample.bin"), Found reference to "PBEWITHHMACTIGER" (Indicator: "HMAC"; Source: "sample.bin"), Found reference to "SHA512WITHRSA/PSS" (Indicator: "SHA512"; Source: "sample.bin"), Found reference to "HMAC-MD5" (Indicator: "HMAC"; Source: "sample.bin"), Found reference to "PBEwithMD5andRC2-CBC" (Indicator: "RC2"; Source: "sample.bin"), Found reference to "PBEWITHHMACSHA1" (Indicator: "HMAC"; Source: "sample.bin"), Found reference to "PBEWITHHMACSHA1" (Indicator: "HMACSHA1"; Source: "sample.bin"), Found reference to "signatureAndHashAlgorithm" (Indicator: "HashAlgorithm"; Source: "sample.bin"), Found reference to "HashAlgorithm." (Indicator: "HashAlgorithm"; Source: "sample.bin"), Found reference to "PBEWITHHMACSHA-256" (Indicator: "HMAC"; Source: "sample.bin"), Found reference to "HMAC-SHA256" (Indicator: "HMAC"; Source: "sample.bin"), Found reference to "HMAC-SHA224" (Indicator: "HMAC"; Source: "sample.bin"), Found reference to "CVC-ECDSAWITHSHA512" (Indicator: "SHA512"; Source: "sample.bin"), Found reference to "SHA384WITHRSASSA-PSS" (Indicator: "SHA384"; Source: "sample.bin"), Found reference to "HKDF parameters required for HkdfBytesGenerator" (Indicator: "HKDF"; Source: "sample.bin")2b:Ta40,Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetDelegateForFunctionPointer" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocHGlobal" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "Copy" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "FreeHGlobal" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "PtrToStructure" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetLastWin32Error" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReleaseComObject" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocCoTaskMem" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "StructureToPtr" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed namespace "System.IO.MemoryStream" and TypeReference "GetBuffer" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed namespace "System.IO.MemoryStream" and TypeReference "Dispose" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed namespace "System.IO.MemoryStream" and TypeReference "WriteTo" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed namespace "System.IO.MemoryStream" and TypeReference "get_Capacity" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "workbook.exe"2c:Tec2,Observed namespace "System.Security.Cryptography.RSACryptoServiceProvider" and TypeReference "VerifyHash" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed namespace "System.Security.Cryptography.DSA" and TypeReference "ExportParameters" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed namespace "System.Security.Cryptography.DSAParameters" and TypeReference "Seed" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed namespace "System.Security.Cryptography.DSAParameters" and TypeReference "Counter" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed namespace "System.Security.Cryptography.DSAParameters" and TypeReference "P" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed namespace "System.Security.Cryptography.DSAParameters" and TypeReference "Q" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed namespace "System.Security.Cryptography.DSAParameters" and TypeReference "G" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed namespace "System.Security.Cryptography.DSAParameters" and TypeReference "Y" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed namespace "System.Security.Cryptography.DSAParameters" and TypeReference "X" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed namespace "System.Security.Cryptography.RSA" and TypeReference "ExportParameters" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed namespace "System.Security.Cryptography.RSAParameters" and TypeReference "Modulus" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed namespace "System.Security.Cryptography.RSAParameters" and TypeReference "Exponent" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed namespace "System.Security.Cryptography.RSAParameters" and TypeReference "D" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed namespace "System.Security.Cryptography.RSAParameters" and TypeReference "P" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed namespace "System.Security.Cryptography.RSAParameters" and TypeReference "Q" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed namespace "System.Security.Cryptography.RSAParameters" and TypeReference "DP" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed namespace "System.Security.Cryptography.RSAParameters" and TypeReference "DQ" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed namespace "System.Security.Cryptography.RSAParameters" and TypeReference "InverseQ" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed namespace "System.Security.Cryptography.RSACryptoServiceProvider" and TypeReference ".ctor" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed namespace "System.Security.Cryptography.RSA" and TypeReference "ImportParameters" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed namespace "System.Security.Cryptography.RSACryptoServiceProvider" and TypeReference "VerifyHash" in "workbook.exe" Observed namespace "System.Security.Cryptography.DSA" and TypeReference "ExportParameters" in "workbook.exe" Observed namespace "System.Security.Cryptography.DSAParameters" and TypeReference "Seed" in "workbook.exe" Observed namespace "System.Security.Cryptography.DSAParameters" and TypeReference "Counter" in "workbook.exe" Observed namespace "System.Security.Cryptography.DSAParameters" and TypeReference "P" in "workbook.exe"2d:T5f6,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains key cryptographic functions (API string) Matched sigs: Contains reference to cryptographic keys Matched sigs: Contains reference to crypto DLLs Matched sigs: Contains ability to perform encryption (API string) Matched sigs: Able to access crypto-related API (String) Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Calls an API typically used to decrypt data Matched sigs: Reads the cryptographic machine GUID Matched sigs: Able to decode string content at runtime (.NET) Matched sigs: Contains ability to perform crypto operations Matched sigs: Contains ability to perform asymmetric crypto operations Matched sigs: Contains ability to perform symmetric crypto operations Matched sigs: Contains ability to perform symmetric encryption (Dotnet) Matched sigs: Contains ability to perform CryptoStream operations (Dotnet) Matched sigs: Dotnet file contains encryption/decryption functions Matched sigs: Contains symmetric decryption functionality in .NET code Matched sigs: YARA signature match - AES encryption2e:T2862,Found XOR loop in file "workbook.exe" at offset 258202; code bytes = 30d0 Found XOR loop in file "workbook.exe" at offset 259603; code bytes = 30d0 Found XOR loop in file "workbook.exe" at offset 990241; code bytes = 30d0 Found XOR loop in file "workbook.exe" at offset 1770740; code bytes = 30d0 Found XOR loop in file "workbook.exe" at offset 1896163; code bytes = 30d0 Found XOR loop in file "workbook.exe" at offset 1259439; code bytes = 33c1 Found XOR loop in file "workbook.exe" at offset 1259547; code bytes = 33c1 Found XOR loop in file "workbook.exe" at offset 1482808; code bytes = 33c1 Found XOR loop in file "workbook.exe" at offset 1841690; code bytes = 33c1 Found XOR loop in file "workbook.exe" at offset 1841744; code bytes = 33c1 Found XOR loop in file "workbook.exe" at offset 1848494; code bytes = 33c1 Found XOR loop in file "workbook.exe" at offset 1848566; code bytes = 33c1 Found XOR loop in file "workbook.exe" at offset 1864046; code bytes = 33c1 Found XOR loop in file "workbook.exe" at offset 1864082; code bytes = 33c1 Found XOR loop in file "workbook.exe" at offset 1864100; code bytes = 33c1 Found XOR loop in file "workbook.exe" at offset 1864316; code bytes = 33c1 Found XOR loop in file "workbook.exe" at offset 1864388; code bytes = 33c1 Found XOR loop in file "workbook.exe" at offset 1864604; code bytes = 33c1 Found XOR loop in file "workbook.exe" at offset 1864622; code bytes = 33c1 Found XOR loop in file "workbook.exe" at offset 1864640; code bytes = 33c1 Found XOR loop in file "workbook.exe" at offset 1864658; code bytes = 33c1 Found XOR loop in file "workbook.exe" at offset 1864676; code bytes = 33c1 Found XOR loop in file "workbook.exe" at offset 1865000; code bytes = 33c1 Found XOR loop in file "workbook.exe" at offset 1865162; code bytes = 33c1 Found XOR loop in file "workbook.exe" at offset 1865378; code bytes = 33c1 Found XOR loop in file "workbook.exe" at offset 1865648; code bytes = 33c1 Found XOR loop in file "workbook.exe" at offset 1865666; code bytes = 33c1 Found XOR loop in file "workbook.exe" at offset 1877384; code bytes = 33c1 Found XOR loop in file "workbook.exe" at offset 1877402; code bytes = 33c1 Found XOR loop in file "workbook.exe" at offset 1877420; code bytes = 33c1 Found XOR loop in file "workbook.exe" at offset 1877438; code bytes = 33c1 Found XOR loop in file "workbook.exe" at offset 1877474; code bytes = 33c1 Found XOR loop in file "workbook.exe" at offset 1930952; code bytes = 33c1 Found XOR loop in file "workbook.exe" at offset 1967816; code bytes = 33c1 Found XOR loop in file "workbook.exe" at offset 2000036; code bytes = 33c1 Found XOR loop in file "workbook.exe" at offset 2000054; code bytes = 33c1 Found XOR loop in file "workbook.exe" at offset 2000180; code bytes = 33c1 Found XOR loop in file "workbook.exe" at offset 2018324; code bytes = 33c1 Found XOR loop in file "workbook.exe" at offset 2018666; code bytes = 33c1 Found XOR loop in file "workbook.exe" at offset 2018846; code bytes = 33c1 Found XOR loop in file "workbook.exe" at offset 312990; code bytes = 8030 Found XOR loop in file "workbook.exe" at offset 733714; code bytes = 8030 Found XOR loop in file "workbook.exe" at offset 1028021; code bytes = 8030 Found XOR loop in file "workbook.exe" at offset 1190651; code bytes = 8030 Found XOR loop in file "workbook.exe" at offset 1227510; code bytes = 8030 Found XOR loop in file "workbook.exe" at offset 1347553; code bytes = 8030 Found XOR loop in file "workbook.exe" at offset 1382402; code bytes = 8030 Found XOR loop in file "workbook.exe" at offset 1395450; code bytes = 8030 Found XOR loop in file "workbook.exe" at offset 1407626; code bytes = 8030 Found XOR loop in file "workbook.exe" at offset 1498080; code bytes = 8030 Found XOR loop in file "workbook.exe" at offset 1522495; code bytes = 8030 Found XOR loop in file "workbook.exe" at offset 1529421; code bytes = 8030 Found XOR loop in file "workbook.exe" at offset 1613525; code bytes = 8030 Found XOR loop in file "workbook.exe" at offset 1632345; code bytes = 8030 Found XOR loop in file "workbook.exe" at offset 1633415; code bytes = 8030 Found XOR loop in file "workbook.exe" at offset 1636815; code bytes = 8030 Found XOR loop in file "workbook.exe" at offset 1637595; code bytes = 8030 Found XOR loop in file "workbook.exe" at offset 1648805; code bytes = 8030 Found XOR loop in file "workbook.exe" at offset 1657675; code bytes = 8030 Found XOR loop in file "workbook.exe" at offset 1658745; code bytes = 8030 Found XOR loop in file "workbook.exe" at offset 1659605; code bytes = 8030 Found XOR loop in file "workbook.exe" at offset 1661295; code bytes = 8030 Found XOR loop in file "workbook.exe" at offset 1661965; code bytes = 8030 Found XOR loop in file "workbook.exe" at offset 1685045; code bytes = 8030 Found XOR loop in file "workbook.exe" at offset 1716555; code bytes = 8030 Found XOR loop in file "workbook.exe" at offset 2401016; code bytes = 8030 Found XOR loop in file "workbook.exe" at offset 3140592; code bytes = 8030 Found XOR loop in file "workbook.exe" at offset 3160929; code bytes = 8030 Found XOR loop in file "workbook.exe" at offset 3196694; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 258202; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 259603; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 990241; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1770740; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1896163; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1259439; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1259547; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1482808; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1841690; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1841744; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1848494; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1848566; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1864046; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1864082; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1864100; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1864316; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1864388; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1864604; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1864622; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1864640; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1864658; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1864676; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1865000; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1865162; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1865378; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1865648; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1865666; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1877384; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1877402; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1877420; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1877438; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1877474; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1930952; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1967816; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2000036; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2000054; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2000180; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2018324; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2018666; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2018846; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 312990; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 733714; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1028021; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1190651; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1227510; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1347553; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1382402; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1395450; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1407626; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1498080; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1522495; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1529421; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1613525; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1632345; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1633415; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1636815; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1637595; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1648805; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1657675; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1658745; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1659605; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1661295; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1661965; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1685045; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1716555; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2401016; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3140592; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3160929; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3196694; code bytes = 80302f:T80e,"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000000000001400000000000000000000000000000000000000000000000200000240a13f0052730021000000000000000000000000800000000000000052730021587540000100000000000000020000000c000000d02c4000d02c4000cb2c4000000000000000000000003b000000000120f121000000000040f7210095e1a37785511a00feffffff435ca7775059a77794000000a0000000ca2c4000c82c400094000000c4f22100fdfebd77a4eb21000100000040f7210092e0fa69b218cf0efeffffff5cf221004c9cfa695c0c000070f221005f9cfa690000000000000000 (UID: 00000000-00005692)30:T836,"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000001005c005300c0113b00110000118b3200006060400040a13f00b1080000aaa8640000200000b0080000580f00000d004200a2000000b1080000a1000000a1080000c9570000000000000000000036a8ffff5c00500000000000b1080000 (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eba077a00a480000d0fd7f9a5ca87700f0fd7fe0df210044d0fd7f00000000400000003f0000001d00000000d0fd7fd4df2100c15ca8776082af771d00000000d0fd7f9a5ca87700f0fd7ff8df21005789a7778083af771317c275d8eba077 (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000a1a39c7700009d770000000000000000f0009d7702000000000000008800000095e1a37714e02100459d3e7600003000000000008000000002000000000022009c1de87328e021006c22e87380000000d322e873dcf0e87344e02100741de873dcf0e8730000000074e1210000000000 (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100009da39c7700009d770000000000000000f0009d7702000000000000008800000095e1a37738e02100459d3e7600003000000000008000000002000000000022009c1de8734ce021006c22e87380000000d322e873dcf0e87368e02100741de873dcf0e8730000000098e1210000000000 (UID: 00000000-00005692) "workbook.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000064007700500072006f006300650073007300490064002c0030002c0030002c002c0031003100340038000d000a0000006c00330032002e0064006c006c002c0022003200350032003a00310035003a00310034002e0037003200370022002c00520058003d0030002c00500058003d00 (UID: 00000000-00004424)31:T4d5,Found string "SELECT * FROM Win32_BIOS" (Indicator: "select * from "; File: "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99") Found string "SELECT * FROM Win32_BaseBoard" (Indicator: "select * from "; File: "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99") Found string "SELECT * FROM Win32_Processor" (Indicator: "select * from "; File: "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99") Found string "Select * From Win32_ComputerSystem" (Indicator: "select * from "; File: "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99") Found string "SELECT * FROM Win32_DisplayConfiguration" (Indicator: "select * from "; File: "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99") Found string "SELECT * FROM Win32_OperatingSystem WHERE Primary='true'" (Indicator: "select * from "; File: "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99") Found string "SELECT * FROM AntivirusProduct" (Indicator: "select * from "; File: "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99") Found string "SELECT * FROM FirewallProduct" (Indicator: "select * from "; File: "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99")32:T5ea,Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "GetSubKeyNames" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "GetValueNames" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "GetValueKind" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "GetValue" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "OpenBaseKey" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "OpenSubKey" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "GetSubKeyNames" in "workbook.exe" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "GetValueNames" in "workbook.exe" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "GetValueKind" in "workbook.exe" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "GetValue" in "workbook.exe" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "OpenBaseKey" in "workbook.exe" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "OpenSubKey" in "workbook.exe"33:T4093,"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "LoadLibrary" with a parameter advapi32 (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\cryptnet.dll (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "LoadLibrary" with a parameter cryptnet.dll (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "LoadLibrary" with a parameter SensApi.dll (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "LoadLibrary" with a parameter certcli.dll (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\dsrole.dll (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\crypt32 (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "LoadLibrary" with a parameter crypt32 (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00005692) "schtasks.