34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 84:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 33:T4b7,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Yogi.Generic Sample c5e82fca91a7… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample c5e82fca91a7…. Malware family: Yogi.Generic. Threat score 100/100. 13/28 AV engines flagged this file. 9 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0","keywords":["Malicious","Yogi.Generic","malware analysis","sandbox report","threat intelligence","c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0"],"about":{"@type":"SoftwareApplication","name":"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll","applicationCategory":["pedll","executable"],"identifier":"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Yogi.Generic","antivirusDetections":{"malicious":13,"total":28},"behavioralIndicators":{"malicious":9,"suspicious":22},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T7ec,Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp")37:T12de,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00001332.00000000.214146.00610000.00000004.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00001332.00000000.214146.00610000.00000004.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00001332.00000000.214146.00610000.00000004.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001332.00000000.214146.00610000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001332.00000000.214146.00610000.00000004.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00001332.00000000.214146.00610000.00000004.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00002568.00000000.214499.00920000.00000004.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00002568.00000000.214499.00920000.00000004.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00002568.00000000.214499.00920000.00000004.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002568.00000000.214499.00920000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002568.00000000.214499.00920000.00000004.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00002568.00000000.214499.00920000.00000004.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00004828.00000000.213750.02E20000.00000004.mdmp, 00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00004828.00000000.213750.02E20000.00000004.mdmp, 00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00004828.00000000.213750.02E20000.00000004.mdmp, 00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004828.00000000.213750.02E20000.00000004.mdmp, 00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004828.00000000.213750.02E20000.00000004.mdmp, 00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00004828.00000000.213750.02E20000.00000004.mdmp")38:T496,Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "NtOpenProcessToken" (Indicator: "OpenProcessToken"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "NtOpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00001332.00000000.214146.00610000.00000004.mdmp") Found reference to API "NtOpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00002568.00000000.214499.00920000.00000004.mdmp") Found reference to API "NtOpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00004828.00000000.213750.02E20000.00000004.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "NtOpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00004972.00000001.214568.00B49000.00000002.mdmp") Found reference to API "NtOpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00006368.00000000.213748.02FD0000.00000004.mdmp")39:Tb68,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00001332.00000000.214146.00610000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001332.00000000.214146.00610000.00000004.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00002568.00000000.214499.00920000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002568.00000000.214499.00920000.00000004.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004828.00000000.213750.02E20000.00000004.mdmp, 00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004828.00000000.213750.02E20000.00000004.mdmp, 00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004972.00000001.214568.00B49000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004972.00000001.214568.00B49000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00006368.00000000.213748.02FD0000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00006368.00000000.213748.02FD0000.00000004.mdmp")3a:T9f4,"rundll32.exe" queried SystemProcessInformation at 00000000-00006368-00000C15-2337784602 [PID: 6368] "rundll32.exe" queried SystemProcessInformation at 00000000-00006368-00000C15-2337792638 [PID: 6368] "rundll32.exe" queried SystemProcessInformation at 00000000-00006368-00000C15-2338235049 [PID: 6368] "rundll32.exe" queried SystemProcessInformation at 00000000-00006368-00000C15-2338243153 [PID: 6368] "rundll32.exe" queried SystemProcessInformation at 00000000-00006368-00000C15-2338561420 [PID: 6368] "rundll32.exe" queried SystemProcessInformation at 00000000-00006368-00000C15-2338569161 [PID: 6368] "rundll32.exe" queried SystemProcessInformation at 00000000-00008384-00000C15-2337698865 [PID: 8384] "rundll32.exe" queried SystemProcessInformation at 00000000-00008384-00000C15-2337708447 [PID: 8384] "rundll32.exe" queried SystemProcessInformation at 00000000-00008384-00000C15-2338134934 [PID: 8384] "rundll32.exe" queried SystemProcessInformation at 00000000-00008384-00000C15-2338143207 [PID: 8384] "rundll32.exe" queried SystemProcessInformation at 00000000-00008384-00000C15-2338513909 [PID: 8384] "rundll32.exe" queried SystemProcessInformation at 00000000-00008384-00000C15-2338579158 [PID: 8384] "rundll32.exe" queried SystemProcessInformation at 00000000-00008384-00000C15-2348569724 [PID: 8384] "rundll32.exe" queried SystemProcessInformation at 00000000-00008384-00000C15-2348577716 [PID: 8384] "rundll32.exe" queried SystemProcessInformation at 00000000-00008384-00000C15-2348611713 [PID: 8384] "rundll32.exe" queried SystemProcessInformation at 00000000-00008384-00000C15-2348619170 [PID: 8384] "rundll32.exe" queried SystemProcessInformation at 00000000-00008384-00000C15-2348710489 [PID: 8384] "rundll32.exe" queried SystemProcessInformation at 00000000-00008384-00000C15-2348791630 [PID: 8384] "rundll32.exe" queried SystemProcessInformation at 00000000-00008384-00000C15-2348867799 [PID: 8384] "rundll32.exe" queried SystemProcessInformation at 00000000-00008384-00000C15-2348876034 [PID: 8384] "rundll32.exe" queried SystemProcessInformation at 00000000-00008384-00000C15-2348978738 [PID: 8384] "rundll32.exe" queried SystemProcessInformation at 00000000-00008384-00000C15-2348987251 [PID: 8384] "rundll32.exe" queried SystemProcessInformation at 00000000-00008384-00000C15-2349054804 [PID: 8384] "rundll32.exe" queried SystemProcessInformation at 00000000-00008384-00000C15-2349116616 [PID: 8384] "rundll32.exe" queried SystemProcessInformation at 00000000-00008384-00000C15-2349189473 [PID: 8384]3b:T3c0c,Assembly shows XOR instruction xor eax ebp in Stream UID: 16558-111-101980F5 Assembly shows XOR instruction xor ecx ebp in Stream UID: 16558-111-101980F5 Assembly shows XOR instruction xor eax ebp in Stream UID: 16558-140-1019D7BE Assembly shows XOR instruction xor ecx ebp in Stream UID: 16558-140-1019D7BE Assembly shows XOR instruction xor eax ebp in Stream UID: 16558-284-10010843 Assembly shows XOR instruction xor dword ptr [ebp-18h] DEADBEEFh in Stream UID: 16558-284-10010843 Assembly shows XOR instruction xor ecx ebp in Stream UID: 16558-284-10010843 Assembly shows XOR instruction xor ecx EDB88320h in Stream UID: 16558-284-10010843 Assembly shows XOR instruction xor al cl in Stream UID: 16558-284-10010843 Assembly shows XOR instruction xor ecx ebx in Stream UID: 16558-1123-10011096 Assembly shows XOR instruction xor ecx 9E31FE32h in Stream UID: 16558-1123-10011096 Assembly shows XOR instruction xor ebx ecx in Stream UID: 16558-1123-10011096 Assembly shows XOR instruction xor cl bl in Stream UID: 16558-1123-10011096 Assembly shows XOR instruction xor cl 91h in Stream UID: 16558-1123-10011096 Assembly shows XOR instruction xor bl cl in Stream UID: 16558-1123-10011096 Assembly shows XOR instruction xor ebx eax in Stream UID: 16558-1123-10011096 Assembly shows XOR instruction xor edx BE129D05h in Stream UID: 16558-1123-10011096 Assembly shows XOR instruction xor cl 94h in Stream UID: 16558-1123-10011096 Assembly shows XOR instruction xor ebx edx in Stream UID: 16558-1123-10011096 Assembly shows XOR instruction xor eax ecx in Stream UID: 16558-1123-10011096 Assembly shows XOR instruction xor eax 4F20C415h in Stream UID: 16558-1123-10011096 Assembly shows XOR instruction xor ecx 8C165C1Ch in Stream UID: 16558-1123-10011096 Assembly shows XOR instruction xor dl bl in Stream UID: 16558-1123-10011096 Assembly shows XOR instruction xor dl 2Bh in Stream UID: 16558-1123-10011096 Assembly shows XOR instruction xor bl dl in Stream UID: 16558-1123-10011096 Assembly shows XOR instruction xor cx word ptr [esp+01h] in Stream UID: 16558-1123-10011096 Assembly shows XOR instruction xor al 80h in Stream UID: 16558-1123-10011096 Assembly shows XOR instruction xor bl al in Stream UID: 16558-1123-10011096 Assembly shows XOR instruction xor al 0Ch in Stream UID: 16558-1123-10011096 Assembly shows XOR instruction xor edx DA01DB9Dh in Stream UID: 16558-1123-10011096 Assembly shows XOR instruction xor al bl in Stream UID: 16558-1123-10011096 Assembly shows XOR instruction xor al 03h in Stream UID: 16558-1123-10011096 Assembly shows XOR instruction xor al dl in Stream UID: 16558-1123-10011096 Assembly shows XOR instruction xor edx ebx in Stream UID: 16558-1123-10011096 Assembly shows XOR instruction xor edx 28128804h in Stream UID: 16558-1123-10011096 Assembly shows XOR instruction xor eax 2E8378BEh in Stream UID: 16558-1123-10011096 Assembly shows XOR instruction xor edx C6A67921h in Stream UID: 16558-1123-10011096 Assembly shows XOR instruction xor eax DD24EC11h in Stream UID: 16558-1123-10011096 Assembly shows XOR instruction xor edx ecx in Stream UID: 16558-1123-10011096 Assembly shows XOR instruction xor cx bx in Stream UID: 16558-1123-10011096 Assembly shows XOR instruction xor cx DF33h in Stream UID: 16558-1123-10011096 Assembly shows XOR instruction xor cl 1Dh in Stream UID: 16558-1123-10011096 Assembly shows XOR instruction xor eax 383B3817h in Stream UID: 16558-1123-10011096 Assembly shows XOR instruction xor dword ptr [esp+edx*2-7Ah] edx in Stream UID: 16558-1123-10011096 Assembly shows XOR instruction xor edx 50329F31h in Stream UID: 16558-1123-10011096 Assembly shows XOR instruction xor edx 6D306C05h in Stream UID: 16558-1123-10011096 Assembly shows XOR instruction xor byte ptr [esp+eax-00000D19h] dl in Stream UID: 16558-1123-10011096 Assembly shows XOR instruction xor eax ebx in Stream UID: 16558-1123-10011096 Assembly shows XOR instruction xor edx A6336EACh in Stream UID: 16558-1123-10011096 Assembly shows XOR instruction xor eax D9939787h in Stream UID: 16558-1123-10011096 Assembly shows XOR instruction xor eax BE129D05h in Stream UID: 16558-1123-10011096 Assembly shows XOR instruction xor eax 309CCC13h in Stream UID: 16558-1123-10011096 Assembly shows XOR instruction xor edx CC2C4D27h in Stream UID: 16558-1123-10011096 Assembly shows XOR instruction xor ecx AFA50F3Fh in Stream UID: 16558-1123-10011096 Assembly shows XOR instruction xor cl byte ptr [ebp+ecx-300600FCh] in Stream UID: 16558-1123-10011096 Assembly shows XOR instruction xor ecx 1AB89011h in Stream UID: 16558-1123-10011096 Assembly shows XOR instruction xor edx 563F883Ch in Stream UID: 16558-1123-10011096 Assembly shows XOR instruction xor dl byte ptr [ecx+ebp-6C12A306h] in Stream UID: 16558-1123-10011096 Assembly shows XOR instruction xor edx 9E98D51Fh in Stream UID: 16558-1123-10011096 Assembly shows XOR instruction xor ecx ebp in Stream UID: 16558-1161-102BA550 Assembly shows XOR instruction xor ecx ebx in Stream UID: 16558-1161-102BA550 Assembly shows XOR instruction xor ebx edx in Stream UID: 16558-1161-102BA550 Assembly shows XOR instruction xor eax ebx in Stream UID: 16558-1161-102BA550 Assembly shows XOR instruction xor ebx eax in Stream UID: 16558-1161-102BA550 Assembly shows XOR instruction xor dl bl in Stream UID: 16558-1161-102BA550 Assembly shows XOR instruction xor bl dl in Stream UID: 16558-1161-102BA550 Assembly shows XOR instruction xor dl BFh in Stream UID: 16558-1161-102BA550 Assembly shows XOR instruction xor eax ebp in Stream UID: 16558-1166-1000E553 Assembly shows XOR instruction xor ecx ebp in Stream UID: 16558-1166-1000E553 Assembly shows XOR instruction xor eax ebp in Stream UID: 16558-1167-1000E8C5 Assembly shows XOR instruction xor ecx ebp in Stream UID: 16558-1167-1000E8C5 Assembly shows XOR instruction xor eax dword ptr [ecx+08h] in Stream UID: 16558-1257-10199A11 Assembly shows XOR instruction xor dword ptr [ecx+08h] eax in Stream UID: 16558-1257-10199A11 Assembly shows XOR instruction xor ecx dword ptr [eax] in Stream UID: 16558-1257-10199A11 Assembly shows XOR instruction xor dword ptr [eax] ecx in Stream UID: 16558-1257-10199A11 Assembly shows XOR instruction xor eax ebx in Stream UID: 16558-1403-1029818E Assembly shows XOR instruction xor eax AFA50F3Fh in Stream UID: 16558-1478-1033337F Assembly shows XOR instruction xor ebx eax in Stream UID: 16558-1478-1033337F Assembly shows XOR instruction xor bl cl in Stream UID: 16558-1478-1033337F Assembly shows XOR instruction xor eax ebx in Stream UID: 16558-1478-1033337F Assembly shows XOR instruction xor eax 1181648Ah in Stream UID: 16558-1478-1033337F Assembly shows XOR instruction xor edx ebx in Stream UID: 16558-1478-1033337F Assembly shows XOR instruction xor ebx ecx in Stream UID: 16558-1478-1033337F Assembly shows XOR instruction xor ecx ebx in Stream UID: 16558-1478-1033337F Assembly shows XOR instruction xor ecx 309CCC13h in Stream UID: 16558-1478-1033337F Assembly shows XOR instruction xor cl bl in Stream UID: 16558-1478-1033337F Assembly shows XOR instruction xor edx 13A5C8AEh in Stream UID: 16558-1478-1033337F Assembly shows XOR instruction xor ebx edx in Stream UID: 16558-1478-1033337F Assembly shows XOR instruction xor edx 15ABE4A1h in Stream UID: 16558-1478-1033337F Assembly shows XOR instruction xor al bl in Stream UID: 16558-1478-1033337F Assembly shows XOR instruction xor ecx 54AAEA83h in Stream UID: 16558-1478-1033337F Assembly shows XOR instruction xor bl dl in Stream UID: 16558-1478-1033337F Assembly shows XOR instruction xor word ptr [esp+ecx-68A60289h] BAB4h in Stream UID: 16558-1478-1033337F Assembly shows XOR instruction xor ecx 5C94C895h in Stream UID: 16558-1478-1033337F Assembly shows XOR instruction xor edx dword ptr [esp+eax-07FEC230h] in Stream UID: 16558-1478-1033337F Assembly shows XOR instruction xor ecx DA000DACh in Stream UID: 16558-1478-1033337F Assembly shows XOR instruction xor edx FDB55C1Ah in Stream UID: 16558-1478-1033337F Assembly shows XOR instruction xor al BBh in Stream UID: 16558-1478-1033337F Assembly shows XOR instruction xor al dh in Stream UID: 16558-1478-1033337F Assembly shows XOR instruction xor ecx 302849BEh in Stream UID: 16558-1478-1033337F Assembly shows XOR instruction xor eax 383B3817h in Stream UID: 16558-1478-1033337F Assembly shows XOR instruction xor ecx 0FBEA518h in Stream UID: 16558-1478-1033337F Assembly shows XOR instruction xor word ptr [esp+eax-70F0A0C4h] ax in Stream UID: 16558-1478-1033337F Assembly shows XOR instruction xor ecx eax in Stream UID: 16558-1478-1033337F Assembly shows XOR instruction xor dword ptr [esp+ecx-001C7FFCh] eax in Stream UID: 16558-1478-1033337F Assembly shows XOR instruction xor edx edi in Stream UID: 16558-1478-1033337F Assembly shows XOR instruction xor cx ax in Stream UID: 16558-1478-1033337F Assembly shows XOR instruction xor edx 3B320E96h in Stream UID: 16558-1478-1033337F Assembly shows XOR instruction xor al ah in Stream UID: 16558-1478-1033337F Assembly shows XOR instruction xor ecx 1285DA26h in Stream UID: 16558-1478-1033337F Assembly shows XOR instruction xor edx DE01BA04h in Stream UID: 16558-1478-1033337F Assembly shows XOR instruction xor edx 57B6E623h in Stream UID: 16558-1478-1033337F Assembly shows XOR instruction xor dl bl in Stream UID: 16558-1478-1033337F Assembly shows XOR instruction xor eax EBBC6116h in Stream UID: 16558-1478-1033337F Assembly shows XOR instruction xor byte ptr [esp+eax*4-1107C1E0h] cl in Stream UID: 16558-1478-1033337F Assembly shows XOR instruction xor cl 26h in Stream UID: 16558-1478-1033337F Assembly shows XOR instruction xor bx dx in Stream UID: 16558-1478-1033337F Assembly shows XOR instruction xor edx 6D306C05h in Stream UID: 16558-1478-1033337F Assembly shows XOR instruction xor cx bx in Stream UID: 16558-1478-1033337F Assembly shows XOR instruction xor byte ptr [esp+ecx-6E5841A6h] 02h in Stream UID: 16558-1478-1033337F Assembly shows XOR instruction xor edx 28128804h in Stream UID: 16558-1478-1033337F Assembly shows XOR instruction xor eax dword ptr [esp+ecx-6E5841A5h] in Stream UID: 16558-1478-1033337F Assembly shows XOR instruction xor ecx DBA49FB2h in Stream UID: 16558-1478-1033337F Assembly shows XOR instruction xor dx word ptr [esp+00h] in Stream UID: 16558-1478-1033337F Assembly shows XOR instruction xor al 07h in Stream UID: 16558-1478-1033337F Assembly shows XOR instruction xor dx bx in Stream UID: 16558-1478-1033337F Assembly shows XOR instruction xor dx DF33h in Stream UID: 16558-1478-1033337F Assembly shows XOR instruction xor cl al in Stream UID: 16558-1478-1033337F Assembly shows XOR instruction xor eax BE8E2AA0h in Stream UID: 16558-1478-1033337F Assembly shows XOR instruction xor bx cx in Stream UID: 16558-1478-1033337F Assembly shows XOR instruction xor eax 00262AB5h in Stream UID: 16558-1478-1033337F Assembly shows XOR instruction xor ecx edx in Stream UID: 16558-1478-1033337F Assembly shows XOR instruction xor eax 3B8B43B0h in Stream UID: 16558-1478-1033337F Assembly shows XOR instruction xor dword ptr [esp+ecx] ebp in Stream UID: 16558-1478-1033337F Assembly shows XOR instruction xor eax 351861ACh in Stream UID: 16558-1478-1033337F Assembly shows XOR instruction xor eax ebp in Stream UID: 16558-1478-1033337F Assembly shows XOR instruction xor al 26h in Stream UID: 16558-1478-1033337F Assembly shows XOR instruction xor bl al in Stream UID: 16558-1478-1033337F Assembly shows XOR instruction xor edx 72191696h in Stream UID: 16558-1478-1033337F Assembly shows XOR instruction xor ecx B40C8506h in Stream UID: 16558-1478-1033337F Assembly shows XOR instruction xor ecx ebx in Stream UID: 16558-1829-1026A15D Assembly shows XOR instruction xor dl ah in Stream UID: 16558-1829-1026A15D Assembly shows XOR instruction xor eax ebx in Stream UID: 16558-2372-102E9646 Assembly shows XOR instruction xor cx dx in Stream UID: 16558-2372-102E9646 Assembly shows XOR instruction xor eax 7909631Fh in Stream UID: 16558-2372-102E9646 Assembly shows XOR instruction xor ebx eax in Stream UID: 16558-2372-102E9646 Assembly shows XOR instruction xor cl bl in Stream UID: 16558-2372-102E9646 Assembly shows XOR instruction xor edx ebx in Stream UID: 16558-2415-102DA3CD Assembly shows XOR instruction xor ebx edx in Stream UID: 16558-2415-102DA3CD Assembly shows XOR instruction xor ecx 2D3955A8h in Stream UID: 16558-2415-102DA3CD Assembly shows XOR instruction xor ecx ebx in Stream UID: 16558-2415-102DA3CD Assembly shows XOR instruction xor ecx 18A31E27h in Stream UID: 16558-2415-102DA3CD Assembly shows XOR instruction xor ecx D2228037h in Stream UID: 16558-2415-102DA3CD Assembly shows XOR instruction xor ebx ecx in Stream UID: 16558-2415-102DA3CD Assembly shows XOR instruction xor cl 9Dh in Stream UID: 16558-2415-102DA3CD Assembly shows XOR instruction xor eax ebx in Stream UID: 16558-2415-102DA3CD Assembly shows XOR instruction xor eax E51F630Ch in Stream UID: 16558-2415-102DA3CD Assembly shows XOR instruction xor byte ptr [esp+edx-7B4178CEh] dl in Stream UID: 16558-2415-102DA3CD Assembly shows XOR instruction xor al bl in Stream UID: 16558-2654-1026E1FD Assembly shows XOR instruction xor bl al in Stream UID: 16558-2654-1026E1FD Assembly shows XOR instruction xor cl bl in Stream UID: 16558-2654-1026E1FD Assembly shows XOR instruction xor bl cl in Stream UID: 16558-2654-1026E1FD Assembly shows XOR instruction xor eax ebx in Stream UID: 16558-2654-1026E1FD Assembly shows XOR instruction xor ebx eax in Stream UID: 16558-2654-1026E1FD Assembly shows XOR instruction xor dword ptr [edx] esp in Stream UID: 16558-11959-101A6DB2 Assembly shows XOR instruction xor esp dword ptr [edx] in Stream UID: 16558-11959-101A6DB2 Assembly shows XOR instruction xor ah byte ptr [edx] in Stream UID: 16558-11959-101A6DB2 Assembly shows XOR instruction xor eax ebp in Stream UID: 16558-12047-1002062D Assembly shows XOR instruction xor eax ebp in Stream UID: 16558-12071-10023700 Assembly shows XOR instruction xor ecx ebp in Stream UID: 16558-12071-10023700 Assembly shows XOR instruction xor eax edx in Stream UID: 16558-12073-10023CB3 Assembly shows XOR instruction xor eax ebp in Stream UID: 16558-12077-100206D7 Assembly shows XOR instruction xor eax ebp in Stream UID: 16558-12092-100230DE Assembly shows XOR instruction xor ecx ebp in Stream UID: 16558-12092-100230DE Assembly shows XOR instruction xor eax ebp in Stream UID: 16558-12107-100D4408 Assembly shows XOR instruction xor ecx ebp in Stream UID: 16558-12107-100D4408 Assembly shows XOR instruction xor eax ebp in Stream UID: 16558-12127-100425F7 Assembly shows XOR instruction xor ecx ebp in Stream UID: 16558-12127-100425F7 Assembly shows XOR instruction xor eax ebp in Stream UID: 16558-12138-100410A2 Assembly shows XOR instruction xor ecx ebp in Stream UID: 16558-12138-100410A2 Assembly shows XOR instruction xor byte ptr [ebx] ch in Stream UID: 16558-12148-1017AA4E Assembly shows XOR instruction xor al 2Ch in Stream UID: 16558-12148-1017AA4E Assembly shows XOR instruction xor esi dword ptr [102316C0h] in Stream UID: 16558-12162-1017963C3c:T8b7,Found string ":\WINDOWS\System32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00000612.00000000.214135.00750000.00000004.mdmp, 00000000-00000612.00000001.214173.00750000.00000004.mdmp") Found string ":\WINDOWS\System32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00001332.00000000.214146.00610000.00000004.mdmp, 00000000-00001332.00000001.214176.00610000.00000004.mdmp") Found string ":\WINDOWS\System32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00002188.00000000.214900.03150000.00000004.mdmp, 00000000-00002188.00000001.215057.03150000.00000004.mdmp") Found string ":\WINDOWS\System32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00002568.00000000.214499.00920000.00000004.mdmp, 00000000-00002568.00000001.214581.00920000.00000004.mdmp") Found string ":\WINDOWS\System32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00002976.00000000.214138.008F0000.00000004.mdmp, 00000000-00002976.00000001.214173.008F0000.00000004.mdmp") Found string ":\WINDOWS\System32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00004828.00000000.213750.02E20000.00000004.mdmp, 00000000-00004828.00000001.213809.02E20000.00000004.mdmp") Found string ":\WINDOWS\System32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00004972.00000000.214502.02E10000.00000004.mdmp, 00000000-00004972.00000001.214568.02E10000.00000004.mdmp") Found string ":\WINDOWS\System32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00006368.00000000.213748.02FD0000.00000004.mdmp, 00000000-00006368.00000001.213820.02FD0000.00000004.mdmp") Found string ":\WINDOWS\System32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00006948.00000000.213748.03090000.00000004.mdmp, 00000000-00006948.00000001.213811.03090000.00000004.mdmp") Found string ":\WINDOWS\System32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00007940.00000000.214496.02D30000.00000004.mdmp, 00000000-00007940.00000001.214572.02D30000.00000004.mdmp") Found string ":\WINDOWS\System32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00008384.00000000.213747.02D40000.00000004.mdmp, 00000000-00008384.00000001.215355.02D40000.00000004.mdmp")3d:T6ff4,Found XOR loop in file "NVDisplay.Container.nvi.exe" at offset 61539; code bytes = 30d0 Found XOR loop in file "NVDisplay.Container.nvi.exe" at offset 24262; code bytes = 33c1 Found XOR loop in file "NVDisplay.Container.nvi.exe" at offset 61504; code bytes = 8030 Found XOR loop in file "NVDisplay.Container.nvi.exe" at offset 63414; code bytes = 8030 Found XOR loop in file "S-1-5-21-735145574-3570218355-1207367261.eXe" at offset 61539; code bytes = 30d0 Found XOR loop in file "S-1-5-21-735145574-3570218355-1207367261.eXe" at offset 24262; code bytes = 33c1 Found XOR loop in file "S-1-5-21-735145574-3570218355-1207367261.eXe" at offset 61504; code bytes = 8030 Found XOR loop in file "S-1-5-21-735145574-3570218355-1207367261.eXe" at offset 63414; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 220820; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 466209; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 476043; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1255329; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1844320; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1874528; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1881356; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1886608; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1907364; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2011620; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2014248; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2168992; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2411455; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2599701; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2606173; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2658604; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2764890; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2774544; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2817153; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2882601; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2956097; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3188643; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3211724; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3244878; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3254616; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3291716; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3296432; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3335738; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3561468; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3623534; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3808480; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3880357; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3944253; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3963271; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4003648; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4041916; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4103006; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4104478; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4135196; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4188540; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4259681; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4690865; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4726427; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4727819; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4727960; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4727963; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4729211; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4730747; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4730750; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4741107; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4782556; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4807117; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5419969; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5421577; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5577771; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5587855; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5596973; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5601317; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5607097; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5609041; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5609685; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5625657; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5627119; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5634189; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5635663; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5639159; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5640633; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5641837; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5643367; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5644787; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5648375; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5653671; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5654767; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5655039; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5656279; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5657673; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5659555; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5662847; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5664403; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5667563; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5672087; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5675633; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5680503; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5687353; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5688187; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5691019; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5695487; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5696339; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5698267; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5698673; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5704617; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5706251; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5709693; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5710593; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5711471; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5714091; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5715159; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5717921; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5720607; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5723783; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5725321; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5726785; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 59815; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 68884; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1564129; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1564260; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1837364; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2041605; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2042053; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2042629; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2043077; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2389676; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2397096; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2406060; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2420903; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2425008; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2436610; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2438780; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2442940; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2454485; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2460491; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2470800; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2473978; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2479102; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2479909; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2484740; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2508530; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2511520; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2519084; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2528503; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2533290; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2543878; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2550612; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2554862; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2565999; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2575633; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2579877; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2590532; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2614903; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2615855; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2623346; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2627335; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2628738; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2632633; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2635273; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2637401; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2638235; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2657144; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2685605; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2686340; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2702378; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2715305; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2716727; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2722072; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2725033; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2726167; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2727204; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2731927; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2772119; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2782300; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2784648; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2790186; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2794874; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2805123; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2807979; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2811864; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2816264; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2833177; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2840777; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2859414; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2876351; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2879478; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2881837; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2885373; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2909564; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2919784; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2922153; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2923612; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2931023; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2940586; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2945132; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2945382; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2961320; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2971467; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2979951; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3018673; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3040311; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3052503; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3052865; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3052873; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3067293; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3089062; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3090585; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3093569; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3097679; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3099922; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3124684; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3133618; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3144605; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3149383; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3154451; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3164044; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3205678; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3208929; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3213373; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3213631; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3220751; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3222828; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3225883; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3233154; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3240336; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3241020; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3242035; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3244518; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3249208; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3251080; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3253261; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3258784; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3262601; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3267174; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3276068; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3287102; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3309205; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3324066; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3328570; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3335408; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3365287; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3369418; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3369895; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3385508; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3386576; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3386790; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3388946; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3506889; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3562586; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3571851; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3587805; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3601715; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3608432; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3633817; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3658826; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3671703; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3726520; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3750565; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3760800; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3778835; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3808952; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3926439; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3980235; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4004120; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4111599; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4156335; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4189012; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4307699; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4419180; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5459903; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5582227; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5585635; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5587353; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5590639; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5605255; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5623317; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4092756; code bytes = 30040e Found XOR loop in file "sample.bin" at offset 160214; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 160285; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 497549; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 497571; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 497593; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 531506; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 615856; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 615945; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 877884; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 