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00004132) "schtasks.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00004132) "schtasks.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00004132) "workbook.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004424) "workbook.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004424) "workbook.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004424) "workbook.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004424) "workbook.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004424) "workbook.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00004424) "workbook.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00004424) "workbook.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00004424) "workbook.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00004424) "workbook.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00004424) "workbook.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00004424) "workbook.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004424) "workbook.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00004424) "workbook.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00004424) "workbook.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00004424) "workbook.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00004424) "workbook.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00004424) "workbook.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00004424) "workbook.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00004424) "workbook.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004424) "workbook.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00004424) "workbook.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00004424) "workbook.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00004424) "workbook.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00004424) "workbook.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll (UID: 00000000-00004424) "workbook.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll (UID: 00000000-00004424) "workbook.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004424) "workbook.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004424) "workbook.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00004424) "workbook.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00004424) "workbook.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00004424) "workbook.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00004424) "workbook.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004424) "workbook.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00004424) "workbook.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00004424) "workbook.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00004424) "workbook.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00004424) "workbook.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00004424) "workbook.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00004424) "workbook.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00004424) "workbook.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00004424) "workbook.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00004424) "workbook.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00004424) "workbook.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00004424) "workbook.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00004424) "workbook.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00004424)34:Tec3e,"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter SortGetHandle (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter SortCloseHandle (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter CryptGetDefaultProviderW (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter IsAppThemedW (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter CreateActCtx (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter CreateActCtxA (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter RegisterWindowMessage (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter RegisterWindowMessageW (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter AdjustWindowRectEx (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter RegisterClass (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter RegisterClassW (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter CreateWindowEx (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter SetWindowLong (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter SetWindowLongW (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter GetWindowLong (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter GetWindowLongW (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter CallWindowProc (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter CallWindowProcW (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter GetParent (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter GetUserObjectInformation (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter GetUserObjectInformationA (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter GetClassInfo (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter GetClassInfoW (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter DefWindowProc (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter GetStartupInfo (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter GetStartupInfoW (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter GetDC (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter GetDeviceCaps (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter ReleaseDC (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter CreateIconFromResourceEx (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter SendMessage (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter SendMessageW (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter GetSystemMenu (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter GetWindowPlacement (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter EnableMenuItem (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter GetWindowTextLength (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter GetWindowTextLengthW (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter GetWindowText (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter GetWindowTextW (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter SetWindowPos (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter RedrawWindow (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter ShowWindow (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter GetFocus (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter EnumThreadWindows (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter DestroyWindow (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter CryptGetHashParam (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter CryptAcquireContext (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter CryptGetProvParam (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter CryptContextAddRef (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter CryptDuplicateKey (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter CryptSetKeyParam (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter CryptDecrypt (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter CryptQueryObject (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter CertCloseStore (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContextW (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter CryptFindOIDInfo (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter CryptFindOIDInfoW (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter I_CryptNetGetConnectivity (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter IsNetworkAlive (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter CAOIDGetLdapURL (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter CAOIDFreeLdapURL (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter DsRoleGetPrimaryDomainInformation (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter DsRoleFreeMemory (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter CryptDecodeObject (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter CryptDecodeObjectW (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter CryptSetHashParam (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter CryptVerifySignatureW (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter CreateMutex (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter CreateMutexW (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter DeleteFile (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter GetTokenInformationW (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter DuplicateTokenExW (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter CheckTokenMembershipW (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter CreateDirectory (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter CreateDirectoryW (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter CopyFile (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter CopyFileW (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter GetCurrentDirectory (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter CreateProcess (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter CreateProcessW (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter SetFileAttributes (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter SetFileAttributesW (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter SetClassLong (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter SetClassLongW (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter PostMessage (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter PostMessageW (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter UnregisterClass (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter UnregisterClassW (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter IsWindow (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter DestroyWindowW (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter DestroyIcon (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00005692) "schtasks.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004132) "schtasks.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004132) "schtasks.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004132) "schtasks.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004132) "schtasks.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00004132) "schtasks.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00004132) "schtasks.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00004132) "schtasks.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00004132) "workbook.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter SortGetHandle (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter SortCloseHandle (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter CryptGetDefaultProviderW (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter IsAppThemedW (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter CreateActCtx (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter CreateActCtxA (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter RegisterWindowMessage (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter RegisterWindowMessageW (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter AdjustWindowRectEx (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter RegisterClass (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter RegisterClassW (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter CreateWindowEx (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter SetWindowLong (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter SetWindowLongW (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter GetWindowLong (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter GetWindowLongW (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter CallWindowProc (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter CallWindowProcW (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter GetParent (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter GetUserObjectInformation (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter GetUserObjectInformationA (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter GetClassInfo (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter GetClassInfoW (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter DefWindowProc (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter GetStartupInfo (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter GetStartupInfoW (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter GetDC (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter GetDeviceCaps (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter ReleaseDC (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter CreateIconFromResourceEx (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter SendMessage (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter SendMessageW (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter GetSystemMenu (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter GetWindowPlacement (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter EnableMenuItem (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter GetWindowTextLength (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter GetWindowTextLengthW (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter GetWindowText (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter GetWindowTextW (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter SetWindowPos (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter RedrawWindow (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter ShowWindow (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter GetFocus (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter EnumThreadWindows (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter DestroyWindow (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter CryptGetHashParam (UID: 00000000-00004424) "workbook.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00004424)35:T119e,"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\crypt32" - [base:0; Status:c0000135] "workbook.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "workbook.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "workbook.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "workbook.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "workbook.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "workbook.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "workbook.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "workbook.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "workbook.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "workbook.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "workbook.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] "workbook.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135]36:Tb53,Observed unmanaged function "LoadLibrary" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed unmanaged function "FreeLibrary" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed unmanaged function "GetProcAddress" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed unmanaged function "QueryFullProcessImageName" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed unmanaged function "BitBlt" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed unmanaged function "CreateDC" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed unmanaged function "DeleteDC" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed unmanaged function "GetLastInputInfo" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed unmanaged function "SetCursorPos" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed unmanaged function "GetMessageExtraInfo" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed unmanaged function "SendInput" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed unmanaged function "SystemParametersInfo" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed unmanaged function "PostMessage" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed unmanaged function "OpenDesktop" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed unmanaged function "CloseDesktop" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed unmanaged function "EnumDesktopWindows" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed unmanaged function "IsWindowVisible" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed unmanaged function "GetForegroundWindow" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed unmanaged function "GetWindowText" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed unmanaged function "GetExtendedTcpTable" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed unmanaged function "SetTcpEntry" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed unmanaged function "CryptAcquireContext" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed unmanaged function "CryptCreateHash" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed unmanaged function "CryptHashData" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed unmanaged function "CryptDestroyHash" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99"37:T47a,"Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004424.00000000.83616.020C0000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\InstallationType" in Source: 00000000-00004424.00000000.83616.020C0000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00004424.00000000.83616.020C0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004424.00000000.83616.020C0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00004424.00000000.83616.020C0000.00000004.mdmp "Read?HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004424.00000002.87464.00280000.00000004.mdmp "Read3HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00004424.00000002.87464.00280000.00000004.mdmp "Read?HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005692.00000003.83301.004D0000.00000004.mdmp "Read3HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00005692.00000003.83301.004D0000.00000004.mdmp38:T29cc,"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 69e60000 "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 71630000 "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" loaded module "KERNEL32" at base 77b90000 "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" loaded module "ADVAPI32.DLL" at base 76330000 "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 6bf30000 "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" loaded module "SHLWAPI.DLL" at base 75f50000 "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" loaded module "VERSION.DLL" at base 74dc0000 "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 652f0000 "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" loaded module "USER32.DLL" at base 75c60000 "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" loaded module "MSCOREE.DLL" at base 6bfc0000 "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" loaded module "PSAPI.DLL" at base 77b70000 "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" loaded module "RPCRT4.DLL" at base 75fc0000 "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" loaded module "KERNEL32.DLL" at base 77b90000 "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 63ee0000 "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" loaded module "OLE32.DLL" at base 76080000 "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" loaded module "CRYPTBASE.DLL" at base 75820000 "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74780000 "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 6bc20000 "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 68920000 "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 63480000 "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DRAWING\F7568D7F1B9D356F64779B4C0927CFB3\SYSTEM.DRAWING.NI.DLL" at base 632d0000 "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.WINDOWS.FORMS\C9A4CBC00F690A9E3CDDFC400F6E85BB\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 62460000 "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 6d010000 "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 61c40000 "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 61b30000 "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 613b0000 "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" loaded module "NTDLL.DLL" at base 77a20000 "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" loaded module "SHELL32.DLL" at base 76760000 "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 76500000 "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" loaded module "PROFAPI.DLL" at base 75930000 "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" loaded module "BCRYPT.DLL" at base 75440000 "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" loaded module "CRYPTSP.DLL" at base 75330000 "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 750c0000 "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" loaded module "UXTHEME.DLL" at base 74780000 "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" loaded module "COMCTL32.DLL" at base 747c0000 "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" loaded module "GDI32.DLL" at base 764b0000 "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" loaded module "DWMAPI.DLL" at base 74250000 "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" loaded module "ADVAPI32" at base 76330000 "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" loaded module "CRYPT32.DLL" at base 75970000 "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 71f70000 "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" loaded module "CRYPTNET.DLL" at base 71f70000 "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" loaded module "SENSAPI.DLL" at base 74760000 "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" loaded module "CERTCLI.DLL" at base 72720000 "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" loaded module "%WINDIR%\SYSTEM32\DSROLE.DLL" at base 73f10000 "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" loaded module "CRYPT32" at base 75970000 "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" loaded module "CERTCLI.DLL" at base 72650000 "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" loaded module "SSPICLI.DLL" at base 757b0000 "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 757d0000 "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 76500000 "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" loaded module "RPCRTREMOTE.DLL" at base 758c0000 "schtasks.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74780000 "schtasks.exe" loaded module "RPCRT4.DLL" at base 75fc0000 "schtasks.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 76500000 "schtasks.exe" loaded module "ADVAPI32.DLL" at base 76330000 "schtasks.exe" loaded module "CLBCATQ.DLL" at base 77580000 "schtasks.exe" loaded module "%WINDIR%\SYSTEM32\TASKSCHD.DLL" at base 73f30000 "schtasks.exe" loaded module "SSPICLI.DLL" at base 757b0000 "schtasks.exe" loaded module "XMLLITE.DLL" at base 74220000 "workbook.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 69e60000 "workbook.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 71630000 "workbook.exe" loaded module "KERNEL32" at base 77b90000 "workbook.exe" loaded module "ADVAPI32.DLL" at base 76330000 "workbook.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 726f0000 "workbook.exe" loaded module "SHLWAPI.DLL" at base 75f50000 "workbook.exe" loaded module "VERSION.DLL" at base 74dc0000 "workbook.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 696b0000 "workbook.exe" loaded module "USER32.DLL" at base 75c60000 "workbook.exe" loaded module "MSCOREE.DLL" at base 6bfc0000 "workbook.exe" loaded module "PSAPI.DLL" at base 77b70000 "workbook.exe" loaded module "KERNEL32.DLL" at base 77b90000 "workbook.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 64690000 "workbook.exe" loaded module "RPCRT4.DLL" at base 75fc0000 "workbook.exe" loaded module "OLE32.DLL" at base 76080000 "workbook.exe" loaded module "CRYPTBASE.DLL" at base 75820000 "workbook.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74780000 "workbook.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 74760000 "workbook.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 6bf30000 "workbook.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 68c50000 "workbook.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DRAWING\F7568D7F1B9D356F64779B4C0927CFB3\SYSTEM.DRAWING.NI.DLL" at base 6aa50000 "workbook.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.WINDOWS.FORMS\C9A4CBC00F690A9E3CDDFC400F6E85BB\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 63820000 "workbook.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 719a0000 "workbook.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 63000000 "workbook.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 6a7d0000 "workbook.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 62880000 "workbook.exe" loaded module "NTDLL.DLL" at base 77a20000 "workbook.exe" loaded module "SHELL32.DLL" at base 76760000 "workbook.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 76500000 "workbook.exe" loaded module "PROFAPI.DLL" at base 75930000 "workbook.exe" loaded module "BCRYPT.DLL" at base 75440000 "workbook.exe" loaded module "CRYPTSP.DLL" at base 75330000 "workbook.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 750c0000 "workbook.exe" loaded module "UXTHEME.DLL" at base 74780000 "workbook.exe" loaded module "COMCTL32.DLL" at base 747c0000 "workbook.exe" loaded module "GDI32.DLL" at base 764b0000 "workbook.exe" loaded module "DWMAPI.DLL" at base 7425000039:T948,"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "workbook.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"3a:Te6c,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00005692-00000C2B-239730400] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00005692-00000C2B-240087934] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00005692-00000C2B-241280496] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00005692-00000C2B-241431057] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00005692-00000C2B-241696098] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00005692-00000C2B-241808913] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00005692-00000C2B-241970347] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00005692-00000C2B-242331850] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00005692-00000C2B-242414871] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll" [Source: 00000000-00005692-00000C2B-242501225] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll" [Source: 00000000-00005692-00000C2B-242603402] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll" [Source: 00000000-00005692-00000C2B-242847495] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00005692-00000C2B-242950149] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" [Source: 00000000-00005692-00000C2B-243020818] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00005692-00000C2B-243105119] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00005692-00000C2B-243539049] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00005692-00000C2B-244036215] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" [Source: 00000000-00005692-00000C2B-244954467] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00005692-00000C2B-245565056] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" [Source: 00000000-00005692-00000C2B-305039087] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll" [Source: 00000000-00005692-00000C2B-305251770] Observed system executable string:"%WINDIR%\system32\cryptnet.dll" [Source: 00000000-00005692-00000C2B-305730225] Observed system executable string:"%WINDIR%\system32\dsrole.dll" [Source: 00000000-00005692-00000C2B-307245592]3b:Tb57,"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: ""; Value: "") "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE\TRACING"; Key: ""; Value: "") "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: ""; Value: "") "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IME COMPATIBILITY"; Key: ""; Value: "") "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLEAUT"; Key: ""; Value: "") "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" (Access type: "OPEN"; Path: "HKLM"; Key: ""; Value: "") "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DIAGNOSTICS"; Key: ""; Value: "") "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\POLICY\"; Key: ""; Value: "") "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\POLICY\V4.0"; Key: ""; Value: "") "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: ""; Value: "")3c:Tf53,"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "C5CB97FBE4243DF1A99A9C82F44AD555F283FAD9F4B15B791FAEBE5048C8FC99"; Value: "") "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "INSTALLROOT"; Value: "") "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "CLRLOADLOGDIR"; Value: "") "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "USELEGACYV2RUNTIMEACTIVATIONPOLICYDEFAULTVALUE"; Value: "") "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "ONLYUSELATESTCLR"; Value: "") "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION"; Key: "NOCLIENTCHECKS"; Value: "") "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\NET FRAMEWORK SETUP\NDP\V4\FULL"; Key: "RELEASE"; Value: "") "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "DISABLECONFIGCACHE"; Value: "") "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "E13C0D23-CCBC-4E12-931B-D9CC2EEE27E4"; Value: "") "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "763FD754-7086-4DFE-95EB-C01A46FAF4CA"; Value: "") "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "A669021C-C450-4609-A035-5AF59AF4DF18"; Value: "")3d:T6e5,"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\config\machine.config" "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll.aux" "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\0b2f69b43a576b9edcc807a30872bd91\system.ni.dll.aux" "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\2c3c912ea8f058f9d04c4650128feb3f\system.ni.dll.aux" "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.windows.forms\c9a4cbc00f690a9e3cddfc400f6e85bb\system.windows.forms.ni.dll.aux" "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.drawing\f7568d7f1b9d356f64779b4c0927cfb3\system.drawing.ni.dll.aux" "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.configuration\96f7edb07b12303f0ec2595c7f3778c7\system.configuration.ni.dll.aux" "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.core\31fae3290fad30c31c98651462d22724\system.core.ni.dll.aux" "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.xml\15af16d373cf0528cb74fc73d365fdbf\system.xml.ni.dll.aux"3e:Tcfc,"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" trying to touch file "C:\Windows\SYSTEM32\MSCOREE.DLL" "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" trying to touch file "C:\FLTLIB.DLL" "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" trying to touch file "C:\Windows\system32\FLTLIB.DLL" "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" trying to touch file "C:\MSVCP140.dll" "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" trying to touch file "C:\Windows\system32\MSVCP140.dll" "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" trying to touch file "C:\VCRUNTIME140.dll" "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" trying to touch file "C:\Windows\system32\VCRUNTIME140.dll" "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" trying to touch file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" trying to touch file "C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll" "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" trying to touch file "C:\ucrtbase.DLL" "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" trying to touch file "C:\Windows\system32\ucrtbase.DLL" "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" trying to touch file "C:\api-ms-win-core-timezone-l1-1-0.dll" "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-timezone-l1-1-0.dll" "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" trying to touch file "C:\api-ms-win-core-file-l2-1-0.dll" "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-file-l2-1-0.dll" "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" trying to touch file "C:\api-ms-win-core-localization-l1-2-0.dll" "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-localization-l1-2-0.dll" "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" trying to touch file "C:\api-ms-win-core-synch-l1-2-0.dll" "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-synch-l1-2-0.dll" "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" trying to touch file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-processthreads-l1-1-1.dll" "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" trying to touch file "C:\api-ms-win-core-file-l1-2-0.dll" "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-file-l1-2-0.dll"3f:Tcf7,"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" trying to access non-existent file "C:\FLTLIB.DLL" "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" trying to access non-existent file "C:\MSVCP140.dll" "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" trying to access non-existent file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" trying to access non-existent file "C:\ucrtbase.DLL" "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" trying to access non-existent file "C:\api-ms-win-core-timezone-l1-1-0.dll" "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" trying to access non-existent file "C:\api-ms-win-core-file-l2-1-0.dll" "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" trying to access non-existent file "C:\api-ms-win-core-localization-l1-2-0.dll" "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" trying to access non-existent file "C:\api-ms-win-core-synch-l1-2-0.dll" "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" trying to access non-existent file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" trying to access non-existent file "C:\api-ms-win-core-file-l1-2-0.dll" "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" trying to access non-existent file "C:\api-ms-win-crt-heap-l1-1-0.dll" "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" trying to access non-existent file "C:\api-ms-win-crt-string-l1-1-0.dll" "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" trying to access non-existent file "C:\api-ms-win-crt-stdio-l1-1-0.dll" "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" trying to access non-existent file "C:\api-ms-win-crt-convert-l1-1-0.dll" "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" trying to access non-existent file "C:\api-ms-win-crt-locale-l1-1-0.dll" "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" trying to access non-existent file "C:\api-ms-win-crt-filesystem-l1-1-0.dll" "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" trying to access non-existent file "C:\api-ms-win-crt-time-l1-1-0.dll" "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" trying to access non-existent file "C:\api-ms-win-crt-environment-l1-1-0.dll" "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" trying to access non-existent file "C:\api-ms-win-crt-math-l1-1-0.dll" "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" trying to access non-existent file "C:\api-ms-win-crt-utility-l1-1-0.dll" "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL"40:Tb86,"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" trying to access non-existent file "C:\Windows\SYSTEM32\MSCOREE.DLL.local" "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" trying to access non-existent file "C:\c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe.config" "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\Client\" "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" trying to access non-existent file "C:\c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.INI" "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" trying to access non-existent file "C:\c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe.Local\" "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" trying to access non-existent file "C:\c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe:Zone.Identifier" "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\SubDir\workbook.exe:Zone.Identifier" "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" trying to access non-existent file "C:\C5CB97FBE4243DF1A99A9C82F44AD555F283FAD9F4B15B791FAEBE5048C8FC99.EXE.CONFIG" "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC" "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\CLIENT" "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" trying to access non-existent file "C:\C5CB97FBE4243DF1A99A9C82F44AD555F283FAD9F4B15B791FAEBE5048C8FC99.INI" "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" trying to access non-existent file "C:\C5CB97FBE4243DF1A99A9C82F44AD555F283FAD9F4B15B791FAEBE5048C8FC99.EXE.LOCAL" "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" trying to access non-existent file "C:\c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe:ZONE.IDENTIFIER" "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\SUBDIR"41:Tcc3,Observed Namespace "System.Net.Sockets.Socket" and MemberReference ".ctor" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "BeginConnect" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "EndConnect" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "get_Connected" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "BeginReceive" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "get_LocalEndPoint" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "EndReceive" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Close" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Send" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Connect" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed Namespace "System.Net.Sockets.NetworkStream" and MemberReference ".ctor" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Dispose" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "IOControl" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "get_OSSupportsIPv6" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed Namespace "System.Net.Sockets.SocketException" and MemberReference "get_SocketErrorCode" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed Namespace "System.Net.Sockets.Socket" and MemberReference ".ctor" in "workbook.