944090; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 952484; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1271100; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1616887; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2045388; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2057738; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2104444; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2104512; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2666714; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2784545; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3216703; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3222437; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3278518; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3308620; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3308638; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3415431; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3415539; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3415795; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3416051; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3416095; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3416307; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3416563; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3416727; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3416819; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3416932; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3417075; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3417327; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3417331; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3417587; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3417843; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3418099; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3418355; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3418575; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3418611; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3418647; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3418867; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3419123; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3419379; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3419635; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3419935; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3518713; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3580488; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3683366; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3709011; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3832146; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3904389; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3984419; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4043840; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4115036; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4141364; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4212214; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4285649; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4570155; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4695530; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4704817; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4704865; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4783253; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5597616; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5619694; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5633436; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5634164; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5635624; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5639120; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5640604; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5641810; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5643328; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5644748; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5646508; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5648336; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5653632; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5654748; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5655000; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5656240; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5657634; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5659516; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5662812; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5664364; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5665812; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5667524; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5670516; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5672048; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5675594; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5677200; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5680464; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5682184; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5683452; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5685840; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5687314; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5688148; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5690980; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5693938; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5695448; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5696320; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5698248; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5698634; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5707100; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5709676; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5710578; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5711456; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5716296; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5720596; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5724350; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5724884; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5726780; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5728624; code bytes = 80303e:T436,file/memory contains long string with (Indicator: "NtQuerySystemInformation"; File: "NVDisplay.Container.nvi.exe") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00001332.00000000.214146.00610000.00000004.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00002568.00000000.214499.00920000.00000004.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00004828.00000000.213750.02E20000.00000004.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00004972.00000001.214568.00B49000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00006368.00000000.213748.02FD0000.00000004.mdmp")3f:T5ca,Found string "GetCommandLineA" (Indicator: "GetCommandLine"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found string "GetCursorPos" (Indicator: "GetCursorPos"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") file/memory contains long string with (Indicator: "GetCommandLine"; File: "NVDisplay.Container.nvi.exe") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00001332.00000000.214146.00610000.00000004.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00002568.00000000.214499.00920000.00000004.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00004828.00000000.213750.02E20000.00000004.mdmp, 00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found string "GetCursorPos" (Indicator: "GetCursorPos"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00004972.00000001.214568.00B49000.00000002.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00006368.00000000.213748.02FD0000.00000004.mdmp")40:T712,Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp")41:T939,Found system information discovery API: "GetEnvironmentStringsW" in file "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll" Found system information discovery API: "GetSystemInfo" in file "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll" Found system information discovery API: "GetMonitorInfoW" in file "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll" Found system information discovery API: "NtQuerySystemInformation" in file "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll" Found system information discovery API: "RtlNtStatusToDosError" in file "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll" Found system information discovery API: "NtQuerySystemInformation" in "00000000-00001332.00000000.214146.00610000.00000004.mdmp" Found system information discovery API: "RtlNtStatusToDosError" in "00000000-00001332.00000000.214146.00610000.00000004.mdmp" Found system information discovery API: "NtQuerySystemInformation" in "00000000-00002568.00000000.214499.00920000.00000004.mdmp" Found system information discovery API: "RtlNtStatusToDosError" in "00000000-00002568.00000000.214499.00920000.00000004.mdmp" Found system information discovery API: "NtQuerySystemInformation" in "00000000-00004828.00000000.213750.02E20000.00000004.mdmp" Found system information discovery API: "RtlNtStatusToDosError" in "00000000-00004828.00000000.213750.02E20000.00000004.mdmp" Found system information discovery API: "GetMonitorInfoW" in "00000000-00004828.00000000.213750.72B79000.00000002.mdmp" Found system information discovery API: "GetSystemInfo" in "00000000-00004828.00000000.213750.72B79000.00000002.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00004828.00000000.213750.72B79000.00000002.mdmp" Found system information discovery API: "NtQuerySystemInformation" in "00000000-00004972.00000001.214568.00B49000.00000002.mdmp" Found system information discovery API: "RtlNtStatusToDosError" in "00000000-00004972.00000001.214568.00B49000.00000002.mdmp" Found system information discovery API: "NtQuerySystemInformation" in "00000000-00006368.00000000.213748.02FD0000.00000004.mdmp" Found system information discovery API: "RtlNtStatusToDosError" in "00000000-00006368.00000000.213748.02FD0000.00000004.mdmp"42:T4ea,Found reference to API "GetTextCharsetInfo" (Indicator: "GetTextCharset"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "GetSystemDefaultUILanguage" (Indicator: "GetSystemDefaultUILanguage"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "GetKeyboardLayout" (Indicator: "GetKeyboardLayout"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "GetSystemDefaultUILanguage" (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "GetKeyboardLayout" (Indicator: "GetKeyboardLayout"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "GetTextCharsetInfo" (Indicator: "GetTextCharset"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp")43:T46a,Found reference to API "InSendMessage" (Indicator: "sendmessage"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "PostMessageW" (Indicator: "postmessage"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "SendMessageW" (Indicator: "sendmessage"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "SendMessageW" (Indicator: "sendmessage"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "InSendMessage" (Indicator: "sendmessage"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp")44:T38c6,"rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006368) "rundll32.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006368) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000ec0016e15f7440efec0038efec0044efec000300000080f6ab7650efec00aaec5f740300000000000000e4477072b6ec5f7431b7de0388efec007de05f7464e05f74e9b7de03e447707205000000f09d70720000000075e2707286e2707208f0ec00802b6274011e5e77feffffff94efec00e0df5f7420027272a4efec0049d97172c064747220027272b0efec0063d9717220027272d4efec00fa9d7072010000000100000037066377010000000b2e607406000000dad8717218f0ec00eecf7172c4dc7172e2cf7172883631350100000001000000000000005fafd2bd00f0ec0014f0ec0032ba6577a068747200000000000000000000000028f0ec00 (UID: 00000000-00006368) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000020000007ceeec0088eeec0030f0ec00e99c6577dd338d29feffffffd0efec0016bcff723e30f0f743aed2bd00efec0033da63770000000033da6377f0c2010300020000000000000000000000020000f0c2010320efec00ae38b5720000fd0200000000f0c20103000200000002000000010000d2d0b472f0c301030000000000010000800000002000000064efec00b922b572f0c40103d81a9c7200000000010000005cefec003c52756e6e696e6700efec00cb21b57202000000aa21b5721bacdee3d81a9c72649eb77201000000000000006cefec0018f2be72e0810103fcf1be72a8efec006e25a87218f2be7250109c72dcdbbe7201000000 (UID: 00000000-00006368) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008384) "rundll32.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008384) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000690016e15f7498f3690090f369009cf369000300000080f6ab76a8f36900aaec5f740300000000000000e4477072b6ec5f7401a75820e0f369007de05f7464e05f7449a75820e447707205000000f09d70720000000075e2707286e2707260f46900802b6274c9125d54feffffffecf36900e0df5f7420027272fcf3690049d97172c06474722002727208f4690063d97172200272722cf46900fa9d7072010000000100000037066377010000000b2e607406000000dad8717270f46900eecf7172c4dc7172e2cf71724aad26900100000001000000000000001cb48dd058f469006cf4690032ba6577a068747200000000000000000000000080f46900 (UID: 00000000-00008384) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000002000000d4f26900e0f2690088f46900e99c6577e12ac995feffffff28f4690016bcff72acf64ce630b38dd058f3690033da63770000000033da6377e8b3d80200020000000000000000000000020000e8b3d80278f36900ae38b5720000d40200000000e8b3d802000200000002000000010000d2d0b472e8b4d80200000000000100008000000020000000bcf36900b922b572e8b5d802d81a9c720000000001000000b4f369003c2ab5721820bf72f052756e6e696e6700000000aa21b572dda2dbf0d81a9c72649eb7720100000000000000c4f3690018f2be72d872d802fcf1be7200f469006e25a87218f2be7250109c72dcdbbe7201000000 (UID: 00000000-00008384) "rundll32.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008384) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006948) "rundll32.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006948) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000e30016e15f7428f0e30020f0e3002cf0e3000300000080f6ab7638f0e300aaec5f740300000000000000e4477072b6ec5f7429b6dbaf70f0e3007de05f7464e05f7461b6dbafe447707205000000f09d70720000000075e2707286e27072f0f0e300802b6274710054dbfeffffff7cf0e300e0df5f74200272728cf0e30049d97172c06474722002727298f0e30063d9717220027272bcf0e300fa9d7072010000000100000037066377010000000b2e607406000000dad8717200f1e300eecf7172c4dc7172e2cf717215716ba90100000001000000000000008868ec4de8f0e300fcf0e30032ba6577a068747200000000000000000000000010f1e300 (UID: 00000000-00006948) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000000200000064efe30070efe30018f1e300e99c6577b49527a7feffffffb8f0e30016bcff72cd37d1dee477ec4de8efe30033da63770000000033da6377d08c0d0300020000000000000000000000020000d08c0d0308f0e300ae38b5720000090300000000d08c0d03000200000002000000010000d2d0b472d8c40d03000000000001000080000000200000004cf0e300b922b572d8c50d03d81a9c72000000000100000044f0e3003c2ab5721820bf728052756e6e696e6700000000aa21b5723aeecc5bd81a9c72649eb772010000000000000054f0e30018f2be7258820d03fcf1be7290f0e3006e25a87218f2be7250109c72dcdbbe7201000000 (UID: 00000000-00006948) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004828) "rundll32.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004828) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000a10016e15f7418f4a10010f4a1001cf4a1000300000080f6ab7628f4a100aaec5f740300000000000000e4477072b6ec5f747864492a60f4a1007de05f7464e05f743064492ae447707205000000f09d70720000000075e2707286e27072e0f4a100802b627430d6845efeffffff6cf4a100e0df5f74200272727cf4a10049d97172c06474722002727288f4a10063d9717220027272acf4a100fa9d7072010000000100000037066377010000000b2e607406000000dad87172f0f4a100eecf7172c4dc7172e2cf71723a69f915010000000100000000000000bcc69fd9d8f4a100ecf4a10032ba6577a068747200000000000000000000000000f5a100 (UID: 00000000-00004828) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000000200000054f3a10060f3a10008f5a100e99c65777c866faafeffffffa8f4a10016bcff72c39e4de290c19fd9d8f3a10033da63770000000033da6377f0c4e60200020000000000000000000000020000f0c4e602f8f3a100ae38b5720000e20200000000f0c4e602000200000002000000010000d2d0b472f0c5e602000000000001000080000000200000003cf4a100b922b572f0c6e602d81a9c72000000000100000034f4a1003c2ab5721820bf727052756e6e696e6700000000aa21b572ca46c3d9d81a9c72649eb772010000000000000044f4a10018f2be72e083e602fcf1be7280f4a1006e25a87218f2be7250109c72dcdbbe7201000000 (UID: 00000000-00004828) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000612) "rundll32.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000612) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000003c0016e15f7480f03c0078f03c0084f03c000300000080f6ab7690f03c00aaec5f740300000000000000e4477072b6ec5f74ab321849c8f03c007de05f7464e05f74f3321849e447707205000000f09d70720000000075e2707286e2707248f13c00802b62745b84483dfeffffffd4f03c00e0df5f7420027272e4f03c0049d97172c064747220027272f0f03c0063d971722002727214f13c00fa9d7072010000000100000037066377010000000b2e607406000000dad8717258f13c00eecf7172c4dc7172e2cf7172a10a886601000000010000000000000065a9314a40f13c0054f13c0032ba6577a068747200000000000000000000000068f13c00 (UID: 00000000-00000612) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000002000000bcef3c00c8ef3c0070f13c00e99c65773d41da10feffffff10f13c0016bcff72096c36d879a8314a40f03c0033da63770000000033da6377d0c2790000020000000000000000000000020000d0c2790060f03c00ae38b5720000750000000000d0c27900000200000002000000010000d2d0b472d0c3790000000000000100008000000020000000a4f03c00b922b572d0c47900d81a9c7200000000010000009cf03c003c52756e6e696e6700f03c00cb21b57202000000aa21b57225089590d81a9c72649eb7720100000000000000acf03c0018f2be72c0817900fcf1be72e8f03c006e25a87218f2be7250109c72dcdbbe7201000000 (UID: 00000000-00000612) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002976) "rundll32.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002976)45:T8b8,Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "GetFileTime" (Indicator: "GetFileTime"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001332.00000000.214146.00610000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002568.00000000.214499.00920000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004828.00000000.213750.02E20000.00000004.mdmp, 00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "GetFileTime" (Indicator: "GetFileTime"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004972.00000001.214568.00B49000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006368.00000000.213748.02FD0000.00000004.mdmp")46:T49e,Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp")47:T6be,Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "DllGetVersion" (Indicator: "GetVersion"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "DllGetVersion" (Indicator: "GetVersion"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp")48:T498,Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00001332.00000000.214146.00610000.00000004.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00002568.00000000.214499.00920000.00000004.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00004828.00000000.213750.02E20000.00000004.mdmp, 00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00004972.00000001.214568.00B49000.00000002.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00006368.00000000.213748.02FD0000.00000004.mdmp")49:T15e3,"rundll32.exe" called "CopyFileW" to copy %WINDIR%\SysWOW64\rundll32.exe to new location %ALLUSERSPROFILE%\NvContainer.Session.{F1E59978-E49F-4ADA-BEB7-DAF9D36905D6}\nvcontainersession.nvi.pif\NVDisplay.Container.nvi.exe (UID: 00000000-00006368) "rundll32.exe" called "CopyFileW" to copy %WINDIR%\SysWOW64\HDPGMS.DLL to new location %ALLUSERSPROFILE%\NvContainer.Session.{F1E59978-E49F-4ADA-BEB7-DAF9D36905D6}\nvcontainersession.nvi.pif\hDPGms.DLl (UID: 00000000-00006368) "rundll32.exe" called "CopyFileW" to copy %WINDIR%\SysWOW64\rundll32.exe to new location %ALLUSERSPROFILE%\NvContainer.Session.{FB6A8D0A-A463-482E-9894-6E22443FE51D}\nvcontainersession.nvi.pif\NVDisplay.Container.nvi.exe (UID: 00000000-00008384) "rundll32.exe" called "CopyFileW" to copy %WINDIR%\SysWOW64\HDPGMS.DLL to new location %ALLUSERSPROFILE%\NvContainer.Session.{FB6A8D0A-A463-482E-9894-6E22443FE51D}\nvcontainersession.nvi.pif\hDPGms.DLl (UID: 00000000-00008384) "rundll32.exe" called "CopyFileW" to copy %WINDIR%\SysWOW64\rundll32.exe to new location %TEMP%\S-1-5-21-735145574-3570218355-1207367261\S-1-5-21-735145574-3570218355-1207367261.eXe (UID: 00000000-00008384) "rundll32.exe" called "CopyFileW" to copy %WINDIR%\SysWOW64\HDPGMS.DLL to new location %TEMP%\S-1-5-21-735145574-3570218355-1207367261\hDPGms.dLl (UID: 00000000-00008384) "rundll32.exe" called "CopyFileW" to copy %WINDIR%\SysWOW64\rundll32.exe to new location %ALLUSERSPROFILE%\NvContainer.Session.