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "BeginConnect" in "workbook.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "EndConnect" in "workbook.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "get_Connected" in "workbook.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "BeginReceive" in "workbook.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "get_LocalEndPoint" in "workbook.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "EndReceive" in "workbook.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Close" in "workbook.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Send" in "workbook.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Connect" in "workbook.exe"42:T8e4,Observed Namespace "System.Net.WebClient" and MemberReference ".ctor" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed Namespace "System.Net.WebClient" and MemberReference "set_Proxy" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed Namespace "System.Net.WebClient" and MemberReference "add_DownloadFileCompleted" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed Namespace "System.Net.WebClient" and MemberReference "get_IsBusy" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed Namespace "System.Net.WebClient" and MemberReference "CancelAsync" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed Namespace "System.Net.WebClient" and MemberReference "DownloadFileAsync" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed Namespace "System.Net.WebClient" and MemberReference "remove_DownloadFileCompleted" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed Namespace "System.Net.HttpWebRequest" and MemberReference "set_UserAgent" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed Namespace "System.Net.HttpWebRequest" and MemberReference "set_AllowAutoRedirect" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed Namespace "System.Net.WebClient" and MemberReference ".ctor" in "workbook.exe" Observed Namespace "System.Net.WebClient" and MemberReference "set_Proxy" in "workbook.exe" Observed Namespace "System.Net.WebClient" and MemberReference "add_DownloadFileCompleted" in "workbook.exe" Observed Namespace "System.Net.WebClient" and MemberReference "get_IsBusy" in "workbook.exe" Observed Namespace "System.Net.WebClient" and MemberReference "CancelAsync" in "workbook.exe" Observed Namespace "System.Net.WebClient" and MemberReference "DownloadFileAsync" in "workbook.exe" Observed Namespace "System.Net.WebClient" and MemberReference "remove_DownloadFileCompleted" in "workbook.exe" Observed Namespace "System.Net.HttpWebRequest" and MemberReference "set_UserAgent" in "workbook.exe" Observed Namespace "System.Net.HttpWebRequest" and MemberReference "set_AllowAutoRedirect" in "workbook.exe"43:T5e2,Observed Namespace "System.Net.Sockets.Socket" and MemberReference "BeginConnect" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "EndConnect" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "get_Connected" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "BeginReceive" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "EndReceive" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Connect" in "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "BeginConnect" in "workbook.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "EndConnect" in "workbook.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "get_Connected" in "workbook.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "BeginReceive" in "workbook.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "EndReceive" in "workbook.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Connect" in "workbook.exe"44:T507,Found string "DBFilename=|DataDirectory|aspnetdb.mdf;User Instance=true" providerName="System.Data.SqlClient"/>" (Indicator: "System.Data.SqlClient"; Source: "00000000-00000132.00000001.91074.00270000.00000004.mdmp"), Found string "er Instance=true" providerName="System.Data.SqlClient"/>" (Indicator: "System.Data.SqlClient"; Source: "00000000-00004424.00000000.83616.00330000.00000004.mdmp, 00000000-00004424.00000001.85542.00330000.00000004.mdmp, 00000000-00004424.00000002.87464.00330000.00000004.mdmp") Found string "" (Indicator: "System.Data.SqlClient"; Source: "00000000-00004424.00000000.83616.00330000.00000004.mdmp") Found string "System.Data.SqlClient" (Indicator: "System.Data.SqlClient"; Source: "00000000-00004424.00000000.83616.020C0000.00000004.mdmp") Found string "" (Indicator: "System.Data.SqlClient"; Source: "00000000-00005692.00000000.79120.003B0000.00000004.mdmp")45:Teac,"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00005692) "c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00005692)46:Te8c,Gma.System.MouseKeyHook.Implementation.KeyListener::.ctor(Gma.System.MouseKeyHook.Implementation.Subscribe) at 3e8b57c2be9df63483a368b71ccb938b-6000999-ctor Gma.System.MouseKeyHook.Implementation.MouseListener::.ctor(Gma.System.MouseKeyHook.Implementation.Subscribe) at 3e8b57c2be9df63483a368b71ccb938b-600099c-ctor Gma.System.MouseKeyHook.Implementation.BaseListener::set_Handle(Gma.System.MouseKeyHook.WinApi.HookResult) at 3e8b57c2be9df63483a368b71ccb938b-60009a3-ctor Gma.System.MouseKeyHook.Implementation.BaseListener::get_Handle() at 3e8b57c2be9df63483a368b71ccb938b-60009a6-BaseListener~Dispose Gma.System.MouseKeyHook.Implementation.KeyListener::.ctor(Gma.System.MouseKeyHook.Implementation.Subscribe) at 3e8b57c2be9df63483a368b71ccb938b-60009ac-ctor Gma.System.MouseKeyHook.Implementation.MouseListener::.ctor(Gma.System.MouseKeyHook.Implementation.Subscribe) at 3e8b57c2be9df63483a368b71ccb938b-60009af-ctor Gma.System.MouseKeyHook.Implementation.GlobalMouseListener::IsDoubleClick(Gma.System.MouseKeyHook.MouseEventExtArgs) at 3e8b57c2be9df63483a368b71ccb938b-60009b0-GlobalMouseListener~ProcessDown Gma.System.MouseKeyHook.Implementation.MouseListener::ProcessUp(Gma.System.MouseKeyHook.MouseEventExtArgs&) at 3e8b57c2be9df63483a368b71ccb938b-60009b1-GlobalMouseListener~ProcessUp Gma.System.MouseKeyHook.Implementation.EventFacade::GetKeyListener() at 3e8b57c2be9df63483a368b71ccb938b-60009b9-EventFacade~add_KeyDown Gma.System.MouseKeyHook.Implementation.EventFacade::GetKeyListener() at 3e8b57c2be9df63483a368b71ccb938b-60009ba-EventFacade~remove_KeyDown Gma.System.MouseKeyHook.Implementation.EventFacade::GetKeyListener() at 3e8b57c2be9df63483a368b71ccb938b-60009bb-EventFacade~add_KeyPress Gma.System.MouseKeyHook.Implementation.EventFacade::GetKeyListener() at 3e8b57c2be9df63483a368b71ccb938b-60009bc-EventFacade~remove_KeyPress Gma.System.MouseKeyHook.Implementation.EventFacade::GetKeyListener() at 3e8b57c2be9df63483a368b71ccb938b-60009bd-EventFacade~add_KeyUp Gma.System.MouseKeyHook.Implementation.EventFacade::GetKeyListener() at 3e8b57c2be9df63483a368b71ccb938b-60009be-EventFacade~remove_KeyUp Gma.System.MouseKeyHook.Implementation.EventFacade::GetMouseListener() at 3e8b57c2be9df63483a368b71ccb938b-60009bf-EventFacade~add_MouseMove Gma.System.MouseKeyHook.Implementation.EventFacade::GetMouseListener() at 3e8b57c2be9df63483a368b71ccb938b-60009c0-EventFacade~remove_MouseMove Gma.System.MouseKeyHook.Implementation.EventFacade::GetMouseListener() at 3e8b57c2be9df63483a368b71ccb938b-60009c1-EventFacade~add_MouseMoveExt Gma.System.MouseKeyHook.Implementation.EventFacade::GetMouseListener() at 3e8b57c2be9df63483a368b71ccb938b-60009c2-EventFacade~remove_MouseMoveExt Gma.System.MouseKeyHook.Implementation.EventFacade::GetMouseListener() at 3e8b57c2be9df63483a368b71ccb938b-60009c3-EventFacade~add_MouseClick Gma.System.MouseKeyHook.Implementation.EventFacade::GetMouseListener() at 3e8b57c2be9df63483a368b71ccb938b-60009c4-EventFacade~remove_MouseClick Gma.System.MouseKeyHook.Implementation.EventFacade::GetMouseListener() at 3e8b57c2be9df63483a368b71ccb938b-60009c5-EventFacade~add_MouseDown Gma.System.MouseKeyHook.Implementation.EventFacade::GetMouseListener() at 3e8b57c2be9df63483a368b71ccb938b-60009c6-EventFacade~remove_MouseDown Gma.System.MouseKeyHook.Implementation.EventFacade::GetMouseListener() at 3e8b57c2be9df63483a368b71ccb938b-60009c7-EventFacade~add_MouseDownExt Gma.System.MouseKeyHook.Implementation.EventFacade::GetMouseListener() at 3e8b57c2be9df63483a368b71ccb938b-60009c8-EventFacade~remove_MouseDownExt Gma.System.MouseKeyHook.Implementation.EventFacade::GetMouseListener() at 3e8b57c2be9df63483a368b71ccb938b-60009c9-EventFacade~add_MouseUp47:Ted4,鬝�ᾝ褐㛃ՠㆅ稠觼젴�♦䪮玞⯞贈껎邁牺::set_Handle(System.Net.Sockets.Socket) at 3e8b57c2be9df63483a368b71ccb938b-6000055-ctor System.Net.Sockets.Socket::EndConnect(System.IAsyncResult) at 3e8b57c2be9df63483a368b71ccb938b-6000056-_~_ System.Net.Sockets.Socket::EndReceive(System.IAsyncResult) at 3e8b57c2be9df63483a368b71ccb938b-6000057-_~_ System.Net.Sockets.Socket::Close() at 3e8b57c2be9df63483a368b71ccb938b-6000058-_~_ System.Net.Sockets.Socket::Send(System.Byte[]) at 3e8b57c2be9df63483a368b71ccb938b-6000059-_~_ 蛃瘀貆챾毾侃⼰㵿挝䐒垰詽樿婖䫅﯄ᄵ⺇::SetKeepAliveEx(System.Net.Sockets.Socket,System.UInt32,System.UInt32) at 3e8b57c2be9df63483a368b71ccb938b-6000140-_~_ System.Type::GetMethod(System.String,System.Reflection.BindingFlags) at 3e8b57c2be9df63483a368b71ccb938b-6000357-Helpers~GetInstanceMethod System.Type::GetMethod(System.String,System.Reflection.BindingFlags) at 3e8b57c2be9df63483a368b71ccb938b-6000358-Helpers~GetStaticMethod System.Type::GetMethod(System.String,System.Reflection.BindingFlags,System.Reflection.Binder,System.Type[],System.Reflection.ParameterModifier[]) at 3e8b57c2be9df63483a368b71ccb938b-6000359-Helpers~GetStaticMethod System.Type::GetMethod(System.String,System.Reflection.BindingFlags,System.Reflection.Binder,System.Type[],System.Reflection.ParameterModifier[]) at 3e8b57c2be9df63483a368b71ccb938b-600035a-Helpers~GetInstanceMethod System.Type::GetConstructor(System.Reflection.BindingFlags,System.Reflection.Binder,System.Type[],System.Reflection.ParameterModifier[]) at 3e8b57c2be9df63483a368b71ccb938b-6000364-Helpers~GetConstructor System.Type::GetConstructors(System.Reflection.BindingFlags) at 3e8b57c2be9df63483a368b71ccb938b-6000365-Helpers~GetConstructors System.Type::GetProperty(System.String,System.Reflection.BindingFlags) at 3e8b57c2be9df63483a368b71ccb938b-6000366-Helpers~GetProperty System.Type::GetProperties(System.Reflection.BindingFlags) at 3e8b57c2be9df63483a368b71ccb938b-6000368-Helpers~GetInstanceFieldsAndProperties System.Type::GetMethod(System.String,System.Reflection.BindingFlags,System.Reflection.Binder,System.Type[],System.Reflection.ParameterModifier[]) at 3e8b57c2be9df63483a368b71ccb938b-6000508-DefaultValueDecorator~EmitBeq System.Type::GetProperties(System.Reflection.BindingFlags) at 3e8b57c2be9df63483a368b71ccb938b-600057b-MapDecorator_3~GetIndexerSetter System.Type::GetMethod(System.String,System.Reflection.BindingFlags,System.Reflection.Binder,System.Type[],System.Reflection.ParameterModifier[]) at 3e8b57c2be9df63483a368b71ccb938b-600059d-ParseableSerializer~TryCreate System.Type::GetMethod(System.String,System.Reflection.BindingFlags,System.Reflection.Binder,System.Type[],System.Reflection.ParameterModifier[]) at 3e8b57c2be9df63483a368b71ccb938b-600059e-ParseableSerializer~GetCustomToString System.Type::GetMethods(System.Reflection.BindingFlags) at 3e8b57c2be9df63483a368b71ccb938b-60005f0-SurrogateSerializer~HasCast System.Type::GetMethod(System.String,System.Reflection.BindingFlags) at 3e8b57c2be9df63483a368b71ccb938b-6000635-EmitWrite System.Type::GetMethod(System.String,System.Reflection.BindingFlags) at 3e8b57c2be9df63483a368b71ccb938b-600063b-EmitCreateInstance System.Type::GetMembers(System.Reflection.BindingFlags) at 3e8b57c2be9df63483a368b71ccb938b-60006c7-MetaType~ApplyDefaultBehaviourImpl System.Type::GetMember(System.String,System.Reflection.BindingFlags) at 3e8b57c2be9df63483a368b71ccb938b-60006e6-MetaType~AddField System.Type::GetMethod(System.String,System.Reflection.BindingFlags) at 3e8b57c2be9df63483a368b71ccb938b-6000746-RuntimeTypeModel~Override System.Type::GetMethod(System.String,System.Reflection.BindingFlags) at 3e8b57c2be9df63483a368b71ccb938b-600074b-RuntimeTypeModel~WriteGetKeyImpl48:T41f,YARA signature "INDICATOR_SUSPICIOUS_Binary_References_Browsers" matched file "sample.bin" as "Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers." YARA signature "INDICATOR_SUSPICIOUS_GENInfoStealer" matched file "sample.bin" as "Detects executables containing common artifacts observed in infostealers" YARA signature "INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA" matched file "sample.bin" as "Detects Windows executables referencing non-Windows User-Agents" YARA signature "INDICATOR_SUSPICIOUS_Binary_References_Browsers" matched file "workbook.exe.1976228177" as "Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers." YARA signature "INDICATOR_SUSPICIOUS_GENInfoStealer" matched file "workbook.exe.1976228177" as "Detects executables containing common artifacts observed in infostealers" YARA signature "INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA" matched file "workbook.exe.1976228177" as "Detects Windows executables referencing non-Windows User-Agents"49:T590,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD80lEQVR4Xu2W21cTVxTG/b/6Tq22VuSi4DWiLXYtXAoiIOiChNwDMQawSDCESwiEgNTWVmpfbSH2wSf7ZN/oCyHJZGYyueDXfWZIMkwyQmwXfaiz1rfO5JyZs3/7O/ucyZEjH6//+rI63RgYtB2qBi0OFAEsNgf+eLuJ12/+JL39V/V1t6diyyBKDtiH8et69B9pfeMVNqK/Y+OVonW6/436mLTPMu0BMJkdSAlpZDMSMlL6A6S8J1WQ9lkWQ8zktAB2ufMwVQaQy+flgbW1l3jxy+sDae3nl8jnsrKi0WhFFTL/5NqULHZfESC/C8AmrutbQv3dMBr6F9FoXMBpcwhnrCE0O4NoHprDOc8Mznun5Wf/2txEJi2UWa1VVQCXbKswOJ7A4FxBy/AyrngiuOpdwldji2gdX8A1Xwjf+OdVAHxZ5lU5wH7sqADavD+gbfR7XH/4FDcekXyraPc/QUdgBbdml9EZjKBrIVwEyBIAm1iSRKVNK63WgRrTqD4ALyoDbNKuyefo8f+EnsCP6J19hpsU/Lo/jNbJIC5P+GHwTaJlylcCEIWyzLUOsOAnHzr1ATheLAIYgy9wb+45WkZCOGGbwKeWEXzmeIDjQx58ft+NE94hnBxzqgB2HaDM5e3HWo0LLHjzXP/BANoff4fj5nHUDI7iqM2LY04KPnwfXzwYxpejLnmyU4/sKoBUWeZaB1jw1mdt+gApFUCNcUzJ2k7Bi1lT8DEXar914NSEDfWPLXtqQKLDKC3q7wYW/P0AQgngqHXXcpa1h4KPDMlZ147bUeezosFvxumAqbQLxP13wQEASkV4zEVZu1WWs6zJ8vpJKxqnBnFm2ogmsrQIIPBVHeP7AqgLrXbcgTqyvIEsbwxQ8JkBWs97OBfqq+ocqApAXWj1BcunTWia7cfZ4F2cX+jFxXD3HoDM7g7QBqukfQHUhSZbPmNUsp7vw4XFO7i41A3DcmcRIE01wApQu/WYWJ9IYxzHIZFIIJmI7w+gLrSm2QHKmlneiwvhHlyKdOHySidaVjuKANJ7tqGUpnkJMJlMIB6PIxHf1gFQnYTqQjs7zyy/I1tuiNym4LdwZbUdV5/eUAFwFbMvOCBQkbLMY7EYtrdjlQEEUfmjMD2zLE98EE0FIsoSCPpFKPA8UlySAm8rADEdgGRKcYB929mk1UhIlRxgLasHnk+BSynrzrLe2tqSpQsQ59LyJxk7GWQlHkAWyFNfRkCOhB2J+t6Rdkh5ZRwZvMspRVY4/9OiCJ4cSVFwjjJP0Nqz9S+IuaELwAYOS3sA2H/0vgGz3PkhMtH7FrsLdpcbVocbZqsTxgrPqXWz43YJ4OP1v7/+BnvlpAT3X7SfAAAAAElFTkSuQmCC1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790609181067,"unified_at":"2026-09-28T15:26:21.067Z","metadata":{"hashes":{"sha256":"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99","sha1":"deb26a1b7f616c8d392ae55dd279140b034a4060","md5":"3e8b57c2be9df63483a368b71ccb938b","sha512":"c7d646c84531b6f182820a3cebc1779ef87bd0c92aeabccb922b685f040371d251b0da15fd5ecaa54dfe315560bba807a87aed2f44dbc0fce9703b5c0f4ee7e5","ssdeep":"49152:Dvwt62XlaSFNWPjljiFa2RoUYIMIW+sWvoGdBNZTHHB72eh2NT:Dv862XlaSFNWPjljiFXRoUYIjW+s6","ssdeep_chunks":["49152:Dvwt62X","49152:vwt62Xl","49152:wt62Xla","49152:t62XlaS","49152:62XlaSF","49152:2XlaSFN","49152:XlaSFNW","49152:laSFNWP","49152:aSFNWPj","49152:SFNWPjl","49152:FNWPjlj","49152:NWPjlji","49152:WPjljiF","49152:PjljiFa","49152:jljiFa2","49152:ljiFa2R","49152:jiFa2Ro","49152:iFa2RoU","49152:Fa2RoUY","49152:a2RoUYI","49152:2RoUYIM","49152:RoUYIMI","49152:oUYIMIW","49152:UYIMIW+","49152:YIMIW+s","49152:IMIW+sW","49152:MIW+sWv","49152:IW+sWvo","49152:W+sWvoG","49152:+sWvoGd","49152:sWvoGdB","49152:WvoGdBN","49152:voGdBNZ","49152:oGdBNZT","49152:GdBNZTH","49152:dBNZTHH","49152:BNZTHHB","49152:NZTHHB7","49152:ZTHHB72","49152:THHB72e","49152:HHB72eh","49152:HB72eh2","49152:B72eh2N","49152:72eh2NT","98304:Dvwt62X","98304:vwt62Xl","98304:wt62Xla","98304:t62XlaS","98304:62XlaSF","98304:2XlaSFN","98304:XlaSFNW","98304:laSFNWP","98304:aSFNWPj","98304:SFNWPjl","98304:FNWPjlj","98304:NWPjlji","98304:WPjljiF","98304:PjljiFa","98304:jljiFa2","98304:ljiFa2R","98304:jiFa2Ro","98304:iFa2RoU","98304:Fa2RoUY","98304:a2RoUYI","98304:2RoUYIM","98304:RoUYIMI","98304:oUYIMIW","98304:UYIMIW+","98304:YIMIW+s","98304:IMIW+sW","98304:MIW+sWv","98304:IW+sWvo","98304:W+sWvoG","98304:+sWvoGd","98304:sWvoGdB","98304:WvoGdBN","98304:voGdBNZ","98304:oGdBNZT","98304:GdBNZTH","98304:dBNZTHH","98304:BNZTHHB","98304:NZTHHB7","98304:ZTHHB72","98304:THHB72e","98304:HHB72eh","98304:HB72eh2","98304:B72eh2N","98304:72eh2NT","49152:Dv862Xl","49152:v862Xla","49152:862XlaS","49152:PjljiFX","49152:jljiFXR","49152:ljiFXRo","49152:jiFXRoU","49152:iFXRoUY","49152:FXRoUYI","49152:XRoUYIj","49152:RoUYIjW","49152:oUYIjW+","49152:UYIjW+s","49152:YIjW+s6"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"Client.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":3266048,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1725627339000,"last_seen":1788898479000,"last_multi_scan":1788898479000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["commodity","strrat","modular","rat","guloader","informationstealer","proxy","loda","keylogger","quasar","opensource","targeted","xworm","criminal","asyncrat","ransomware","downloader","warzone","evasive"]},"stats":{"av":{"malicious_count":20,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":2,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":69},"sandbox_signatures":{"informative_count":162,"suspicious_count":18,"malicious_count":10,"total":190},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Backdoor/Win32.QuasarRAT","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/MSIL.Quasar","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Quasar.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Application.Fca.3927","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Malware.Generic-9883083-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.Agent (A)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/Agent.CLQ trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Spy.Win32.Keylogger.dd!n","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Trojan/MSIL.Obfuscated.g!crit","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005b1c021 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"YARA","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Quasar-AF","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Backdoor/W32.DN-Agent.3266048.G","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"malicious","threat_name":"Quasar!3E8B57C2BE9D","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/MSIL_Troj.BTX.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.MSIL_Heur.B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Agent.Win32.4008352","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Agent","sources":[{"report_type":"quickscan","report_id":""}]},{"value":"Quasar","sources":[{"report_type":"qsp","report_id":""}]}]},"mitre_attacks":[{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to perform CryptoStream operations (Dotnet)"},{"type":"informative","value":"Dotnet file contains encryption/decryption functions"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Found a cryptographic related string in Linux binary"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"YARA signature match - MD5 algorithm"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to perform crypto operations"},{"type":"informative","value":"Dotnet code contains ability to generate random numbers"},{"type":"informative","value":"Contains ability to perform symmetric encryption (Dotnet)"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"Contains key cryptographic functions (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Found browser information locations related strings"},{"type":"informative","value":"Calls an API typically used to copy file from one location to another"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":".NET code is able to query registry"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Possibly checks for the presence of an Antivirus engine"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to gather system environment details"},{"type":"informative","value":"Contains ability to retrieve information about the current system"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Able to gather system file/directory information (.NET)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to gather system information (Dotnet)"},{"type":"informative","value":"Able to obtain MAC address in .NET file"},{"type":"informative","value":"Contains ability to query the machine version"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"tactic":"Discovery","technique":"Internet Connection Discovery","attack_id":"T1016.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1016/001","identifiers":[{"type":"informative","value":"Able to check internet connectivity using ping command"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Found a reference to a WMI query string known to be used for VM detection"},{"type":"informative","value":"Contains ability to execute a WMI query"},{"type":"informative","value":"Contains ability to execute WMI queries (Dotnet)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to cryptographic keys"},{"type":"informative","value":"Contains reference to crypto DLLs"},{"type":"informative","value":"Contains ability to perform encryption (API string)"},{"type":"informative","value":"Able to access crypto-related API (String)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"},{"type":"informative","value":"Able to perform SQL operations"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":".NET source code contains suspicious native API"},{"type":"informative","value":"Found Native API in Dotnet file"},{"type":"informative","value":"Contains native function calls (syscalls strings)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Able to execute application (.NET)"},{"type":"informative","value":"Contains ability to start a process (Dotnet)"},{"type":"informative","value":"Contains ability to execute Windows APIs"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","identifiers":[{"type":"suspicious","value":"Found registry location strings which can modify auto-execute functionality"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"tactic":"Credential Access","technique":"Credentials In Files","attack_id":"T1552.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1552/001","identifiers":[{"type":"suspicious","value":"Identified FTP credentials location strings"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"tactic":"Credential Access","technique":"Credentials from Web Browsers","attack_id":"T1555.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/003","identifiers":[{"type":"suspicious","value":"Able to retrieve saved login credentials from browser"},{"type":"informative","value":"References Chromium browser credentials files"},{"type":"informative","value":"References Firefox browser credentials files"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contains ability to communicates via socket (possible C&C communication)"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"suspicious","value":"Spawned process connects to a network"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"tactic":"Execution","technique":"Scheduled Task","attack_id":"T1053.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1053/005","identifiers":[{"type":"malicious","value":"Schedules a task to be executed at a specific time and date"}],"sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Connects to LPC ports"}],"sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"}],"sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"The analysis spawned a process that was identified as malicious"},{"type":"malicious","value":"The analysis extracted a file that was identified as malicious"},{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Dotnet code contains ability to modify/delete registry"}],"sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"suspicious","value":"Adjusts debug privileges"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"suspicious","value":"Spawned processes are likely due to an injection"}],"sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Able to execute applications in hidden mode (.NET)"}],"sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"informative","value":"Contains ability to delete files"},{"type":"malicious","value":"Tries to hide tracks of having downloaded a file from the internet"}],"sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"Uses a .NET obfuscator to hide its code"},{"type":"informative","value":"Dotnet file contains function to dynamically call methods at runtime"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains symmetric decryption functionality in .NET code"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"},{"type":"informative","value":"Able to load content into memory (.NET)"},{"type":"informative","value":"Able to decode string content at runtime (.NET)"}],"sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"},{"type":"informative","value":"Contains ability to generate intermediate language instructions (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"tactic":"Defense Evasion","technique":"Masquerade Task or Service","attack_id":"T1036.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/004","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to set file attributes (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Found strings related to keylogger"}],"sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"tactic":"Credential Access","technique":"Network Sniffing","attack_id":"T1040","attack_id_wiki":"https://attack.mitre.org/techniques/T1040","identifiers":[{"type":"suspicious","value":"Contains ability to listen for incoming connections"}],"sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Contains ability to gather process details (Dotnet)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"References to WMI query strings used for process discovery"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"}],"sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"suspicious","value":"Reference to an external IP address lookup service identified"},{"type":"informative","value":"Contains ability to retrieve network adapter information (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Reads files"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"}],"sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve current user details (Dotnet)"},{"type":"informative","value":"Contains ability to retrieve user privileges"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"}],"sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"tactic":"Discovery","technique":"Domain Groups","attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"References Windows LDAP client module"},{"type":"informative","value":"Loads Windows LDAP client module"}],"sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"suspicious","value":"Able to retrieve open application windows"},{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Contains ability to get active window titles (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Contains ability to retrieve system language"}],"sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Calls an API typically used to register an interface (RPC)"}],"sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"},{"type":"informative","value":"Contains ability to capture screen information (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains ability to communicate with network (Dotnet)"},{"type":"informative","value":"Found User Agent related strings"},{"type":"informative","value":"Contains ability to provide interface for network protocols (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"malicious","value":"Uses network protocols on unusual ports"},{"type":"suspicious","value":"Contains ability to open a port and listen for incoming connection"}],"sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Contains ability to download files with network (Dotnet)"},{"type":"informative","value":"Able to download remote files (.NET)"},{"type":"suspicious","value":"Drops executable files"}],"sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate via sockets (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains ability to perform asymmetric crypto operations"}],"sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Contains ability to perform symmetric crypto operations"},{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Asymmetric Encrypted Non-C2 Protocol","attack_id":"T1048.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1048/002","identifiers":[{"type":"informative","value":"Contains references to SFTP or FTPS file transfer"}],"sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]}],"sandbox_signatures":[{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1027","id":"yara-103","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - MD5 algorithm","description":"YARA signature for MD5 algorithm matched on file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1027","id":"yara-112","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (On Sensor) detected file with high confidence","description":"\"Portable Executable (On Sensor) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-12","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" in Source: sample.bin, \"BraveSoftware\\Brave-Browser\\User Data\\Local State\" in Source: sample.bin, \"Opera Software\\Opera GX Stable\\Login Data\" in Source: sample.bin, \"SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\" in Source: sample.bin, \"Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2\" in Source: sample.bin, \"Opera Software\\Opera Stable\\Login Data\" in Source: sample.bin, \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce\" in Source: sample.bin, \"SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\RunOnce\" in Source: sample.bin, \"BraveSoftware\\Brave-Browser\\User Data\\Default\\Login Data\" in Source: sample.bin, \"SOFTWARE\\\\Martin Prikryl\\\\WinSCP 2\\\\Sessions\" in Source: sample.bin, \"Opera Software\\Opera GX Stable\\Local State\" in Source: sample.bin, \"Software\\Microsoft\\Windows\\CurrentVersion\\Run\" in Source: sample.bin, \"Opera Software\\Opera Stable\\Local State\" in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-120","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"General","name":"Contains native function calls (syscalls strings)","description":"$25","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-5000","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Possibly checks for the presence of an Antivirus engine","description":"\"Antivirus\" (Indicator: \"antivirus\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1518.001","id":"string-8","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"\"Are you mixing protobuf-net and protobuf-csharp-port? See https://stackoverflow.com/q/11564914/23354; type: \" (Indicator: \"stackoverflow.com\"), \"; please see https://stackoverflow.com/q/14436606/23354\" (Indicator: \"stackoverflow.com\")","origin":"sample.bin","id":"string-135","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"SELECT Caption FROM Win32_OperatingSystem\" (Source: sample.bin, Indicator: \"select caption from win32_operatingsystem\")","origin":"sample.bin","mitre_attack_id":"T1213","id":"string-16","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Found registry location strings which can modify auto-execute functionality","description":"$26","origin":"sample.bin","mitre_attack_id":"T1547","id":"string-184","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"$27","origin":"sample.bin","mitre_attack_id":"T1486","id":"string-280","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Cryptographic Related","name":"Found a cryptographic related string in Linux binary","description":"Observed cryptographic string -(Indicator: \"des-cbc\"), Observed cryptographic string -(Indicator: \"rc2-cbc\"), Observed cryptographic string -(Indicator: \"idea-cbc\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-5004","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$28","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-57","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Identified FTP credentials location strings","description":"\"{0}\\FileZilla\\sitemanager.xml\" (Indicator: \"sitemanager.xml\") in Source: sample.bin, \"{0}\\FileZilla\\recentservers.xml\" (Indicator: \"recentservers.xml\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1552.001","id":"string-11","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found browser information locations related strings","description":"$29","origin":"sample.bin","mitre_attack_id":"T1005","id":"string-93","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"HostName\" (Indicator: \"hostname\"; Source: \"sample.bin\"), Found string \"'name' is not a HostName string\" (Indicator: \"hostname\"; Source: \"sample.bin\"), Found string \"hostname\" (Indicator: \"hostname\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-126","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"no password supplied when one expected\" (Indicator: \"password\"; Source: \"sample.bin\"), Found string \"Missing password.\" (Indicator: \"password\"; Source: \"sample.bin\"), Found string \"BCrypt password must be <= 72 bytes\" (Indicator: \"password\"; Source: \"sample.bin\"), Found string \"cannot export keying material without extended_master_secret\" (Indicator: \"secret\"; Source: \"sample.bin\"), Found string \"password_value\" (Indicator: \"password\"; Source: \"sample.bin\"), Found string \"Export of key material requires extended_master_secret\" (Indicator: \"secret\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1555","id":"string-475","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Able to retrieve saved login credentials from browser","description":"Found string \"logins.json\" (Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1555.003","id":"string-693","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"Found string \"SELECT Caption FROM Win32_OperatingSystem\" (Indicator: \" Win32_OperatingSystem\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-507","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$2a","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-138","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"1.4.1.0\", \"2.5.1.1\", \"2.5.29.37\", \"2.5.29.17\", \"2.5.29.18\", \"2.5.29.19\", \"2.5.29.15\", \"2.4.0.0\", \"1.9.0.1\", Potential IP \"2.4.8.1\" found in string \"2.4.8.1+cce1c58590\", \"1.3.132.0\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Network Related","name":"Able to check internet connectivity using ping command","description":"Found string \"@echo off\nchcp 65001\necho DONT CLOSE THIS WINDOW!