{76D42E9E-E502-47C9-8364-ABD9318C6752}\nvcontainersession.nvi.pif\NVDisplay.Container.nvi.exe (UID: 00000000-00006948) "rundll32.exe" called "CopyFileW" to copy %WINDIR%\SysWOW64\HDPGMS.DLL to new location %ALLUSERSPROFILE%\NvContainer.Session.{76D42E9E-E502-47C9-8364-ABD9318C6752}\nvcontainersession.nvi.pif\hDPGms.DLl (UID: 00000000-00006948) "rundll32.exe" called "CopyFileW" to copy %WINDIR%\SysWOW64\rundll32.exe to new location %ALLUSERSPROFILE%\NvContainer.Session.{2D091FB6-3601-4E2C-8DA0-957318AFDEF0}\nvcontainersession.nvi.pif\NVDisplay.Container.nvi.exe (UID: 00000000-00004828) "rundll32.exe" called "CopyFileW" to copy %WINDIR%\SysWOW64\HDPGMS.DLL to new location %ALLUSERSPROFILE%\NvContainer.Session.{2D091FB6-3601-4E2C-8DA0-957318AFDEF0}\nvcontainersession.nvi.pif\hDPGms.DLl (UID: 00000000-00004828) "rundll32.exe" called "CopyFileW" to copy %WINDIR%\SysWOW64\rundll32.exe to new location %ALLUSERSPROFILE%\NvContainer.Session.{DE2F907C-64B8-4C9D-BB22-CBA153708D41}\nvcontainersession.nvi.pif\NVDisplay.Container.nvi.exe (UID: 00000000-00000612) "rundll32.exe" called "CopyFileW" to copy %WINDIR%\SysWOW64\HDPGMS.DLL to new location %ALLUSERSPROFILE%\NvContainer.Session.{DE2F907C-64B8-4C9D-BB22-CBA153708D41}\nvcontainersession.nvi.pif\hDPGms.DLl (UID: 00000000-00000612) "rundll32.exe" called "CopyFileW" to copy %WINDIR%\SysWOW64\rundll32.exe to new location %ALLUSERSPROFILE%\NvContainer.Session.{B43C0F53-C23A-4AF6-A7E1-51628C9AA0EB}\nvcontainersession.nvi.pif\NVDisplay.Container.nvi.exe (UID: 00000000-00002976) "rundll32.exe" called "CopyFileW" to copy %WINDIR%\SysWOW64\HDPGMS.DLL to new location %ALLUSERSPROFILE%\NvContainer.Session.{B43C0F53-C23A-4AF6-A7E1-51628C9AA0EB}\nvcontainersession.nvi.pif\hDPGms.DLl (UID: 00000000-00002976) "rundll32.exe" called "CopyFileW" to copy %WINDIR%\SysWOW64\rundll32.exe to new location %ALLUSERSPROFILE%\NvContainer.Session.{AEB845D3-164B-42DF-967F-E5812BEFA07C}\nvcontainersession.nvi.pif\NVDisplay.Container.nvi.exe (UID: 00000000-00001332) "rundll32.exe" called "CopyFileW" to copy %WINDIR%\SysWOW64\HDPGMS.DLL to new location %ALLUSERSPROFILE%\NvContainer.Session.{AEB845D3-164B-42DF-967F-E5812BEFA07C}\nvcontainersession.nvi.pif\hDPGms.DLl (UID: 00000000-00001332) "rundll32.exe" called "CopyFileW" to copy %WINDIR%\SysWOW64\rundll32.exe to new location %ALLUSERSPROFILE%\NvContainer.Session.{ECA141CF-9DD5-458A-B577-7F397C35A510}\nvcontainersession.nvi.pif\NVDisplay.Container.nvi.exe (UID: 00000000-00007940) "rundll32.exe" called "CopyFileW" to copy %WINDIR%\SysWOW64\HDPGMS.DLL to new location %ALLUSERSPROFILE%\NvContainer.Session.{ECA141CF-9DD5-458A-B577-7F397C35A510}\nvcontainersession.nvi.pif\hDPGms.DLl (UID: 00000000-00007940) "rundll32.exe" called "CopyFileW" to copy %WINDIR%\SysWOW64\rundll32.exe to new location %ALLUSERSPROFILE%\NvContainer.Session.{BFFC80E0-8127-466A-9A65-AC60551DB29D}\nvcontainersession.nvi.pif\NVDisplay.Container.nvi.exe (UID: 00000000-00004972) "rundll32.exe" called "CopyFileW" to copy %WINDIR%\SysWOW64\HDPGMS.DLL to new location %ALLUSERSPROFILE%\NvContainer.Session.{BFFC80E0-8127-466A-9A65-AC60551DB29D}\nvcontainersession.nvi.pif\hDPGms.DLl (UID: 00000000-00004972) "rundll32.exe" called "CopyFileW" to copy %WINDIR%\SysWOW64\rundll32.exe to new location %ALLUSERSPROFILE%\NvContainer.Session.{C9A6A134-A801-48BB-9CD1-A2AAC8D0CE62}\nvcontainersession.nvi.pif\NVDisplay.Container.nvi.exe (UID: 00000000-00002568) "rundll32.exe" called "CopyFileW" to copy %WINDIR%\SysWOW64\HDPGMS.DLL to new location %ALLUSERSPROFILE%\NvContainer.Session.{C9A6A134-A801-48BB-9CD1-A2AAC8D0CE62}\nvcontainersession.nvi.pif\hDPGms.DLl (UID: 00000000-00002568) "rundll32.exe" called "CopyFileW" to copy %WINDIR%\SysWOW64\rundll32.exe to new location %ALLUSERSPROFILE%\NvContainer.Session.{76302604-3989-448B-B2FC-1D27F1533A08}\nvcontainersession.nvi.pif\NVDisplay.Container.nvi.exe (UID: 00000000-00002188) "rundll32.exe" called "CopyFileW" to copy %WINDIR%\SysWOW64\HDPGMS.DLL to new location %ALLUSERSPROFILE%\NvContainer.Session.{76302604-3989-448B-B2FC-1D27F1533A08}\nvcontainersession.nvi.pif\hDPGms.DLl (UID: 00000000-00002188)4a:Tf53,"rundll32.exe" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\NvContainer.Session.{F1E59978-E49F-4ADA-BEB7-DAF9D36905D6} (UID: 00000000-00006368) "rundll32.exe" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\NvContainer.Session.{F1E59978-E49F-4ADA-BEB7-DAF9D36905D6}\nvcontainersession.nvi.pif (UID: 00000000-00006368) "rundll32.exe" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\NvContainer.Session.{FB6A8D0A-A463-482E-9894-6E22443FE51D} (UID: 00000000-00008384) "rundll32.exe" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\NvContainer.Session.{FB6A8D0A-A463-482E-9894-6E22443FE51D}\nvcontainersession.nvi.pif (UID: 00000000-00008384) "rundll32.exe" called "CreateDirectoryW" with parameter %TEMP%\S-1-5-21-735145574-3570218355-1207367261 (UID: 00000000-00008384) "rundll32.exe" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\NvContainer.Session.{76D42E9E-E502-47C9-8364-ABD9318C6752} (UID: 00000000-00006948) "rundll32.exe" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\NvContainer.Session.{76D42E9E-E502-47C9-8364-ABD9318C6752}\nvcontainersession.nvi.pif (UID: 00000000-00006948) "rundll32.exe" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\NvContainer.Session.{2D091FB6-3601-4E2C-8DA0-957318AFDEF0} (UID: 00000000-00004828) "rundll32.exe" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\NvContainer.Session.{2D091FB6-3601-4E2C-8DA0-957318AFDEF0}\nvcontainersession.nvi.pif (UID: 00000000-00004828) "rundll32.exe" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\NvContainer.Session.{DE2F907C-64B8-4C9D-BB22-CBA153708D41} (UID: 00000000-00000612) "rundll32.exe" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\NvContainer.Session.{DE2F907C-64B8-4C9D-BB22-CBA153708D41}\nvcontainersession.nvi.pif (UID: 00000000-00000612) "rundll32.exe" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\NvContainer.Session.{B43C0F53-C23A-4AF6-A7E1-51628C9AA0EB} (UID: 00000000-00002976) "rundll32.exe" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\NvContainer.Session.{B43C0F53-C23A-4AF6-A7E1-51628C9AA0EB}\nvcontainersession.nvi.pif (UID: 00000000-00002976) "rundll32.exe" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\NvContainer.Session.{AEB845D3-164B-42DF-967F-E5812BEFA07C} (UID: 00000000-00001332) "rundll32.exe" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\NvContainer.Session.{AEB845D3-164B-42DF-967F-E5812BEFA07C}\nvcontainersession.nvi.pif (UID: 00000000-00001332) "rundll32.exe" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\NvContainer.Session.{ECA141CF-9DD5-458A-B577-7F397C35A510} (UID: 00000000-00007940) "rundll32.exe" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\NvContainer.Session.{ECA141CF-9DD5-458A-B577-7F397C35A510}\nvcontainersession.nvi.pif (UID: 00000000-00007940) "rundll32.exe" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\NvContainer.Session.{BFFC80E0-8127-466A-9A65-AC60551DB29D} (UID: 00000000-00004972) "rundll32.exe" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\NvContainer.Session.{BFFC80E0-8127-466A-9A65-AC60551DB29D}\nvcontainersession.nvi.pif (UID: 00000000-00004972) "rundll32.exe" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\NvContainer.Session.{C9A6A134-A801-48BB-9CD1-A2AAC8D0CE62} (UID: 00000000-00002568) "rundll32.exe" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\NvContainer.Session.{C9A6A134-A801-48BB-9CD1-A2AAC8D0CE62}\nvcontainersession.nvi.pif (UID: 00000000-00002568) "rundll32.exe" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\NvContainer.Session.{76302604-3989-448B-B2FC-1D27F1533A08} (UID: 00000000-00002188) "rundll32.exe" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\NvContainer.Session.{76302604-3989-448B-B2FC-1D27F1533A08}\nvcontainersession.nvi.pif (UID: 00000000-00002188)4b:T2a67,"rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006368) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006368) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-0 (UID: 00000000-00006368) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006368) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006368) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00006368) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00006368) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00006368) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00006368) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008384) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008384) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-0 (UID: 00000000-00008384) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008384) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008384) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00008384) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00008384) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00008384) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00008384) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006948) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006948) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-0 (UID: 00000000-00006948) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006948) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006948) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00006948) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00006948) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00006948) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00006948) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004828) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004828) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-0 (UID: 00000000-00004828) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004828) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004828) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00004828) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00004828) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00004828) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00004828) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000612) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000612) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-0 (UID: 00000000-00000612) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000612) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000612) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00000612) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00000612) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00000612) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00000612) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002976) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002976) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-0 (UID: 00000000-00002976) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002976) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002976) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00002976) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00002976) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00002976) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00002976) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001332) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001332) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-0 (UID: 00000000-00001332) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001332) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001332) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00001332) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00001332) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00001332) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00001332) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007940) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007940) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-0 (UID: 00000000-00007940) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007940) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007940) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00007940) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00007940) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00007940) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00007940) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004972) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004972) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-0 (UID: 00000000-00004972) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004972) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004972) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00004972) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00004972) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00004972) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00004972) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002568) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002568) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-0 (UID: 00000000-00002568) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002568) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002568) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00002568) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00002568) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00002568) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00002568) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002188) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002188) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-0 (UID: 00000000-00002188) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002188) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002188) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00002188) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00002188) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00002188) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00002188)4c:Tf2cf,"rundll32.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006368) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006368) "rundll32.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006368) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006368) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006368) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006368) "rundll32.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006368) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00006368) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00006368) "rundll32.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006368) "rundll32.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006368) "rundll32.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006368) "rundll32.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006368) "rundll32.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006368) "rundll32.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006368) "rundll32.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006368) "rundll32.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006368) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006368) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006368) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006368) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006368) "rundll32.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006368) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006368) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006368) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006368) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006368) "rundll32.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006368) "rundll32.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006368) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006368) "rundll32.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006368) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006368) "rundll32.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006368) "rundll32.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006368) "rundll32.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006368) "rundll32.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006368) "rundll32.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006368) "rundll32.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006368) "rundll32.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006368) "rundll32.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006368) "rundll32.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006368) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006368) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006368) "rundll32.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006368) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006368) "rundll32.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006368) "rundll32.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006368) "rundll32.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006368) "rundll32.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00006368) "rundll32.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00006368) "rundll32.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00006368) "rundll32.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00006368) "rundll32.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00006368) "rundll32.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00006368) "rundll32.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00006368) "rundll32.exe" called "GetProcAddress" with a parameter AppPolicyGetProcessTerminationMethod (UID: 00000000-00006368) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00008384) "rundll32.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00008384) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00008384) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00008384) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00008384) "rundll32.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00008384) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00008384) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00008384) "rundll32.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00008384) "rundll32.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00008384) "rundll32.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00008384) "rundll32.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00008384) "rundll32.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00008384) "rundll32.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00008384) "rundll32.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00008384) "rundll32.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00008384) "rundll32.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00008384) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00008384) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00008384) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00008384) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00008384) "rundll32.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00008384) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00008384) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00008384) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00008384) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00008384) "rundll32.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00008384) "rundll32.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00008384) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00008384) "rundll32.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00008384) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00008384) "rundll32.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00008384) "rundll32.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00008384) "rundll32.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00008384) "rundll32.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00008384) "rundll32.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00008384) "rundll32.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00008384) "rundll32.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00008384) "rundll32.