\nping -n 10 localhost > nul\ndel /a /q /f \"\" (Indicator: \"ping -\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1016.001","id":"string-5070","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"https://ipwho.is/\", Pattern match: \"https://stackoverflow.com/q/11564914/23354\", Heuristic match: \"\n*.sy\", Pattern match: \"https://stackoverflow.com/q/14436606/23354\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://ipwho.is\", Found HTTPS url \"https://stackoverflow.com\"","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-98","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1529","id":"string-406","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a reference to a WMI query string known to be used for VM detection","description":"\"SELECT Caption FROM Win32_OperatingSystem\" (Indicator: \" win32_operatingsystem\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1047","id":"string-55","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to execute applications in hidden mode (.NET)","description":"Observed Namespace \"System.Diagnostics.ProcessStartInfo\" and MemberReference \"set_CreateNoWindow\" in \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\"\n Observed Namespace \"System.Diagnostics.ProcessStartInfo\" and MemberReference \"set_CreateNoWindow\" in \"workbook.exe\"","origin":"Static Parser","mitre_attack_id":"T1564.003","relevance":7,"id":"static-161","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to load content into memory (.NET)","description":"$2b","origin":"Static Parser","mitre_attack_id":"T1140","relevance":5,"id":"static-107","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe\" called \"LoadResource with parameter {'hModule': '1975910400', 'hResInfo': '7472624'}\" (UID: 00000000-00005692)\n \"workbook.exe\" called \"LoadResource with parameter {'hModule': '1975910400', 'hResInfo': '4851184'}\" (UID: 00000000-00004424)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to generate intermediate language instructions (Dotnet)","description":"Observed namespace \"System.Reflection.Emit.DynamicMethod\" and TypeReference \"GetILGenerator\" in \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\"\n Observed namespace \"System.Reflection.Emit.ILGenerator\" and TypeReference \"Emit\" in \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\"\n Observed namespace \"System.Reflection.Emit.ILGenerator\" and TypeReference \"EmitCall\" in \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\"\n Observed namespace \"System.Reflection.Emit.DynamicMethod\" and TypeReference \"GetILGenerator\" in \"workbook.exe\"\n Observed namespace \"System.Reflection.Emit.ILGenerator\" and TypeReference \"Emit\" in \"workbook.exe\"\n Observed namespace \"System.Reflection.Emit.ILGenerator\" and TypeReference \"EmitCall\" in \"workbook.exe\"","origin":"Static Parser","mitre_attack_id":"T1620","relevance":1,"id":"static-171","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/3\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; File: \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/3\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; File: \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file contains encryption/decryption functions","description":"Observed namespace \"System.Security.Cryptography\" and MemberReference \"CreateDecryptor\" in \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\"\n Observed namespace \"System.Security.Cryptography\" and MemberReference \"CreateDecryptor\" in \"workbook.exe\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-134","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file contains function to dynamically call methods at runtime","description":"Observed namespace \"System\" and MemberReference \"GetMethod\" in \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\"\n Observed namespace \"System.Reflection\" and MemberReference \"GetGetMethod\" in \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\"\n Observed namespace \"System\" and MemberReference \"GetMethods\" in \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\"\n Observed namespace \"System\" and MemberReference \"GetMethod\" in \"workbook.exe\"\n Observed namespace \"System.Reflection\" and MemberReference \"GetGetMethod\" in \"workbook.exe\"\n Observed namespace \"System\" and MemberReference \"GetMethods\" in \"workbook.exe\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":1,"id":"static-135","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"description=\"Uses CryptProtectData and Cryp\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00000132.00000001.91074.00270000.00000004.mdmp\"), Found reference to API \"iption=\"Uses CryptProtectData and CryptUnProtectData W\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00000132.00000001.91074.00270000.00000004.mdmp\")\n Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00004424.00000000.83616.00330000.00000004.mdmp\")\n Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00004424.00000000.83616.020C0000.00000004.mdmp\")\n Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00005692.00000000.79120.003B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decode string content at runtime (.NET)","description":"Observed function \"FromBase64String\" in \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\"\n Observed function \"ToBase64String\" in \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\"\n Observed function \"FromBase64String\" in \"workbook.exe\"\n Observed function \"ToBase64String\" in \"workbook.exe\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":5,"id":"static-106","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"CryptHashData\" (Indicator: \"CryptHashData\"; File: \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"CryptHashData\" (Indicator: \"CryptHashData\"; File: \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform CryptoStream operations (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.CryptoStream\" and TypeReference \"FlushFinalBlock\" in \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\"\n Observed namespace \"System.Security.Cryptography.CryptoStream\" and TypeReference \"FlushFinalBlock\" in \"workbook.exe\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-166","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform asymmetric crypto operations","description":"$2c","origin":"Static Parser","mitre_attack_id":"T1573.002","relevance":1,"id":"static-141","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform crypto operations","description":"Observed namespace \"System.Security.Cryptography\" in [Source: \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\"]\n Observed namespace \"System.Security.Cryptography.X509Certificates\" in [Source: \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\"]","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-118","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"description=\"Uses CryptProtectData and Cryp\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00000132.00000001.91074.00270000.00000004.mdmp\"), Found reference to API \"iption=\"Uses CryptProtectData and CryptUnProtectData W\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00000132.00000001.91074.00270000.00000004.mdmp\")\n Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00004424.00000000.83616.00330000.00000004.mdmp\")\n Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00004424.00000000.83616.020C0000.00000004.mdmp\")\n Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00005692.00000000.79120.003B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform symmetric crypto operations","description":"Observed namespace \"System.Security.Cryptography.AesCryptoServiceProvider\" and TypeReference \".ctor\" in \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\"\n Observed namespace \"System.Security.Cryptography.AesCryptoServiceProvider\" and TypeReference \".ctor\" in \"workbook.exe\"","origin":"Static Parser","mitre_attack_id":"T1573.001","relevance":1,"id":"static-140","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform symmetric encryption (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateEncryptor\" in \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\"\n Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateEncryptor\" in \"workbook.exe\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-165","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains key cryptographic functions (API string)","description":"Found reference to API \"CryptHashData\" (Indicator: \"CryptHashData\"; File: \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-195","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00000132.00000000.89148.00270000.00000004.mdmp, 00000000-00000132.00000001.91074.00270000.00000004.mdmp\")\n Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00004424.00000000.83616.00330000.00000004.mdmp, 00000000-00004424.00000001.85542.00330000.00000004.mdmp, 00000000-00004424.00000002.87464.00330000.00000004.mdmp\")\n Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00005692.00000000.79120.003B0000.00000004.mdmp, 00000000-00005692.00000001.81041.003B0000.00000004.mdmp, 00000000-00005692.00000002.82967.003B0000.00000004.mdmp, 00000000-00005692.00000003.83301.003B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains symmetric decryption functionality in .NET code","description":"Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateDecryptor\" in \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\"\n Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateDecryptor\" in \"workbook.exe\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-168","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Cryptographic Related","name":"Dotnet code contains ability to generate random numbers","description":"Observed namespace \"System.Security.Cryptography.RandomNumberGenerator\" and TypeReference \"GetBytes\" in \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\"\n Observed namespace \"System.Security.Cryptography.RandomNumberGenerator\" and TypeReference \"Create\" in \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\"\n Observed namespace \"System.Security.Cryptography.RandomNumberGenerator\" and TypeReference \"GetBytes\" in \"workbook.exe\"\n Observed namespace \"System.Security.Cryptography.RandomNumberGenerator\" and TypeReference \"Create\" in \"workbook.exe\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-150","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$2d","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2e","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005692-00000C2C-243248783\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system file/directory information (.NET)","description":"Observed dotnet function \"GetFiles\" in \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\"\n Observed dotnet function \"GetDirectories\" in \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\"\n Observed dotnet function \"GetFiles\" in \"workbook.exe\"\n Observed dotnet function \"GetDirectories\" in \"workbook.exe\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":3,"id":"static-200","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005692-00000C2C-243248783\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Environment Awareness","name":"Able to obtain MAC address in .NET file","description":"Observed retrieval of MAC address \"System.Net.NetworkInformation.GetPhysicalAddress\" in \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\"\n Observed retrieval of MAC address \"System.Net.NetworkInformation.GetPhysicalAddress\" in \"workbook.exe\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":1,"id":"static-216","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00005692-00000C2C-241429368\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00005692-00000C2C-241430065\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00005692-00000C2C-308137254\")\n Found reference to API \"CheckTokenMembershipW\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00005692-00000C2C-308137329\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"SendMessage\" (Indicator: \"sendmessage\"; Source: \"00000000-00005692-00000C2C-245542542\")\n Found reference to API \"SendMessageW\" (Indicator: \"sendmessage\"; Source: \"00000000-00005692-00000C2C-245542615\")\n Found reference to API \"PostMessage\" (Indicator: \"postmessage\"; Source: \"00000000-00005692-00000C2C-308894373\")\n Found reference to API \"PostMessageW\" (Indicator: \"postmessage\"; Source: \"00000000-00005692-00000C2C-308894445\")\n Found reference to API \"sendMessageChannelCache\" (Indicator: \"sendmessage\"; Source: \"00000000-00004424.00000000.83616.020C0000.00000004.mdmp\")\n Found reference to API \"System.ServiceModel.Activities.Configuration.SendMessageChannelCacheElement, System.ServiceModel.Activities, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\" (Indicator: \"sendmessage\"; Source: \"00000000-00004424.00000000.83616.020C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00005692)\n \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00005692)\n \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe\" called \"GlobalMemoryStatusEx\" with parameters (UID: 00000000-00005692)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00005692)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe\" called \"IsWow64Process\" with parameter \"5692\" - (UID: 00000000-00005692)\n \"schtasks.exe\" called \"IsWow64Process\" with parameter \"4132\" - (UID: 00000000-00004132)\n \"workbook.exe\" called \"IsWow64Process\" with parameter \"4424\" - (UID: 00000000-00004424)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe\" called \"GetWindowTextW\" (UID: 00000000-00005692)\n \"workbook.exe\" called \"GetWindowTextW\" (UID: 00000000-00004424)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005692)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2f","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$30","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00005692)\n \"schtasks.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00004132)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00005692)\n \"workbook.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00004424)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute WMI queries (Dotnet)","description":"Observed namespace \"System.Management.ManagementObjectSearcher\" in \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\"\n Observed namespace \"System.Management.ManagementObjectSearcher\" in \"workbook.exe\"","origin":"Static Parser","mitre_attack_id":"T1047","relevance":1,"id":"static-114","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"$31","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to gather system environment details","description":"Observed function \"GetEnvironmentVariable\" in \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\"\n Observed function \"GetEnvironmentVariable\" in \"workbook.exe\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":1,"id":"static-119","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to gather system information (Dotnet)","description":"Observed function \"get_UserName\" in \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\"\n Observed function \"get_SystemDirectory\" in \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\"\n Observed function \"get_MachineName\" in \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\"\n Observed function \"get_OSVersion\" in \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\"\n Observed function \"get_Is64BitOperatingSystem\" in \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\"\n Observed function \"get_UserName\" in \"workbook.exe\"\n Observed function \"get_SystemDirectory\" in \"workbook.exe\"\n Observed function \"get_MachineName\" in \"workbook.exe\"\n Observed function \"get_OSVersion\" in \"workbook.exe\"\n Observed function \"get_Is64BitOperatingSystem\" in \"workbook.exe\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":1,"id":"static-120","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to get active window titles (Dotnet)","description":"Observed Namespace \"System.Diagnostics.Process\" and MemberReference \"get_MainWindowTitle\" in \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\"\n Observed Namespace \"System.Diagnostics.Process\" and MemberReference \"get_MainWindowTitle\" in \"workbook.exe\"","origin":"Static Parser","mitre_attack_id":"T1010","relevance":1,"id":"static-148","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"Org.BouncyCastle.Asn1.Pkcs.PrivateKeyInfo::GetVersionValue(Org.BouncyCastle.Asn1.DerInteger) at 3e8b57c2be9df63483a368b71ccb938b-6004ed7-ctor","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"workbook.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve current user details (Dotnet)","description":"Observed Namespace \"System.Security.Principal.WindowsIdentity\" and MemberReference \"GetCurrent\" in \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\"\n Observed Namespace \"System.Security.Principal.WindowsIdentity\" and MemberReference \"GetCurrent\" in \"workbook.exe\"","origin":"Static Parser","mitre_attack_id":"T1033","relevance":1,"id":"static-152","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system","description":"⢬䥂ὃ倏䎑鶒ꢰ丗课ˬⶐ獒腊﯊䱍ᓲೆᝲ륗::韹཮㪧⤅㍌㮋┲挻䖌㋑ᯞ㦴탭ꠛ⠄䉯㤾(戄掣徻庒޷郕廀汦橰ꋹ淯טּꉨ껵﴾䆑⊑,Quasar.Common.Messages.GetSystemInfo) at 3e8b57c2be9df63483a368b71ccb938b-60001d2-_~Execute\n Quasar.Common.Messages.GetSystemInfoResponse::set_SystemInfos(System.Collections.Generic.List`1>) at 3e8b57c2be9df63483a368b71ccb938b-60001d3-_~_","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":4,"id":"stream-86","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve network adapter information (Dotnet)","description":"Observed namespace \"System.Net.NetworkInformation\" and TypeReference \"NetworkInterface\" in \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\"\n Observed namespace \"System.Net.NetworkInformation\" and TypeReference \"NetworkInterface\" in \"workbook.exe\"","origin":"Static Parser","mitre_attack_id":"T1016","relevance":1,"id":"static-137","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language","description":"Gma.System.MouseKeyHook.WinApi.KeyboardNativeMethods::GetKeyboardLayout(System.Int32) at 3e8b57c2be9df63483a368b71ccb938b-6000980-KeyboardNativeMethods~GetActiveKeyboard","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614.001","relevance":3,"id":"stream-79","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"95754896,2168,3024,,RtlGetVersion,NTDLL.dll,\"252:16:16.067\",RX=0,PX=0\" (Indicator: \"GetVersion\"; Source: \"00000000-00004424.00000002.87464.00330000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe\" queries volume information of \"C:\\c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe\" at 00000000-00005692-0000010C-3089539\n \"workbook.exe\" queries volume information of \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\SubDir\\workbook.exe\" at 00000000-00004424-0000010C-3355135\n \"workbook.exe\" queries volume information of \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.ServiceModel\\v4.0_4.0.0.0__b77a5c561934e089\\System.ServiceModel.dll\" at 00000000-00004424-0000010C-67059570\n \"workbook.exe\" queries volume information of \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.ServiceModel\\v4.0_4.0.0.0__b77a5c561934e089\\System.ServiceModel.dll\" at 00000000-00004424-0000010C-67102851","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"workbook.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"workbook.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Environment Awareness","name":"References to WMI query strings used for process discovery","description":"Found string \"SELECT * FROM Win32_Processor\" (Indicator: \" Win32_Process\"; File: \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-513","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"General","name":".NET code is able to query registry","description":"$32","origin":"Static Parser","mitre_attack_id":"T1012","relevance":5,"id":"static-138","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"General","name":".NET source code contains suspicious native API","description":"Observed API \"LoadLibrary\" in \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\"\n Observed API \"GetProcAddress\" in \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\"\n Observed API \"MapVirtualKeyEx\" in \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\"\n Observed API \"LoadLibrary\" in \"workbook.exe\"\n Observed API \"GetProcAddress\" in \"workbook.exe\"\n Observed API \"MapVirtualKeyEx\" in \"workbook.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":5,"id":"static-126","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"General","name":"Able to execute application (.NET)","description":"Observed function \"System.Diagnostics.ProcessStartInfo.UseShellExecute\" in \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\"\n Observed function \"System.Diagnostics.ProcessStartInfo.UseShellExecute\" in \"workbook.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":3,"id":"static-108","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"General","name":"Calls an API typically used to copy file from one location to another","description":"\"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe\" called \"CopyFileW\" to copy C:\\c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe to new location %APPDATA%\\SubDir\\workbook.exe (UID: 00000000-00005692)","origin":"API Call","mitre_attack_id":"T1005","relevance":3,"id":"api-123","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe\" called \"CreateDirectoryW\" with parameter C:\\Users\\%OSUSER% (UID: 00000000-00005692)\n \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData\\Roaming (UID: 00000000-00005692)\n \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe\" called \"CreateDirectoryW\" with parameter %APPDATA%\\SubDir (UID: 00000000-00005692)\n \"workbook.exe\" called \"CreateDirectoryW\" with parameter C:\\Users\\%OSUSER% (UID: 00000000-00004424)\n \"workbook.