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00008384) "rundll32.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00008384) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00008384) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00008384) "rundll32.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00008384) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00008384) "rundll32.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00008384) "rundll32.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00008384) "rundll32.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00008384) "rundll32.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00008384) "rundll32.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00008384) "rundll32.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00008384) "rundll32.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00008384) "rundll32.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00008384) "rundll32.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00008384) "rundll32.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00008384) "rundll32.exe" called "GetProcAddress" with a parameter AppPolicyGetThreadInitializationType (UID: 00000000-00008384) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006948) "rundll32.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006948) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006948) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006948) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006948) "rundll32.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006948) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00006948) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00006948) "rundll32.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006948) "rundll32.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006948) "rundll32.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006948) "rundll32.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006948) "rundll32.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006948) "rundll32.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006948) "rundll32.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006948) "rundll32.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006948) "rundll32.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006948) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006948) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006948) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006948) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006948) "rundll32.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006948) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006948) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006948) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006948) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006948) "rundll32.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006948) "rundll32.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006948) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006948) "rundll32.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006948) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006948) "rundll32.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006948) "rundll32.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006948) "rundll32.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006948) "rundll32.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006948) "rundll32.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006948) "rundll32.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006948) "rundll32.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006948) "rundll32.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006948) "rundll32.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006948) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006948) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006948) "rundll32.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006948) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006948) "rundll32.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006948) "rundll32.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006948) "rundll32.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006948) "rundll32.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00006948) "rundll32.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00006948) "rundll32.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00006948) "rundll32.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00006948) "rundll32.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00006948) "rundll32.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00006948) "rundll32.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00006948) "rundll32.exe" called "GetProcAddress" with a parameter AppPolicyGetProcessTerminationMethod (UID: 00000000-00006948) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004828) "rundll32.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004828) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004828) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004828) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004828) "rundll32.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004828) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00004828) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00004828) "rundll32.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004828) "rundll32.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004828) "rundll32.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004828) "rundll32.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004828) "rundll32.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004828) "rundll32.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004828) "rundll32.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004828) "rundll32.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004828) "rundll32.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004828) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004828) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004828) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004828) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004828) "rundll32.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004828) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004828) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004828) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004828) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004828) "rundll32.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004828) "rundll32.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004828) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004828) "rundll32.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004828) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004828) "rundll32.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004828) "rundll32.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004828) "rundll32.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004828) "rundll32.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004828) "rundll32.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004828) "rundll32.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004828) "rundll32.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004828) "rundll32.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004828) "rundll32.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004828) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004828) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004828) "rundll32.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004828) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004828) "rundll32.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004828) "rundll32.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004828) "rundll32.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004828) "rundll32.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00004828) "rundll32.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00004828) "rundll32.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00004828) "rundll32.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00004828) "rundll32.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00004828) "rundll32.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00004828) "rundll32.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00004828) "rundll32.exe" called "GetProcAddress" with a parameter AppPolicyGetProcessTerminationMethod (UID: 00000000-00004828) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00000612) "rundll32.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00000612) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00000612) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00000612) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00000612) "rundll32.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00000612) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00000612) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00000612) "rundll32.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000612) "rundll32.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00000612) "rundll32.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00000612) "rundll32.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00000612) "rundll32.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00000612) "rundll32.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00000612) "rundll32.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00000612) "rundll32.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00000612) "rundll32.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00000612) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00000612) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00000612) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00000612) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00000612) "rundll32.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00000612) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00000612) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00000612) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00000612) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00000612) "rundll32.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00000612) "rundll32.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00000612) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00000612) "rundll32.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00000612) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00000612) "rundll32.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00000612) "rundll32.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00000612) "rundll32.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00000612) "rundll32.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00000612) "rundll32.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00000612) "rundll32.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00000612) "rundll32.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00000612) "rundll32.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00000612) "rundll32.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00000612) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00000612) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00000612) "rundll32.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00000612) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00000612) "rundll32.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00000612) "rundll32.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00000612) "rundll32.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00000612) "rundll32.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00000612) "rundll32.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00000612) "rundll32.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00000612) "rundll32.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00000612) "rundll32.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00000612) "rundll32.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00000612) "rundll32.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00000612) "rundll32.exe" called "GetProcAddress" with a parameter AppPolicyGetProcessTerminationMethod (UID: 00000000-00000612) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002976) "rundll32.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002976) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002976) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002976) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00002976) "rundll32.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00002976) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00002976) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00002976) "rundll32.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002976) "rundll32.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002976) "rundll32.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002976) "rundll32.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002976) "rundll32.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002976) "rundll32.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002976) "rundll32.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002976) "rundll32.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00002976) "rundll32.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00002976) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00002976) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00002976) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00002976) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00002976) "rundll32.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00002976) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00002976) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00002976) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00002976) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00002976) "rundll32.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00002976) "rundll32.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00002976) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00002976) "rundll32.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00002976) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00002976) "rundll32.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00002976) "rundll32.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00002976) "rundll32.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00002976) "rundll32.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00002976) "rundll32.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00002976) "rundll32.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00002976) "rundll32.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002976) "rundll32.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00002976) "rundll32.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002976) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00002976) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00002976) "rundll32.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00002976) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00002976) "rundll32.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00002976) "rundll32.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002976) "rundll32.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002976) "rundll32.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00002976) "rundll32.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00002976) "rundll32.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00002976) "rundll32.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00002976) "rundll32.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00002976) "rundll32.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00002976) "rundll32.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00002976) "rundll32.exe" called "GetProcAddress" with a parameter AppPolicyGetProcessTerminationMethod (UID: 00000000-00002976) "rundll32.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001332) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001332) "rundll32.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001332) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001332) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001332) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00001332) "rundll32.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00001332) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00001332) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00001332) "rundll32.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00001332) "rundll32.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00001332) "rundll32.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00001332) "rundll32.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00001332) "rundll32.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00001332) "rundll32.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001332) "rundll32.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00001332) "rundll32.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00001332) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00001332) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00001332) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00001332) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00001332) "rundll32.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00001332) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00001332) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00001332) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00001332) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00001332) "rundll32.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00001332) "rundll32.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00001332) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00001332) "rundll32.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00001332) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00001332) "rundll32.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00001332) "rundll32.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00001332) "rundll32.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00001332) "rundll32.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00001332) "rundll32.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00001332) "rundll32.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00001332) "rundll32.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00001332) "rundll32.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00001332) "rundll32.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00001332) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00001332) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00001332) "rundll32.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00001332) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00001332) "rundll32.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00001332) "rundll32.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00001332) "rundll32.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00001332) "rundll32.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00001332) "rundll32.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00001332) "rundll32.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00001332) "rundll32.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00001332) "rundll32.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00001332) "rundll32.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00001332) "rundll32.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00001332) "rundll32.exe" called "GetProcAddress" with a parameter AppPolicyGetProcessTerminationMethod (UID: 00000000-00001332) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007940) "rundll32.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007940) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007940) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007940) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007940) "rundll32.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007940) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00007940) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007940) "rundll32.