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData\\Roaming (UID: 00000000-00004424)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe\" called \"CreateProcessW\" with parameter \"\"schtasks\" /create /tn \"workbook\" /sc ONLOGON /tr \"%APPDATA%\\SubDir\\workbook.exe\" /rl HIGHEST /f\" - (UID: 00000000-00005692)\n \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe\" called \"CreateProcessW\" with parameter \"\"%APPDATA%\\SubDir\\workbook.exe\"\" - (UID: 00000000-00005692)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$33","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$34","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"141.11.243.94:9792\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"General","name":"Contains ability to download files with network (Dotnet)","description":"Observed Namespace \"System.Net.WebClient\" and MemberReference \"add_DownloadFileCompleted\" in \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadFileAsync\" in \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"remove_DownloadFileCompleted\" in \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"add_DownloadFileCompleted\" in \"workbook.exe\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadFileAsync\" in \"workbook.exe\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"remove_DownloadFileCompleted\" in \"workbook.exe\"","origin":"Static Parser","mitre_attack_id":"T1105","relevance":1,"id":"static-99","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"Found reference to API (Indicator: \"CreateDC\"; File: \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\")\n Found reference to API (Indicator: \"DeleteDC\"; File: \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\")\n Found reference to API (Indicator: \"CryptHashData\"; File: \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\")\n Found reference to API (Indicator: \"GetCurrentThreadId\"; File: \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\")\n Found reference to API (Indicator: \"GetWindowThreadProcessId\"; File: \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\")\n Found reference to API (Indicator: \"GetProcessById\"; File: \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\")\n Found reference to API (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00004424.00000001.85542.00330000.00000004.mdmp, 00000000-00004424.00000002.87464.00330000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"General","name":"Contains ability to set file attributes (Dotnet)","description":"Observed Namespace \"System.IO.File\" and MemberReference \"SetAttributes\" in \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\"\n Observed Namespace \"System.IO.FileSystemInfo\" and MemberReference \"get_Attributes\" in \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\"\n Observed Namespace \"System.IO.FileSystemInfo\" and MemberReference \"set_Attributes\" in \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\"\n Observed Namespace \"System.IO.File\" and MemberReference \"SetAttributes\" in \"workbook.exe\"\n Observed Namespace \"System.IO.FileSystemInfo\" and MemberReference \"get_Attributes\" in \"workbook.exe\"\n Observed Namespace \"System.IO.FileSystemInfo\" and MemberReference \"set_Attributes\" in \"workbook.exe\"","origin":"Static Parser","mitre_attack_id":"T1222","relevance":1,"id":"static-155","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; File: \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"General","name":"Contains ability to start a process (Dotnet)","description":"Observed function \"Process.Start\" in \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\"\n Observed function \"Process.set_StartInfo\" in \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\"\n Observed function \"Process.Start\" in \"workbook.exe\"\n Observed function \"Process.set_StartInfo\" in \"workbook.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-111","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex\"\n Process c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\0235e291-5d04-4fa3-932c-869aeec51499\"\n Process workbook.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\0235e291-5d04-4fa3-932c-869aeec51499\"","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"General","name":"Dotnet code contains ability to modify/delete registry","description":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"SetValue\" in \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"DeleteValue\" in \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"CreateSubKey\" in \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"DeleteSubKeyTree\" in \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"SetValue\" in \"workbook.exe\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"DeleteValue\" in \"workbook.exe\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"CreateSubKey\" in \"workbook.exe\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"DeleteSubKeyTree\" in \"workbook.exe\"","origin":"Static Parser","mitre_attack_id":"T1112","relevance":1,"id":"static-139","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$35","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"workbook.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"General","name":"Found Native API in Dotnet file","description":"$36","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-101","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"General","name":"Found User Agent related strings","description":"Found string \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.75.14 (KHTML, like Gecko) Version/7.0.3 Safari/7046A194A\" (Indicator: \"mozilla/5.0 (\"; File: \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\")\n Found string \"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0\" (Indicator: \"mozilla/5.0 (\"; File: \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$37","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"General","name":"Loads Windows LDAP client module","description":"\"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe\" loaded module \"%WINDIR%\\System32\\Wldap32.dll\" at 779D0000\n \"workbook.exe\" loaded module \"%WINDIR%\\System32\\Wldap32.dll\" at 779D0000","origin":"Loaded Module","mitre_attack_id":"T1069.002","relevance":3,"id":"module-17","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$38","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 63EE0000\n \"workbook.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 64690000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 75440000\n \"workbook.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 75440000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 64B40000\n \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 652F0000\n \"workbook.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 68F00000\n \"workbook.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 696B0000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 75FC0000\n \"schtasks.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 75FC0000\n \"workbook.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 75FC0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"1300140054f40b76@RPCRT4.dll\"\n \"1800190068e8e969@api-ms-win-core-synch-l1-2-0.dll\"\n \"1800190088e8e969@api-ms-win-core-synch-l1-2-0.dll\"\n \"0d000e00cc5fe969@ntdll.dll\"\n \"100011000e03006c@ADVAPI32.dll\"\n \"0d000e002203006c@ADVAPI32.dll\"\n \"0d000e00fe02006c@ADVAPI32.dll\"\n \"0b000c00cc02006c@ADVAPI32.dll\"\n \"10001100da02006c@ADVAPI32.dll\"\n \"150016002073fb69@ADVAPI32.dll\"\n \"0e000f00e473fb69@ADVAPI32.dll\"\n \"0e000f005074fb69@ADVAPI32.dll\"\n \"11001200d47dfb69@ADVAPI32.dll\"\n \"110012007c7efb69@ADVAPI32.dll\"\n \"12001300cc7efb69@ADVAPI32.dll\"\n \"12001300387ffb69@ADVAPI32.dll\"\n \"14001500e4b7fb69@ADVAPI32.dll\"\n \"1400150000b8fb69@ADVAPI32.dll\"\n \"140015001cb8fb69@ADVAPI32.dll\"\n \"1700180038b8fb69@ADVAPI32.dll\"\n \"0d000e0054b8fb69@ADVAPI32.dll\"\n \"1100120064b8fb69@ADVAPI32.dll\"\n \"110012007cb8fb69@ADVAPI32.dll\"\n \"0f001000ecb9fb69@ADVAPI32.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\" was detected as \".NET\" and name: \"Library\"\n \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"workbook.exe\" was detected as \".NET\" and name: \"Library\"\n \"workbook.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"\n \"workbook.exe\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","id":"static-144","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\" has an executable section named \".text\"\n \"workbook.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$39","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x31c600\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x31c404\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"schtasks.exe\" (UID: 00000000-00004132) was launched with new environment variables: \"USERDNSDOMAIN=\"%OSUSER%-PC\"\"\n Process \"schtasks.exe\" (UID: 00000000-00004132) was launched with modified environment variables: \"NUMBER_OF_PROCESSORS\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"twart.myfirewall.org\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"workbook.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"workbook.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"workbook.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"General","name":"References Windows LDAP client module","description":"Found string \":\\Windows\\system32\\WLDAP32.dll\" (Source: \"00000000-00004424.00000002.87464.00330000.00000004.mdmp\")\n Found string \":\\Windows\\system32\\WLDAP32.dll\" (Source: \"00000000-00005692.00000003.83301.003B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1069.002","relevance":1,"id":"string-987","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"schtasks.exe\" with commandline \"\"schtasks\" /create /tn \"workbook\" /sc ONLOGON /tr \"%APPDATA%\\\\Su ...\" (UID: 00000000-00004132), Spawned process \"workbook.exe\" (UID: 00000000-00004424)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"schtasks.exe\" with commandline \"\"schtasks\" /create /tn \"workbook\" /sc ONLOGON /tr \"%APPDATA%\\\\Su ...\" (UID: 00000000-00004132), Spawned process \"workbook.exe\" (UID: 00000000-00004424)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"workbook.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe\" connecting to \"\\ThemeApiPort\"\n \"schtasks.exe\" connecting to \"\\ThemeApiPort\"\n \"workbook.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","mitre_attack_id":"T1559","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"workbook.exe\" has type \"PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 3 sections\"- Location: [%APPDATA%\\SubDir\\workbook.exe]- [targetUID: 00000000-00005692]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$3b","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"workbook.exe\" queries basic process information of the \"C:\\Windows\\System32\\cryptsp.dll\" (UID: 4424)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$3c","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$3d","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Reference to an external IP address lookup service identified\n Matched sigs: Able to identify virtual environment by using API string","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$3e","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$3f","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$40","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe\" writes file \"c:\\users\\%osuser%\\appdata\\roaming\\subdir\\workbook.exe\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Network Related","name":"Able to download remote files (.NET)","description":"Observed dotnet function \"WebRequest.GetResponse\" in \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\"\n Observed dotnet function \"WebResponse.GetResponseStream\" in \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\"\n Observed dotnet function \"WebRequest.GetResponse\" in \"workbook.exe\"\n Observed dotnet function \"WebResponse.GetResponseStream\" in \"workbook.exe\"","origin":"Static Parser","mitre_attack_id":"T1105","relevance":7,"id":"static-201","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to register an interface (RPC)","description":"\"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00005692)","origin":"API Call","mitre_attack_id":"T1021","relevance":3,"id":"api-219","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate via sockets (Dotnet)","description":"$41","origin":"Static Parser","mitre_attack_id":"T1095","relevance":1,"id":"static-159","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (Dotnet)","description":"$42","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-158","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicates via socket (possible C&C communication)","description":"$43","origin":"Static Parser","mitre_attack_id":"T1071","relevance":1,"id":"static-151","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Network Related","name":"Contains ability to provide interface for network protocols (Dotnet)","description":"Observed namespace \"System.Net\" in \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\"\n Observed namespace \"System.Net.Sockets\" in \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\"\n Observed namespace \"System.Net.Security\" in \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\"\n Observed namespace \"System.Net.NetworkInformation\" in \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\"","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-110","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"AUTHUI.DLL: Shutdown Choices Message Window\" (Indicator: \" shutdown \"; Source: \"00000000-00000132.00000000.89148.014C0000.00000002.mdmp, 00000000-00000132.00000001.91074.014C0000.00000002.mdmp\")\n Found reference to API \"AUTHUI.DLL: Shutdown Choices Message Window\" (Indicator: \" shutdown \"; Source: \"00000000-00004424.00000000.83616.014C0000.00000002.mdmp, 00000000-00004424.00000001.85542.014C0000.00000002.mdmp, 00000000-00004424.00000002.87464.014C0000.00000002.mdmp\")\n Found reference to API \"AUTHUI.DLL: Shutdown Choices Message Window\" (Indicator: \" shutdown \"; Source: \"00000000-00005692.00000000.79120.01620000.00000002.mdmp, 00000000-00005692.00000001.81041.01620000.00000002.mdmp, 00000000-00005692.00000002.82967.01620000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"Found URL \"http://go.microsoft.com/fwlink/?linkid=42127\" - Source: \"00000000-00004424.00000000.83616.00330000.00000004.mdmp\")\n Found URL \"http://user.configfile:.configfile://datadirectoryfile:http:\\\\?\\globalroot\" - Source: \"00000000-00004424.00000000.83616.020C0000.00000004.mdmp\")\n Found URL \"http://go.microsoft.com/fwlink/?linkid=42127\" - Source: \"00000000-00004424.00000000.83616.020C0000.00000004.mdmp\")\n Found URL \"http://www.w3.org/2000/09/xmldsig\" - Source: \"00000000-00004424.00000000.83616.020C0000.00000004.mdmp\")\n Found URL \"http://go.microsoft.com/fwlink/?linkid=42127\" - Source: \"00000000-00005692.00000000.79120.003B0000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"twart.myfirewall.org\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLE6AA4D1B182E4403C9F6C5AA72EC5]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00005692.00000003.83301.003B0000.00000004.mdmp\")\n Found string \"ncacn_np\" (Indicator: \"ncacn_np\"; Source: \"00000000-00005692.00000003.83301.003B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to SFTP or FTPS file transfer","description":"Found string \"b__4_0\" (Indicator: \"winscp\"; File: \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\")\n Found string \"WinSCP\" (Indicator: \"winscp\"; File: \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\")\n Found string \"SOFTWARE\\\\Martin Prikryl\\\\WinSCP 2\\\\Sessions\" (Indicator: \"winscp\"; File: \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\")\n Found string \"SOFTWARE\\\\\\\\Martin Prikryl\\\\\\\\WinSCP 2\\\\\\\\Sessions\" (Indicator: \"winscp\"; File: \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\")","origin":"File/Memory","mitre_attack_id":"T1048.002","relevance":1,"id":"string-724","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00005692.00000003.83301.003B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"CreateDC\" (Indicator: \"CreateDC\"; File: \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"95754896,2168,3024,,RtlGetVersion,NTDLL.dll,\"252:16:16.067\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00004424.00000002.87464.00330000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to perform SQL operations","description":"$44","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$45","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"schtasks.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"workbook.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen information (Dotnet)","description":"Observed Namespace \"System.Windows.Forms::Screen\" and MemberReference \"get_AllScreens\" in \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\"\n Observed Namespace \"System.Windows.Forms::Screen\" and MemberReference \"get_AllScreens\" in \"workbook.exe\"","origin":"Static Parser","mitre_attack_id":"T1113","relevance":1,"id":"static-164","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetProcessById\" (Indicator: \"GetProcessById\"; File: \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to gather process details (Dotnet)","description":"Observed function \"GetProcessesByName\" in \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\"\n Observed function \"get_ProcessName\" in \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\"\n Observed function \"GetProcessById\" in \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\"\n Observed function \"GetProcessesByName\" in \"workbook.exe\"\n Observed function \"get_ProcessName\" in \"workbook.exe\"\n Observed function \"GetProcessById\" in \"workbook.exe\"","origin":"Static Parser","mitre_attack_id":"T1057","relevance":1,"id":"static-100","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve user privileges","description":"System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole) at 3e8b57c2be9df63483a368b71ccb938b-600003d-ctor","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1033","relevance":5,"id":"stream-136","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found strings related to keylogger","description":"Found string \"

[Esc]