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007940) "rundll32.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007940) "rundll32.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007940) "rundll32.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007940) "rundll32.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007940) "rundll32.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007940) "rundll32.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007940) "rundll32.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007940) "rundll32.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007940) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007940) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007940) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007940) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007940) "rundll32.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007940) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007940) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007940) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007940) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007940) "rundll32.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007940) "rundll32.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007940) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007940) "rundll32.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007940) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007940) "rundll32.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007940) "rundll32.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007940) "rundll32.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007940) "rundll32.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007940) "rundll32.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007940) "rundll32.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007940) "rundll32.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007940) "rundll32.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007940) "rundll32.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007940) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007940) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007940) "rundll32.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007940) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007940) "rundll32.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007940) "rundll32.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007940) "rundll32.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007940) "rundll32.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00007940) "rundll32.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00007940) "rundll32.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00007940) "rundll32.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00007940) "rundll32.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00007940) "rundll32.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00007940) "rundll32.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00007940) "rundll32.exe" called "GetProcAddress" with a parameter AppPolicyGetProcessTerminationMethod (UID: 00000000-00007940) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004972) "rundll32.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004972) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004972) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004972) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004972) "rundll32.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004972) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00004972) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00004972) "rundll32.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004972) "rundll32.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004972) "rundll32.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004972) "rundll32.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004972) "rundll32.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004972) "rundll32.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004972) "rundll32.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004972) "rundll32.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004972) "rundll32.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004972) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004972) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004972) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004972) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004972) "rundll32.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004972) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004972) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004972) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004972) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004972) "rundll32.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004972) "rundll32.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004972) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004972) "rundll32.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004972) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004972) "rundll32.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004972) "rundll32.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004972) "rundll32.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004972) "rundll32.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004972) "rundll32.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004972) "rundll32.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004972) "rundll32.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004972) "rundll32.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004972) "rundll32.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004972) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004972) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004972) "rundll32.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004972) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004972) "rundll32.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004972) "rundll32.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004972) "rundll32.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004972) "rundll32.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00004972) "rundll32.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00004972) "rundll32.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00004972) "rundll32.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00004972) "rundll32.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00004972) "rundll32.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00004972) "rundll32.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00004972) "rundll32.exe" called "GetProcAddress" with a parameter AppPolicyGetProcessTerminationMethod (UID: 00000000-00004972) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002568) "rundll32.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002568) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002568) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002568) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00002568) "rundll32.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00002568) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00002568) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00002568) "rundll32.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002568) "rundll32.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002568) "rundll32.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002568) "rundll32.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002568) "rundll32.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002568) "rundll32.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002568) "rundll32.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002568) "rundll32.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00002568) "rundll32.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00002568) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00002568) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00002568) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00002568) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00002568) "rundll32.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00002568) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00002568) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00002568) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00002568) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00002568) "rundll32.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00002568) "rundll32.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00002568) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00002568) "rundll32.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00002568) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00002568) "rundll32.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00002568) "rundll32.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00002568) "rundll32.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00002568) "rundll32.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00002568) "rundll32.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00002568) "rundll32.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00002568) "rundll32.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002568) "rundll32.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00002568) "rundll32.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002568) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00002568) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00002568) "rundll32.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00002568) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00002568) "rundll32.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00002568) "rundll32.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002568) "rundll32.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002568) "rundll32.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00002568) "rundll32.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00002568) "rundll32.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00002568) "rundll32.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00002568) "rundll32.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00002568) "rundll32.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00002568) "rundll32.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00002568) "rundll32.exe" called "GetProcAddress" with a parameter AppPolicyGetProcessTerminationMethod (UID: 00000000-00002568) "rundll32.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002188) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002188) "rundll32.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002188) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002188) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002188) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00002188) "rundll32.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00002188) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00002188) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00002188) "rundll32.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002188) "rundll32.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002188) "rundll32.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002188) "rundll32.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002188) "rundll32.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002188) "rundll32.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002188) "rundll32.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00002188) "rundll32.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00002188) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00002188) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00002188) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00002188) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00002188) "rundll32.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00002188) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00002188) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00002188) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00002188) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00002188) "rundll32.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00002188) "rundll32.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00002188) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00002188) "rundll32.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00002188) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00002188) "rundll32.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00002188) "rundll32.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00002188) "rundll32.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00002188) "rundll32.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00002188) "rundll32.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00002188) "rundll32.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00002188) "rundll32.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002188) "rundll32.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00002188) "rundll32.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002188) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00002188) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00002188) "rundll32.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00002188) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00002188) "rundll32.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00002188) "rundll32.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002188) "rundll32.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002188) "rundll32.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00002188) "rundll32.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00002188) "rundll32.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00002188) "rundll32.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00002188) "rundll32.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00002188) "rundll32.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00002188) "rundll32.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00002188) "rundll32.exe" called "GetProcAddress" with a parameter AppPolicyGetProcessTerminationMethod (UID: 00000000-00002188)4d:T1568,Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00000612.00000000.214135.00750000.00000004.mdmp, 00000000-00000612.00000001.214173.00750000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000612.00000000.214135.00750000.00000004.mdmp, 00000000-00000612.00000001.214173.00750000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000612.00000000.214135.00750000.00000004.mdmp, 00000000-00000612.00000001.214173.00750000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000612.00000000.214135.00750000.00000004.mdmp, 00000000-00000612.00000001.214173.00750000.00000004.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00001332.00000000.214146.00610000.00000004.mdmp, 00000000-00001332.00000001.214176.00610000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00001332.00000000.214146.00610000.00000004.mdmp, 00000000-00001332.00000001.214176.00610000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00001332.00000000.214146.00610000.00000004.mdmp, 00000000-00001332.00000001.214176.00610000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00001332.00000000.214146.00610000.00000004.mdmp, 00000000-00001332.00000001.214176.00610000.00000004.mdmp") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; Source: "00000000-00001332.00000000.214146.00610000.00000004.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00002188.00000000.214900.03150000.00000004.mdmp, 00000000-00002188.00000001.215057.03150000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00002188.00000000.214900.03150000.00000004.mdmp, 00000000-00002188.00000001.215057.03150000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00002188.00000000.214900.03150000.00000004.mdmp, 00000000-00002188.00000001.215057.03150000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00002188.00000000.214900.03150000.00000004.mdmp, 00000000-00002188.00000001.215057.03150000.00000004.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00002568.00000000.214499.00920000.00000004.mdmp, 00000000-00002568.00000001.214581.00920000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00002568.00000000.214499.00920000.00000004.mdmp, 00000000-00002568.00000001.214581.00920000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00002568.00000000.214499.00920000.00000004.mdmp, 00000000-00002568.00000001.214581.00920000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00002568.00000000.214499.00920000.00000004.mdmp, 00000000-00002568.00000001.214581.00920000.00000004.mdmp") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; Source: "00000000-00002568.00000000.214499.00920000.00000004.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00002976.00000000.214138.008F0000.00000004.mdmp, 00000000-00002976.00000001.214173.008F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00002976.00000000.214138.008F0000.00000004.mdmp, 00000000-00002976.00000001.214173.008F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00002976.00000000.214138.008F0000.00000004.mdmp, 00000000-00002976.00000001.214173.008F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00002976.00000000.214138.008F0000.00000004.mdmp, 00000000-00002976.00000001.214173.008F0000.00000004.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00004828.00000000.213750.02E20000.00000004.mdmp, 00000000-00004828.00000001.213809.02E20000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00004828.00000000.213750.02E20000.00000004.mdmp, 00000000-00004828.00000001.213809.02E20000.00000004.mdmp")4e:T6be,Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "CreateFileW" (Indicator: "CreateFile"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "CreateFileMoniker" (Indicator: "CreateFile"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "CreateFileTransactedW" (Indicator: "CreateFile"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00001332.00000000.214146.00610000.00000004.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00002568.00000000.214499.00920000.00000004.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00004828.00000000.213750.02E20000.00000004.mdmp, 00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "CreateFileTransactedW" (Indicator: "CreateFile"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "CreateFileMoniker" (Indicator: "CreateFile"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00004972.00000001.214568.00B49000.00000002.