\" (Indicator: \"[esc]\"; File: \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-556","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References Chromium browser credentials files","description":"Found string \"BraveSoftware\\Brave-Browser\\User Data\\Default\\Login Data\" (Indicator: \"bravesoftware\\brave-browser\\user data\\default\\login data\"; File: \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\")\n Found string \"Google\\Chrome\\User Data\\Default\\Login Data\" (Indicator: \"google\\chrome\\user data\\default\\login data\"; File: \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\")\n Found string \"Microsoft\\Edge\\User Data\\Default\\Login Data\" (Indicator: \"edge\\user data\\default\\login data\"; File: \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\")\n Found string \"Opera Software\\Opera GX Stable\\Login Data\" (Indicator: \"opera software\\opera gx stable\\login data\"; File: \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\")\n Found string \"Opera Software\\Opera Stable\\Login Data\" (Indicator: \"opera software\\opera stable\\login data\"; File: \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\")","origin":"File/Memory","mitre_attack_id":"T1555.003","relevance":3,"id":"string-1000","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References Firefox browser credentials files","description":"Found string \"logins.json\" (Indicator: \"logins.json\"; in File: \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\")","origin":"File/Memory","mitre_attack_id":"T1555.003","relevance":1,"id":"string-405","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00005692)\n \"workbook.exe\" called an API \"AdjustTokenPrivileges\"on file: C:\\Windows\\System32\\cryptsp.dll\" (UID: 00000000-00004424)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\HarddiskVolume2\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll\" (Indicator: \"\\Device\\\"; Source: \"00000000-00000132.00000000.89148.00270000.00000004.mdmp, 00000000-00000132.00000001.91074.00270000.00000004.mdmp\")\n Found string \"\\Device\\HarddiskVolume2\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll\" (Indicator: \"\\Device\\\"; Source: \"00000000-00004424.00000000.83616.00330000.00000004.mdmp, 00000000-00004424.00000001.85542.00330000.00000004.mdmp, 00000000-00004424.00000002.87464.00330000.00000004.mdmp\")\n Found string \"\\Device\\HarddiskVolume2\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll\" (Indicator: \"\\Device\\\"; Source: \"00000000-00005692.00000000.79120.003B0000.00000004.mdmp, 00000000-00005692.00000001.81041.003B0000.00000004.mdmp, 00000000-00005692.00000002.82967.003B0000.00000004.mdmp, 00000000-00005692.00000003.83301.003B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files","description":"Observed string: \"\"del /a /q /f \"\" (Indicator: \"\"del \") in Source: c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-408","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"SeDebugPrivilegeile>\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00000132.00000001.91074.00270000.00000004.mdmp\")\n Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00004424.00000001.85542.00330000.00000004.mdmp, 00000000-00004424.00000002.87464.00330000.00000004.mdmp\")\n Found reference to API \"SeDebugPrivilege \" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00005692.00000001.81041.003B0000.00000004.mdmp, 00000000-00005692.00000002.82967.003B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe\" opened \"\\Device\\KsecDD\"\n \"schtasks.exe\" opened \"\\Device\\KsecDD\"\n \"workbook.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"\"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\CRYPT32\"; Key: \"DEBUGHEAPFLAGS\"; Value: \"\")\n \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\LDAP\"; Key: \"LDAPCLIENTINTEGRITY\"; Value: \"\")\n \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\LDAP\"; Key: \"USEOLDHOSTRESOLUTIONORDER\"; Value: \"\")\n \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\LDAP\"; Key: \"USEHOSTNAMEASALIAS\"; Value: \"\")\n \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\LDAP\"; Key: \"IPV4LOOPBACKALTERNATIVE\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"\"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\LOCAL SETTINGS\\MUICACHE\\137\\52C64B7E\"; Key: \"LANGUAGELIST\"; Value: \"en-US\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"workbook.exe\" - Location: [%APPDATA%\\SubDir\\workbook.exe]- [targetUID: 00000000-00005692]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"DeleteDC\" (Source: c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99, API is part of module: GDI32.DLL)\n Found string \"CryptHashData\" (Source: c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99, API is part of module: CRYPTSP.DLL)\n Found string \"GetCurrentThreadId\" (Source: c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99, API is part of module: KERNELBASE.DLL)\n Found string \"GetWindowThreadProcessId\" (Source: c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99, API is part of module: USER32.DLL)\n Found string \"shutdown\" (Source: c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99, API is part of module: WS2_32.DLL)\n Found string \"Escape\" (Source: 60001f9-_~_, API is part of module: GDI32.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\" was detected as \"Microsoft Visual C# v7.0 / Basic .NET\"\n \"workbook.exe\" was detected as \"Microsoft Visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"workbook.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Uses a .NET obfuscator to hide its code","description":"\"ompress and email...\" is a hint for the obfuscator \"MPRESS\"\n \"ompress to \"workbook.7z\" and email\" is a hint for the obfuscator \"MPRESS\"\n \"ompress to \"workbook.zip\" and email\" is a hint for the obfuscator \"MPRESS\"","origin":"File/Memory","mitre_attack_id":"T1027.002","relevance":2,"id":"string-6","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"suspicious","category":"Environment Awareness","name":"Able to retrieve open application windows","description":"Observed API \"GetForegroundWindow\" in \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\"\n Observed API \"GetWindowText\" in \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99\"\n Observed API \"GetForegroundWindow\" in \"workbook.exe\"\n Observed API \"GetWindowText\" in \"workbook.exe\"","origin":"Static Parser","mitre_attack_id":"T1010","relevance":1,"id":"static-222","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"19/24 Antivirus vendors marked sample as malicious (79% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"workbook.exe\" has type \"PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 3 sections\"- Location: [%APPDATA%\\SubDir\\workbook.exe]- [targetUID: 00000000-00005692]","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to listen for incoming connections","description":"$46","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1040","relevance":5,"id":"stream-33","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection","description":"$47","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1571","relevance":5,"id":"stream-85","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"suspicious","category":"Network Related","name":"Reference to an external IP address lookup service identified","description":"\"https://api.ipify.org/\" (Indicator: \"api.ipify.org\"; File: \"6000217-_~_\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-56","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"suspicious","category":"Network Related","name":"Spawned process connects to a network","description":"Process \"%APPDATA%\\SubDir\\workbook.exe\" connects to 141.11.243.94 on port 9792 (TCP); Domain: \"twart.myfirewall.org\"","origin":"Monitored Target","mitre_attack_id":"T1071","relevance":5,"id":"target-412","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"suspicious","category":"Pattern Matching","name":"Yara Signature Match - Indicators","description":"$48","origin":"YARA Signature","relevance":9,"id":"yara-553","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe\" opened \"C:\\c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe:Zone.Identifier\" with delete access\n \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\SubDir\\workbook.exe:Zone.Identifier\" with delete access\n \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe\" opened \"C:\\c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe:ZONE.IDENTIFIER\" with delete access\n \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\SubDir\\workbook.exe:ZONE.IDENTIFIER\" with delete access\n \"workbook.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\SubDir\\workbook.exe:Zone.Identifier\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"suspicious","category":"System Security","name":"Adjusts debug privileges","description":"\"workbook.exe\" adjusted SE_DEBUG_PRIVILEGE on file \"C:\\Windows\\System32\\cryptsp.dll\"","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-28","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Spawned processes are likely due to an injection","description":"Process \"%APPDATA%\\SubDir\\workbook.exe\" spawned likely due to injection","origin":"Monitored Target","mitre_attack_id":"T1055","relevance":3,"id":"target-413","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Tries to hide tracks of having downloaded a file from the internet","description":"\"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe\" opened \"C:\\c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe:Zone.Identifier\" with delete access\n \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\SubDir\\workbook.exe:Zone.Identifier\" with delete access\n \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe\" opened \"C:\\c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe:ZONE.IDENTIFIER\" with delete access\n \"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\SubDir\\workbook.exe:ZONE.IDENTIFIER\" with delete access\n \"workbook.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\SubDir\\workbook.exe:Zone.Identifier\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-42","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"19/24 Antivirus vendors marked sample as malicious (79% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"19/24 Antivirus vendors marked dropped file \"workbook.exe\" as malicious (classified as \"MSIL_Troj.BTX.gen\" with 79% detection rate)","origin":"Binary File","mitre_attack_id":"T1204.002","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"19/24 Antivirus vendors marked spawned process \"workbook.exe\" (PID: 4424) as malicious (classified as \"MSIL_Troj.BTX.gen\" with 79% detection rate)","origin":"Monitored Target","mitre_attack_id":"T1204.002","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"malicious","category":"Installation/Persistence","name":"Schedules a task to be executed at a specific time and date","description":"Process \"schtasks.exe\" with commandline \"\"schtasks\" /create /tn \"workbook\" /sc ONLOGON /tr \"%APPDATA%\\\\SubDir\\\\workbook.exe\" /rl HIGHEST /f\" (UID: 00000000-00004132)","origin":"Monitored Target","mitre_attack_id":"T1053.005","relevance":8,"id":"target-13","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 141.11.243.94 on port 9792","origin":"Network Traffic","mitre_attack_id":"T1571","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"YARA signature \"MALWARE_Win_QuasarStealer\" matched file \"sample.bin\" as \"Detects Quasar infostealer\"\n YARA signature \"MALWARE_Win_QuasarStealer\" matched file \"workbook.exe.1976228177\" as \"Detects Quasar infostealer\"","origin":"YARA Signature","relevance":9,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Contains ability to listen for incoming connections"}],"sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"name":"Spyware","details_count":2,"details":[{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Found browser information locations related strings"}],"sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"name":"Stealer/Phishing","details_count":1,"details":[{"detail":"Identified FTP credentials location strings"}],"sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Schedules a task to be executed at a specific time and date"}],"sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries kernel debugger information"}],"sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Tries to hide tracks of having downloaded a file from the internet"},{"detail":"Found a reference to a WMI query string known to be used for VM detection"}],"sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]}],"intel_graph":{"map":{"Domain:twart.myfirewall.org":{"type":"Domain","value":"twart.myfirewall.org"},"File:c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99":{"type":"File","value":"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["File reported as malware by ClamAV antivirus","confirmed malicious file","confirmed relationship with a Threat Quasar"]}},"Ip:141.11.243.94":{"type":"Ip","value":"141.11.243.94"},"Threat:d9bb688ffeddaa656e6f3b7c4f321c10c080132c43ab3b98d8ff58409fe90d9c":{"type":"Threat","value":"Quasar","verdict":{"verdict":"malicious","verdict_source":"indicator database"}}},"chains":[{"id":"1546977103879415737","root":"File:c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99","edges":[],"verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["File reported as malware by ClamAV antivirus","confirmed malicious file","confirmed relationship with a Threat Quasar"]}},{"id":"1546977099900006416","root":"File:c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99","edges":[{"edge_kind":"is_threat","from_key":"File:c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99","to_key":"Threat:d9bb688ffeddaa656e6f3b7c4f321c10c080132c43ab3b98d8ff58409fe90d9c"}],"verdict":{"verdict":"malicious","verdict_source":"indicator database"}},{"id":"sandbox_network","root":"File:c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99","edges":[{"edge_kind":"contacted_ip","from_key":"File:c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99","to_key":"Ip:141.11.243.94"},{"edge_kind":"contacted_domain","from_key":"File:c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99","to_key":"Domain:twart.myfirewall.org"},{"edge_kind":"resolves_to","from_key":"Domain:twart.myfirewall.org","to_key":"Ip:141.11.243.94"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99","edges":[{"edge_kind":"extracted","from_key":"File:c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99","to_key":"File:c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":2,"imported_dlls_count":96,"dropped_files_count":0,"extracted_files_count":1,"files_written_count":3,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["commodity","strrat","modular","rat","guloader","informationstealer","proxy","loda","keylogger","quasar","opensource","targeted","xworm","criminal","asyncrat","ransomware","downloader","warzone","evasive"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"6aa06caec7017ec29b09c501","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"MSIL_Troj.BTX.gen","contacted_countries":["USA"],"submit_name":"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99","analysis_start_time":"2026-09-08T20:14:40+00:00","indicators_count":{"informative":160,"suspicious":33,"malicious":9},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"141.11.243.94","port":9792,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]}],"dns_resolutions":[{"domain":"twart.myfirewall.org","address":"141.11.243.94","ttl":60,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}],"processes":[{"pid":5692,"ppid":0,"name":"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe","command_line":"","sha256":"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99","normalized_path":"C:\\c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99.exe","uid":"00000000-00005692","icon":"$49"},{"pid":4132,"ppid":5692,"name":"schtasks.exe","command_line":"\"schtasks\" /create /tn \"workbook\" /sc ONLOGON /tr \"%APPDATA%\\SubDir\\workbook.exe\" /rl HIGHEST /f","sha256":"15018d0093befabba8b927743191030d1f8c17bb97fdb48c2fc3eab20e2d4b3d","normalized_path":"%WINDIR%\\system32\\schtasks.exe","parent_uid":"00000000-00005692","uid":"00000000-00004132"},{"pid":4424,"ppid":5692,"name":"workbook.exe","command_line":"","sha256":"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99","normalized_path":"%APPDATA%\\SubDir\\workbook.exe","parent_uid":"00000000-00005692","uid":"00000000-00004424"}],"all_imported_dlls":["mscoree.dll","api-ms-win-crt-environment-l1-1-0.dll","api-ms-win-crt-utility-l1-1-0.dll","ucrtbase_clr0400.dll","dsrole.dll","taskschd.dll","kernel32.dll","mswsock.dll","nsi.dll","lpk.dll","api-ms-win-core-file-l1-2-0.dll","imm32.dll","uxtheme.dll","shell32.dll","Wldap32.dll","sechost.dll","VxSSL32.dll","api-ms-win-core-processthreads-l1-1-1.dll","api-ms-win-crt-stdio-l1-1-0.dll","api-ms-win-crt-locale-l1-1-0.dll","comctl32.dll","msasn1.dll","fltLib.dll","usp10.dll","ucrtbase.dll","System.Core.ni.dll","crypt32.dll","clbcatq.dll","wship6.dll","winnsi.dll","vcruntime140.dll","api-ms-win-core-localization-l1-2-0.dll","clr.dll","vcruntime140_clr0400.dll","mscorlib.ni.dll","SensApi.dll","apphelp.dll","FWPUCLNT.DLL","KernelBase.dll","ole32.dll","clrjit.dll","atl.dll","sspicli.dll","IPHLPAPI.DLL","nlssorting.dll","ntdll.dll","api-ms-win-crt-runtime-l1-1-0.dll","shlwapi.dll","System.Xml.ni.dll","profapi.dll","rsaenh.dll","System.Windows.Forms.dll","System.Drawing.ni.dll","api-ms-win-crt-string-l1-1-0.dll","mscoreei.dll","version.dll","cryptbase.dll","dwmapi.dll","System.Runtime.Serialization.ni.dll","api-ms-win-core-file-l2-1-0.dll","ktmw32.dll","xmllite.dll","advapi32.dll","msvcp140.dll","rpcss.dll","certcli.dll","System.ni.dll","System.Windows.Forms.ni.dll","System.Configuration.ni.dll","cryptsp.dll","cryptnet.dll","System.Data.SqlXml.ni.dll","user32.dll","api-ms-win-core-timezone-l1-1-0.dll","api-ms-win-crt-math-l1-1-0.dll","api-ms-win-core-xstate-l2-1-0.dll","gdi32.dll","api-ms-win-core-synch-l1-2-0.dll","RpcRtRemote.dll","System.Security.ni.dll","rasadhlp.dll","rpcrt4.dll","api-ms-win-crt-heap-l1-1-0.dll","api-ms-win-crt-filesystem-l1-1-0.dll","oleaut32.dll","bcrypt.dll","psapi.dll","Accessibility.ni.dll","dnsapi.dll","msvcrt.dll","ws2_32.dll","api-ms-win-crt-convert-l1-1-0.dll","api-ms-win-crt-time-l1-1-0.dll","msctf.dll","System.ServiceModel.dll","WSHTCPIP.DLL"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"workbook.exe","sha256":"c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]}],"files_written":[{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"path":"%APPDATA%\\SubDir\\workbook.exe","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\\AUTOENROLLMENT\\","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\0235e291-5d04-4fa3-932c-869aeec51499","sources":[{"report_type":"sandbox","report_id":"6aa06caec7017ec29b09c501"}]}]}},"report_ids":{"sandbox_job_ids":["6aa06caec7017ec29b09c501"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Agent Sample c5cb97fbe424… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample c5cb97fbe424…. Malware family: Trojan.Agent. Threat score 100/100. 20/25 AV engines flagged this file. 10 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Agent Sample c5cb97fbe424… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample c5cb97fbe424…. Malware family: Trojan.Agent. Threat score 100/100. 20/25 AV engines flagged this file. 10 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/c5cb97fbe4243df1a99a9c82f44ad555f283fad9f4b15b791faebe5048c8fc99"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Agent Sample c5cb97fbe424… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample c5cb97fbe424…. Malware family: Trojan.Agent. Threat score 100/100. 20/25 AV engines flagged this file. 10 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L4a","11",{}]]