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00006368.00000000.213748.02FD0000.00000004.mdmp")4f:T405,Sleep@KERNEL32.dll at 16558-284-10010843 WaitForSingleObject@KERNEL32.dll at 16558-1123-10011096 WaitForSingleObject@KERNEL32.dll at 16558-1167-1000E8C5 WaitForSingleObjectEx@KERNEL32.dll at 16558-12166-1017971A MsgWaitForMultipleObjects at 16558-12343-10003523 Sleep@KERNEL32.dll at 16558-12354-100039B9 WaitForSingleObject@KERNEL32.dll at 16558-12389-100048A5 Sleep@KERNEL32.dll at 16558-12390-10004986 Sleep@KERNEL32.dll at 16558-12604-1000745A Sleep@KERNEL32.dll at 16558-12685-1000780B Sleep@KERNEL32.dll at 16558-13054-1000C32B Sleep@KERNEL32.dll at 16558-13301-10011743 SetTimer at 16558-14204-100344A6 SetTimer at 16558-14342-100F4519 SetTimer at 16558-14500-100475C4 SetTimer at 16558-14512-10047D2F SetTimer at 16558-14533-10048422 SetTimer at 16558-14827-101173A4 SetTimer at 16558-14880-10053895 SetTimer at 16558-15317-1006A898 SetTimer at 16558-15375-1006D225 SetTimer at 16558-15500-100CED2A SetTimer at 16558-17052-100EB37E SetTimer at 16558-17151-100F2B98 SetTimer at 16558-17438-101033A950:Tbd6,Found reference to API "ShellExecuteW" (Indicator: "ShellExecute"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "ShellExecuteExW" (Indicator: "ShellExecute"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00000612.00000000.214135.00750000.00000004.mdmp, 00000000-00000612.00000001.214173.00750000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00001332.00000000.214146.00610000.00000004.mdmp, 00000000-00001332.00000001.214176.00610000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00002188.00000000.214900.03150000.00000004.mdmp, 00000000-00002188.00000001.215057.03150000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00002568.00000000.214499.00920000.00000004.mdmp, 00000000-00002568.00000001.214581.00920000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00002976.00000000.214138.008F0000.00000004.mdmp, 00000000-00002976.00000001.214173.008F0000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00004828.00000000.213750.02E20000.00000004.mdmp, 00000000-00004828.00000001.213809.02E20000.00000004.mdmp") Found reference to API "ShellExecuteExW" (Indicator: "ShellExecute"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "ShellExecuteW" (Indicator: "ShellExecute"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00004972.00000000.214502.02E10000.00000004.mdmp, 00000000-00004972.00000001.214568.02E10000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00006368.00000000.213748.02FD0000.00000004.mdmp, 00000000-00006368.00000001.213820.02FD0000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00006948.00000000.213748.03090000.00000004.mdmp, 00000000-00006948.00000001.213811.03090000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00007940.00000000.214496.02D30000.00000004.mdmp, 00000000-00007940.00000001.214572.02D30000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00008384.00000000.213747.02D40000.00000004.mdmp, 00000000-00008384.00000001.215355.02D40000.00000004.mdmp")51:T69e,Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "FindResourceExW" (Indicator: "FindResource"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "FindResourceW" (Indicator: "FindResource"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "FreeResource" (Indicator: "FreeResource"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "LockResource" (Indicator: "LockResource"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "FindResourceExW" (Indicator: "FindResource"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp")52:T4ac,Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00001332.00000000.214146.00610000.00000004.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00002568.00000000.214499.00920000.00000004.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00004828.00000000.213750.02E20000.00000004.mdmp, 00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00004972.00000001.214568.00B49000.00000002.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00006368.00000000.213748.02FD0000.00000004.mdmp")53:T87c,Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "AGetSystemDirectoGetThreadContextSetThreadContext" (Indicator: "GetThreadContext"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "AGetSystemDirectoGetThreadContextSetThreadContext" (Indicator: "SetThreadContext"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "AGetSystemDirectoGetThreadContextSetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "AGetSystemDirectoGetThreadContextSetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp")54:T802,Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "SetLastError" (Indicator: "SetLastError"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "WSASetLastError" (Indicator: "SetLastError"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "WSAGetLastError" (Indicator: "GetLastError"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00001332.00000000.214146.00610000.00000004.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00001332.00000000.214146.00610000.00000004.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00002568.00000000.214499.00920000.00000004.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00002568.00000000.214499.00920000.00000004.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00004828.00000000.213750.02E20000.00000004.mdmp, 00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00004828.00000000.213750.02E20000.00000004.mdmp, 00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00004972.00000001.214568.00B49000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00004972.00000001.214568.00B49000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00006368.00000000.213748.02FD0000.00000004.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00006368.00000000.213748.02FD0000.00000004.mdmp")55:T5b4,"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll" contains export function called "CloseChannel" at ordinal 5 "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll" contains export function called "GetMetrics" at ordinal 7 "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll" contains export function called "GmsCommonRequest" at ordinal 6 "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll" contains export function called "InitSDK" at ordinal 1 "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll" contains export function called "MakeRequest" at ordinal 8 "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll" contains export function called "NvPluginWatchdog" at ordinal 11 "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll" contains export function called "RegisterLicense" at ordinal 2 "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll" contains export function called "ReleaseData" at ordinal 10 "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll" contains export function called "ResponseParse" at ordinal 9 "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll" contains export function called "SetCommonCallback" at ordinal 3 "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll" contains export function called "StartChannel" at ordinal 456:T9f5,Process rundll32.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:6368:168:WilStaging_02" Process rundll32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:6368:168:WilStaging_02" Process rundll32.exe created mutex with name "Local\SM0:6368:168:WilStaging_02" Process rundll32.exe created mutex with name "B7CD47736AE70B846B2D71538483C479AC32026D7A7DD4528966F91FE3E9F92FDA45112612AD4F46A31B885D7B21C1D801BE16581E22B5FF36EAE45006F620200415368506E811EC7DBEDCA8B5CBCA901B026AE47362236AEB2AE5B59C2ADA3DC22E7C9412F9B18CCC5CAAD248303BA1A6B97143AE7BB87AB23BED54EB6E083D2F3AB6C3E86916D2E4E6A196F55DD3B3DCE2597F6EA743F629255DBC70E7A2D3320A87B37687AB654FACE8A319A724A5E87B395DF9A07D11DE89F931F16A8F335D8C2EC6CBF1DBA1DD6E59AA7DE" Process rundll32.exe created mutex with name "SM0:6368:168:WilStaging_02" Process rundll32.exe created mutex with name "\Sessions\1\BaseNamedObjects\B7CD47736AE70B846B2D71538483C479AC32026D7A7DD4528966F91FE3E9F92FDA45112612AD4F46A31B885D7B21C1D801BE16581E22B5FF36EAE45006F620200415368506E811EC7DBEDCA8B5CBCA901B026AE47362236AEB2AE5B59C2ADA3DC22E7C9412F9B18CCC5CAAD248303BA1A6B97143AE7BB87AB23BED54EB6E083D2F3AB6C3E86916D2E4E6A196F55DD3B3DCE2597F6EA743F629255DBC70E7A2D3320A87B37687AB654FACE8A319A724A5E87B395DF9A07D11DE89F931F16A8F335D8C2EC6CBF1DBA1DD6E59AA7DE" Process rundll32.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:8384:168:WilStaging_02" Process rundll32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:8384:168:WilStaging_02" Process rundll32.exe created mutex with name "SM0:8384:168:WilStaging_02" Process rundll32.exe created mutex with name "Local\SM0:8384:168:WilStaging_02" Process rundll32.exe created mutex with name "Local\SM0:6948:168:WilStaging_02" Process rundll32.exe created mutex with name "SM0:6948:168:WilStaging_02" Process rundll32.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:6948:168:WilStaging_02" Process rundll32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:6948:168:WilStaging_02" Process rundll32.exe created mutex with name "SM0:4828:168:WilStaging_02" Process rundll32.exe created mutex with name "Local\SM0:4828:168:WilStaging_02" Process rundll32.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4828:168:WilStaging_02" Process rundll32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4828:168:WilStaging_02" Process rundll32.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:612:168:WilStaging_02"57:T646,Process "rundll32.exe" with commandline ""C:\\c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll",#1" (UID: 00000000-00006368) Process "rundll32.exe" with commandline ""C:\\c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll",#3" (UID: 00000000-00008384) Process "rundll32.exe" with commandline ""C:\\c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll",#2" (UID: 00000000-00006948) Process "rundll32.exe" with commandline ""C:\\c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll",#4" (UID: 00000000-00004828) Process "rundll32.exe" with commandline ""C:\\c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll",#5" (UID: 00000000-00000612) Process "rundll32.exe" with commandline ""C:\\c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll",#6" (UID: 00000000-00002976) Process "rundll32.exe" with commandline ""C:\\c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll",#7" (UID: 00000000-00001332) Process "rundll32.exe" with commandline ""C:\\c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll",#8" (UID: 00000000-00007940) Process "rundll32.exe" with commandline ""C:\\c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll",#10" (UID: 00000000-00004972) Process "rundll32.exe" with commandline ""C:\\c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll",#9" (UID: 00000000-00002568) Process "rundll32.exe" with commandline ""C:\\c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll",#11" (UID: 00000000-00002188)58:T6bc,"rundll32.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72f50000 "rundll32.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 769c0000 "rundll32.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 769c0000 "rundll32.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-0" at base 769c0000 "rundll32.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 769c0000 "rundll32.exe" loaded module "KERNEL32" at base 74500000 "rundll32.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 769c0000 "rundll32.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 769c0000 "rundll32.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 769c0000 "rundll32.exe" loaded module "C:\C5E82FCA91A7B8140781EECBE9F709E96EED638DEEA3ACD5F0CA35EF79A221C0.DLL" at base 729c0000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73c10000 "rundll32.exe" loaded module "KERNEL32.DLL" at base 74500000 "rundll32.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 76890000 "rundll32.exe" loaded module "RPCRT4.DLL" at base 75b80000 "rundll32.exe" loaded module "NTDLL.DLL" at base 77600000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 73410000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\NAPINSP.DLL" at base 72680000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\PNRPNSP.DLL" at base 72660000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\NLAAPI.DLL" at base 72640000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\WINRNR.DLL" at base 72630000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 725e0000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 725d000059:T4e3,"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x10179fc4,call 0x1017a817,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x10179e90,add esp, 0xc,pop ebp,ret 0xc,jmp dword ptr [0x101b9bb8],mov ecx, dword ptr [ebp - 0xc],mov dword ptr fs:[0], ecx,pop ecx,pop edi,pop edi,pop esi,pop ebx,mov esp, ebp,pop ebp,push ecx,bnd ret ,mov ecx, dword ptr [ebp - 0x10],xor ecx, ebp,bnd call 0x101794f6,bnd jmp 0x10179fdf,mov ecx, dword ptr [ebp - 0x14],xor ecx, ebp,bnd call 0x101794f6,bnd jmp 0x10179fdf,push eax," "NVDisplay.Container.nvi.exe" file has an entrypoint instructions - "call 0x406a63,jmp 0x406013,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,cmp ecx, dword ptr [0x408018],jne 0x40624b,ret 0,jmp 0x406533,call 0x406282,push 0x406370,call 0x4067c4,pop ecx,xor eax, eax,ret ,mov edi, edi,push ebp,mov ebp, esp,mov eax, dword ptr [0x408018],and eax, 0x1f,push 0x20,pop ecx,sub ecx, eax,mov eax, dword ptr [ebp + 8],ror eax, cl,xor eax, dword ptr [0x408018],pop ebp,ret ,mov edi, edi,push ebp,mov ebp, esp,push ecx,mov eax, dword ptr [0x408018],xor eax, ebp,mov dword ptr [ebp - 4], eax,push ebx,push esi,"5a:T698,Spawned process "rundll32.exe" with commandline ""C:\\c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a ..." (UID: 00000000-00008384), Spawned process "rundll32.exe" with commandline ""C:\\c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a ..." (UID: 00000000-00006948) Spawned process "rundll32.exe" with commandline ""C:\\c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a ..." (UID: 00000000-00004828), Spawned process "rundll32.exe" with commandline ""C:\\c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a ..." (UID: 00000000-00000612) Spawned process "rundll32.exe" with commandline ""C:\\c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a ..." (UID: 00000000-00002976), Spawned process "rundll32.exe" with commandline ""C:\\c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a ..." (UID: 00000000-00001332) Spawned process "taskkill.exe" with commandline "taskkill /f /im cmd.exe" (UID: 00000000-00007528) Spawned process "cmd.exe" with commandline "/c start "" /B cmd /C %TEMP%\\S-1-5-21-735145574-3570218355-1207 ..." (UID: 00000000-00008752) Spawned process "rundll32.exe" with commandline ""C:\\c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a ..." (UID: 00000000-00007940), Spawned process "rundll32.exe" with commandline ""C:\\c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a ..." (UID: 00000000-00004972) Spawned process "rundll32.exe" with commandline ""C:\\c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a ..." (UID: 00000000-00002568), Spawned process "rundll32.exe" with commandline ""C:\\c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a ..." (UID: 00000000-00002188)5b:T698,Spawned process "rundll32.exe" with commandline ""C:\\c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a ..." (UID: 00000000-00008384), Spawned process "rundll32.exe" with commandline ""C:\\c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a ..." (UID: 00000000-00006948) Spawned process "rundll32.exe" with commandline ""C:\\c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a ..." (UID: 00000000-00004828), Spawned process "rundll32.exe" with commandline ""C:\\c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a ..." (UID: 00000000-00000612) Spawned process "rundll32.exe" with commandline ""C:\\c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a ..." (UID: 00000000-00002976), Spawned process "rundll32.exe" with commandline ""C:\\c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a ..." (UID: 00000000-00001332) Spawned process "taskkill.exe" with commandline "taskkill /f /im cmd.exe" (UID: 00000000-00007528) Spawned process "cmd.exe" with commandline "/c start "" /B cmd /C %TEMP%\\S-1-5-21-735145574-3570218355-1207 ..." (UID: 00000000-00008752) Spawned process "rundll32.exe" with commandline ""C:\\c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a ..." (UID: 00000000-00007940), Spawned process "rundll32.exe" with commandline ""C:\\c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a ..." (UID: 00000000-00004972) Spawned process "rundll32.exe" with commandline ""C:\\c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a ..." (UID: 00000000-00002568), Spawned process "rundll32.exe" with commandline ""C:\\c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a ..." (UID: 00000000-00002188)5c:T59e,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001332.00000000.214146.00610000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002568.00000000.214499.00920000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004828.00000000.213750.02E20000.00000004.mdmp, 00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004972.00000001.214568.00B49000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00006368.00000000.213748.02FD0000.00000004.mdmp")5d:Tf02,"NVDisplay.Container.nvi.exe" has type "PE32 executable for MS Windows 10.00 (GUI) Intel i386 6 sections"- Location: [%ALLUSERSPROFILE%\NvContainer.Session.{BFFC80E0-8127-466A-9A65-AC60551DB29D}\nvcontainersession.nvi.pif\NVDisplay.Container.nvi.exe]- [targetUID: 00000000-00002976] "S-1-5-21-735145574-3570218355-1207367261.CMD" has type "Unicode text UTF-8 text with CRLF line terminators"- Location: [%TEMP%\S-1-5-21-735145574-3570218355-1207367261\S-1-5-21-735145574-3570218355-1207367261.CMD]- [targetUID: 00000000-00008384] "S-1-5-21-735145574-3570218355-1207367261.CMD.ini" has type "data"- Location: [%TEMP%\S-1-5-21-735145574-3570218355-1207367261\S-1-5-21-735145574-3570218355-1207367261.CMD.ini]- [targetUID: 00000000-00008384] "NVDisplay.Container.nvi.exe" has type "PE32 executable for MS Windows 10.00 (GUI) Intel i386 6 sections"- Location: [%ALLUSERSPROFILE%\NvContainer.Session.{2D091FB6-3601-4E2C-8DA0-957318AFDEF0}\nvcontainersession.nvi.pif\NVDisplay.Container.nvi.exe]- [targetUID: 00000000-00002976] "NVDisplay.Container.nvi.exe" has type "PE32 executable for MS Windows 10.00 (GUI) Intel i386 6 sections"- Location: [%ALLUSERSPROFILE%\NvContainer.Session.{AEB845D3-164B-42DF-967F-E5812BEFA07C}\nvcontainersession.nvi.pif\NVDisplay.Container.nvi.exe]- [targetUID: 00000000-00002976] "NVDisplay.Container.nvi.exe" has type "PE32 executable for MS Windows 10.00 (GUI) Intel i386 6 sections"- Location: [%ALLUSERSPROFILE%\NvContainer.Session.{C9A6A134-A801-48BB-9CD1-A2AAC8D0CE62}\nvcontainersession.nvi.pif\NVDisplay.Container.nvi.exe]- [targetUID: 00000000-00002976] "NVDisplay.Container.nvi.exe" has type "PE32 executable for MS Windows 10.00 (GUI) Intel i386 6 sections"- Location: [%ALLUSERSPROFILE%\NvContainer.Session.{B43C0F53-C23A-4AF6-A7E1-51628C9AA0EB}\nvcontainersession.nvi.pif\NVDisplay.Container.nvi.exe]- [targetUID: 00000000-00002976] "NVDisplay.Container.nvi.exe" has type "PE32 executable for MS Windows 10.00 (GUI) Intel i386 6 sections"- Location: [%ALLUSERSPROFILE%\NvContainer.Session.{FB6A8D0A-A463-482E-9894-6E22443FE51D}\nvcontainersession.nvi.pif\NVDisplay.Container.nvi.exe]- [targetUID: 00000000-00002976] "NVDisplay.Container.nvi.exe" has type "PE32 executable for MS Windows 10.00 (GUI) Intel i386 6 sections"- Location: [%ALLUSERSPROFILE%\NvContainer.Session.{F1E59978-E49F-4ADA-BEB7-DAF9D36905D6}\nvcontainersession.nvi.pif\NVDisplay.Container.nvi.exe]- [targetUID: 00000000-00002976] "NVDisplay.Container.nvi.exe" has type "PE32 executable for MS Windows 10.00 (GUI) Intel i386 6 sections"- Location: [%ALLUSERSPROFILE%\NvContainer.Session.{76302604-3989-448B-B2FC-1D27F1533A08}\nvcontainersession.nvi.pif\NVDisplay.Container.nvi.exe]- [targetUID: 00000000-00002976] "NVDisplay.Container.nvi.exe" has type "PE32 executable for MS Windows 10.00 (GUI) Intel i386 6 sections"- Location: [%ALLUSERSPROFILE%\NvContainer.Session.{76D42E9E-E502-47C9-8364-ABD9318C6752}\nvcontainersession.nvi.pif\NVDisplay.Container.nvi.exe]- [targetUID: 00000000-00002976] "NVDisplay.Container.nvi.exe" has type "PE32 executable for MS Windows 10.00 (GUI) Intel i386 6 sections"- Location: [%ALLUSERSPROFILE%\NvContainer.Session.{DE2F907C-64B8-4C9D-BB22-CBA153708D41}\nvcontainersession.nvi.pif\NVDisplay.Container.nvi.exe]- [targetUID: 00000000-00002976] "NVDisplay.Container.nvi.exe" has type "PE32 executable for MS Windows 10.00 (GUI) Intel i386 6 sections"- Location: [%ALLUSERSPROFILE%\NvContainer.Session.{ECA141CF-9DD5-458A-B577-7F397C35A510}\nvcontainersession.nvi.pif\NVDisplay.Container.nvi.exe]- [targetUID: 00000000-00002976] "S-1-5-21-735145574-3570218355-1207367261.eXe" has type "PE32 executable for MS Windows 10.00 (GUI) Intel i386 6 sections"- Location: [%TEMP%\S-1-5-21-735145574-3570218355-1207367261\S-1-5-21-735145574-3570218355-1207367261.eXe]- [targetUID: 00000000-00008384]5e:T574,"rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "")5f:Td8a,"rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "USEFILTER"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "DISABLEHEAPLOOKASIDE"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "FRONTENDHEAPDEBUGOPTIONS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "SHUTDOWNFLAGS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "UNLOADEVENTTRACEDEPTH"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "MAXLOADERTHREADS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "USEIMPERSONATEDDEVICEMAP"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "TRACINGFLAGS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "CFGOPTIONS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "MINIMUMSTACKCOMMITINBYTES"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "BREAKONINITIALIZEPROCESSFAILURE"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "KEEPACTIVATIONCONTEXTSALIVE"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "TRACKACTIVATIONCONTEXTRELEASES"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "MAXDEADACTIVATIONCONTEXTS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "GLOBALFLAG"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "DEBUGPROCESSHEAPONLY"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "RUNDLL32.EXE"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "")60:T42a,"rundll32.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "rundll32.exe" trying to access non-existent file "C:\WINDOWS\system32\wow64log.dll" "rundll32.exe" trying to access non-existent file "C:\MSIMG32.DLL" "rundll32.exe" trying to access non-existent file "C:\MSIMG32.dll" "rundll32.exe" trying to access non-existent file "C:\UXTHEME.DLL" "rundll32.exe" trying to access non-existent file "C:\UxTheme.dll" "rundll32.exe" trying to access non-existent file "C:\OLEDLG.DLL" "rundll32.exe" trying to access non-existent file "C:\oledlg.dll" "rundll32.exe" trying to access non-existent file "C:\WINMM.DLL" "rundll32.exe" trying to access non-existent file "C:\WINMM.dll" "rundll32.exe" trying to access non-existent file "C:\OLEACC.DLL" "rundll32.exe" trying to access non-existent file "C:\OLEACC.dll" "rundll32.exe" trying to access non-existent file "C:\WINMMBASE.DLL" "rundll32.exe" trying to access non-existent file "C:\WINMMBASE.dll" "rundll32.exe" trying to access non-existent file "C:\Windows\SysWOW64\HDPGMS.DLL"61:T59a,"rundll32.exe" trying to access non-existent file "C:\C5E82FCA91A7B8140781EECBE9F709E96EED638DEEA3ACD5F0CA35EF79A221C0.DLL.MANIFEST" "rundll32.exe" trying to access non-existent file "C:\c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll.manifest" "rundll32.exe" trying to access non-existent file "C:\C5E82FCA91A7B8140781EECBE9F709E96EED638DEEA3ACD5F0CA35EF79A221C0.DLL.123.MANIFEST" "rundll32.exe" trying to access non-existent file "C:\C5E82FCA91A7B8140781EECBE9F709E96EED638DEEA3ACD5F0CA35EF79A221C0.DLL.124.MANIFEST" "rundll32.exe" trying to access non-existent file "C:\Windows\SysWOW64\RUNDLL32.EXE.LOCAL" "rundll32.exe" trying to access non-existent file "C:\WINDOWS\SysWOW64\rundll32.exe.Local\" "rundll32.exe" trying to access non-existent file "C:\ProgramData\NVCONTAINER.SESSION.{F1E59978-E49F-4ADA-BEB7-DAF9D36905D6}" "rundll32.exe" trying to access non-existent file "C:\ProgramData\NvContainer.Session.{F1E59978-E49F-4ADA-BEB7-DAF9D36905D6}" "rundll32.exe" trying to access non-existent file "C:\ProgramData\NVCONTAINER.SESSION.{FB6A8D0A-A463-482E-9894-6E22443FE51D}" "rundll32.exe" trying to access non-existent file "C:\ProgramData\NvContainer.Session.{FB6A8D0A-A463-482E-9894-6E22443FE51D}" "rundll32.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\S-1-5-21-735145574-3570218355-1207367261" "rundll32.exe" trying to access non-existent file "\Device\RasAcd"62:Tde9,"rundll32.exe" writes file "c:\programdata\nvcontainer.session.{f1e59978-e49f-4ada-beb7-daf9d36905d6}\nvcontainersession.nvi.pif\nvdisplay.container.nvi.exe" "rundll32.exe" writes file "%allusersprofile%\nvcontainer.session.{f1e59978-e49f-4ada-beb7-daf9d36905d6}\nvcontainersession.nvi.pif\nvdisplay.container.nvi.exe" "rundll32.exe" writes file "c:\programdata\nvcontainer.session.{fb6a8d0a-a463-482e-9894-6e22443fe51d}\nvcontainersession.nvi.pif\nvdisplay.container.nvi.exe" "rundll32.exe" writes file "c:\users\%osuser%\appdata\local\temp\s-1-5-21-735145574-3570218355-1207367261\s-1-5-21-735145574-3570218355-1207367261.exe" "rundll32.exe" writes file "c:\users\%osuser%\appdata\local\temp\s-1-5-21-735145574-3570218355-1207367261\s-1-5-21-735145574-3570218355-1207367261.cmd.ini" "rundll32.exe" writes file "c:\users\%osuser%\appdata\local\temp\s-1-5-21-735145574-3570218355-1207367261\s-1-5-21-735145574-3570218355-1207367261.cmd" "rundll32.exe" writes file "%allusersprofile%\nvcontainer.session.{fb6a8d0a-a463-482e-9894-6e22443fe51d}\nvcontainersession.nvi.pif\nvdisplay.container.nvi.exe" "rundll32.exe" writes file "%temp%\s-1-5-21-735145574-3570218355-1207367261\s-1-5-21-735145574-3570218355-1207367261.exe" "rundll32.exe" writes file "%temp%\s-1-5-21-735145574-3570218355-1207367261\s-1-5-21-735145574-3570218355-1207367261.cmd.ini" "rundll32.exe" writes file "%temp%\s-1-5-21-735145574-3570218355-1207367261\s-1-5-21-735145574-3570218355-1207367261.cmd" "rundll32.exe" writes file "c:\programdata\nvcontainer.session.{76d42e9e-e502-47c9-8364-abd9318c6752}\nvcontainersession.nvi.pif\nvdisplay.container.nvi.exe" "rundll32.exe" writes file "%allusersprofile%\nvcontainer.session.{76d42e9e-e502-47c9-8364-abd9318c6752}\nvcontainersession.nvi.pif\nvdisplay.container.nvi.exe" "rundll32.exe" writes file "c:\programdata\nvcontainer.session.{2d091fb6-3601-4e2c-8da0-957318afdef0}\nvcontainersession.nvi.pif\nvdisplay.container.nvi.exe" "rundll32.exe" writes file "%allusersprofile%\nvcontainer.session.{2d091fb6-3601-4e2c-8da0-957318afdef0}\nvcontainersession.nvi.pif\nvdisplay.container.nvi.exe" "rundll32.exe" writes file "c:\programdata\nvcontainer.session.{de2f907c-64b8-4c9d-bb22-cba153708d41}\nvcontainersession.nvi.pif\nvdisplay.container.nvi.exe" "rundll32.exe" writes file "%allusersprofile%\nvcontainer.session.{de2f907c-64b8-4c9d-bb22-cba153708d41}\nvcontainersession.nvi.pif\nvdisplay.container.nvi.exe" "rundll32.exe" writes file "c:\programdata\nvcontainer.session.{b43c0f53-c23a-4af6-a7e1-51628c9aa0eb}\nvcontainersession.nvi.pif\nvdisplay.container.nvi.exe" "rundll32.exe" writes file "%allusersprofile%\nvcontainer.session.{b43c0f53-c23a-4af6-a7e1-51628c9aa0eb}\nvcontainersession.nvi.pif\nvdisplay.container.nvi.exe" "rundll32.exe" writes file "c:\programdata\nvcontainer.session.{aeb845d3-164b-42df-967f-e5812befa07c}\nvcontainersession.nvi.pif\nvdisplay.container.nvi.exe" "rundll32.exe" writes file "%allusersprofile%\nvcontainer.session.{aeb845d3-164b-42df-967f-e5812befa07c}\nvcontainersession.nvi.pif\nvdisplay.container.nvi.exe" "rundll32.exe" writes file "c:\programdata\nvcontainer.session.{eca141cf-9dd5-458a-b577-7f397c35a510}\nvcontainersession.nvi.pif\nvdisplay.container.nvi.exe" "rundll32.exe" writes file "%allusersprofile%\nvcontainer.session.{eca141cf-9dd5-458a-b577-7f397c35a510}\nvcontainersession.nvi.pif\nvdisplay.container.nvi.exe" "rundll32.exe" writes file "c:\programdata\nvcontainer.session.{bffc80e0-8127-466a-9a65-ac60551db29d}\nvcontainersession.nvi.pif\nvdisplay.container.nvi.exe"63:T8bc,Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "CreateDCW" (Indicator: "CreateDC"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "BitBlt" (Indicator: "BitBlt"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "GetDC" (Indicator: "GetDC"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "CreateDCW" (Indicator: "CreateDC"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp")64:T647,Found registry query API: "RegEnumValueW" in file "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll" Found registry query API: "RegQueryValueW" in file "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll" Found registry query API: "RegEnumKeyExW" in file "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll" Found registry query API: "RegQueryValueExW" in file "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll" Found registry query API: "RegOpenKeyExW" in file "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll" Found registry query API: "RegEnumKeyW" in file "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll" Found registry query API: "RegOpenKeyTransactedW" in file "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll" Found registry query API: "RegOpenKeyTransactedW" in "00000000-00004828.00000000.213750.72B79000.00000002.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00004828.00000000.213750.72B79000.00000002.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00004828.00000000.213750.72B79000.00000002.mdmp" Found registry query API: "RegEnumKeyW" in "00000000-00004828.00000000.213750.72B79000.00000002.mdmp" Found registry query API: "RegQueryValueW" in "00000000-00004828.00000000.213750.72B79000.00000002.mdmp" Found registry query API: "RegEnumKeyExW" in "00000000-00004828.00000000.213750.72B79000.00000002.mdmp" Found registry query API: "RegEnumValueW" in "00000000-00004828.00000000.213750.72B79000.00000002.mdmp"65:T6c4,Found reference to API "GetKeyNameTextW" (Indicator: "GetKeyNameText"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "GetAsyncKeyState" (Indicator: "GetAsyncKeyState"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "MapVirtualKeyExW" (Indicator: "MapVirtualKey"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "MapVirtualKeyW" (Indicator: "MapVirtualKey"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "GetKeyNameTextW" (Indicator: "GetKeyNameText"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "MapVirtualKeyW" (Indicator: "MapVirtualKey"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "GetAsyncKeyState" (Indicator: "GetAsyncKeyState"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "MapVirtualKeyExW" (Indicator: "MapVirtualKey"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp")66:T8ae,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "NtQueryInformationToken" (Indicator: "NtQueryInformationToken"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00001332.00000000.214146.00610000.00000004.mdmp") Found reference to API "NtQueryInformationToken" (Indicator: "NtQueryInformationToken"; Source: "00000000-00001332.00000000.214146.00610000.00000004.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00002568.00000000.214499.00920000.00000004.mdmp") Found reference to API "NtQueryInformationToken" (Indicator: "NtQueryInformationToken"; Source: "00000000-00002568.00000000.214499.00920000.00000004.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00004828.00000000.213750.02E20000.00000004.mdmp") Found reference to API "NtQueryInformationToken" (Indicator: "NtQueryInformationToken"; Source: "00000000-00004828.00000000.213750.02E20000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00004972.00000001.214568.00B49000.00000002.mdmp") Found reference to API "NtQueryInformationToken" (Indicator: "NtQueryInformationToken"; Source: "00000000-00004972.00000001.214568.00B49000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00006368.00000000.213748.02FD0000.00000004.mdmp") Found reference to API "NtQueryInformationToken" (Indicator: "NtQueryInformationToken"; Source: "00000000-00006368.00000000.213748.02FD0000.00000004.mdmp")67:Tf8c,Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "Process32NextW" (Indicator: "Process32Next"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "Process32FirstW" (Indicator: "Process32First"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00001332.00000000.214146.00610000.00000004.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00001332.00000000.214146.00610000.00000004.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00001332.00000000.214146.00610000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001332.00000000.214146.00610000.00000004.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002568.00000000.214499.00920000.00000004.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00002568.00000000.214499.00920000.00000004.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00002568.00000000.214499.00920000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002568.00000000.214499.00920000.00000004.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00004828.00000000.213750.02E20000.00000004.mdmp, 00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00004828.00000000.213750.02E20000.00000004.mdmp, 00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00004828.00000000.213750.02E20000.00000004.mdmp, 00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004828.00000000.213750.02E20000.00000004.mdmp, 00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "Process32FirstW" (Indicator: "Process32First"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp")68:T860,Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00001332.00000000.214146.00610000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001332.00000000.214146.00610000.00000004.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00002568.00000000.214499.00920000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002568.00000000.214499.00920000.00000004.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00004828.00000000.213750.02E20000.00000004.mdmp, 00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004828.00000000.213750.02E20000.00000004.mdmp, 00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00004972.00000001.214568.00B49000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004972.00000001.214568.00B49000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00006368.00000000.213748.02FD0000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00006368.00000000.213748.02FD0000.00000004.mdmp")69:Tf44,Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "PathFindFileNameW" (Indicator: "PathFindFileName"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "GetFileAttributesTransactedW" (Indicator: "GetFileAttributes"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00001332.00000000.214146.00610000.00000004.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00001332.00000000.214146.00610000.00000004.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00002568.00000000.214499.00920000.00000004.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00002568.00000000.214499.00920000.00000004.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00004828.00000000.213750.02E20000.00000004.mdmp, 00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00004828.00000000.213750.02E20000.00000004.mdmp, 00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "GetFileAttributesTransactedW" (Indicator: "GetFileAttributes"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp")6a:T4a2,Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00001332.00000000.214146.00610000.00000004.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00002568.00000000.214499.00920000.00000004.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00004828.00000000.213750.02E20000.00000004.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00004972.00000001.214568.00B49000.00000002.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00006368.00000000.213748.02FD0000.00000004.mdmp")6b:T488,Found reference to API "GetTickCount" (Indicator: "GetTickCount"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "GetTickCount64" (Indicator: "GetTickCount"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "GetTickCount" (Indicator: "GetTickCount"; Source: "00000000-00001332.00000000.214146.00610000.00000004.mdmp") Found reference to API "GetTickCount" (Indicator: "GetTickCount"; Source: "00000000-00002568.00000000.214499.00920000.00000004.mdmp") Found reference to API "GetTickCount" (Indicator: "GetTickCount"; Source: "00000000-00004828.00000000.213750.02E20000.00000004.mdmp, 00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "GetTickCount" (Indicator: "GetTickCount"; Source: "00000000-00004972.00000001.214568.00B49000.00000002.mdmp") Found reference to API "GetTickCount" (Indicator: "GetTickCount"; Source: "00000000-00006368.00000000.213748.02FD0000.00000004.mdmp")6c:T4aa,Found registry deletion API: "RegDeleteValueW" in file "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll" Found registry deletion API: "RegDeleteKeyW" in file "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll" Found registry deletion API: "RegDeleteTreeW" in file "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll" Found registry deletion API: "RegDeleteKeyTransactedW" in file "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll" Found registry deletion API: "RegDeleteKeyExW" in file "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll" Found registry deletion API: "RegDeleteKeyTransactedW" in "00000000-00004828.00000000.213750.72B79000.00000002.mdmp" Found registry deletion API: "rRegDeleteKeyExW" in "00000000-00004828.00000000.213750.72B79000.00000002.mdmp" Found registry deletion API: "RegDeleteValueW" in "00000000-00004828.00000000.213750.72B79000.00000002.mdmp" Found registry deletion API: "RegDeleteTreeW" in "00000000-00004828.00000000.213750.72B79000.00000002.mdmp" Found registry deletion API: "RegDeleteKeyW" in "00000000-00004828.00000000.213750.72B79000.00000002.mdmp"6d:Tfc7,Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00000612.00000000.214135.00750000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00000612.00000000.214135.00750000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\SysWOW64\rundll32.exe" (Indicator: "\Device\"; Source: "00000000-00000612.00000000.214135.00750000.00000004.mdmp, 00000000-00000612.00000001.214173.00750000.00000004.mdmp") Found string "INDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00000612.00000001.214173.00750000.00000004.mdmp") Found string "INDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00000612.00000001.214173.00750000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00001332.00000000.214146.00610000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00001332.00000000.214146.00610000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\SysWOW64\rundll32.exe" (Indicator: "\Device\"; Source: "00000000-00001332.00000000.214146.00610000.00000004.mdmp, 00000000-00001332.00000001.214176.00610000.00000004.mdmp") Found string "INDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00001332.00000001.214176.00610000.00000004.mdmp") Found string "INDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00001332.00000001.214176.00610000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00002188.00000000.214900.03150000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00002188.00000000.214900.03150000.00000004.mdmp") Found string "NDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00002188.00000001.215057.03150000.00000004.mdmp") Found string "NDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00002188.00000001.215057.03150000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\SysWOW64\rundll32.exe" (Indicator: "\Device\"; Source: "00000000-00002568.00000000.214499.00920000.00000004.mdmp, 00000000-00002568.00000001.214581.00920000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00002568.00000000.214499.00920000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00002568.00000000.214499.00920000.00000004.mdmp") Found string "INDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00002568.00000001.214581.00920000.00000004.mdmp") Found string "INDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00002568.00000001.214581.00920000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00002976.00000000.214138.008F0000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00002976.00000000.214138.008F0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\SysWOW64\rundll32.exe" (Indicator: "\Device\"; Source: "00000000-00002976.00000000.214138.008F0000.00000004.mdmp, 00000000-00002976.00000001.214173.008F0000.00000004.mdmp") Found string "INDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00002976.00000001.214173.008F0000.00000004.mdmp") Found string "INDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00002976.00000001.214173.008F0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00004828.00000000.213750.02E20000.00000004.mdmp")6e:T700,Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "SetFileSecurityW" (Indicator: "SetFileSecurityW"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "GetFileSecurityW" (Indicator: "GetFileSecurityW"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "GetFileSecurityW" (Indicator: "GetFileSecurityW"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "SetFileSecurityW" (Indicator: "SetFileSecurityW"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp")6f:T818,Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00001332.00000000.214146.00610000.00000004.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00001332.00000000.214146.00610000.00000004.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002568.00000000.214499.00920000.00000004.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00002568.00000000.214499.00920000.00000004.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00004828.00000000.213750.02E20000.00000004.mdmp, 00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00004828.00000000.213750.02E20000.00000004.mdmp, 00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00004972.00000001.214568.00B49000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00004972.00000001.214568.00B49000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00006368.00000000.213748.02FD0000.00000004.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00006368.00000000.213748.02FD0000.00000004.mdmp")70:T581,Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll] Observed import api "CheckTokenMembership" which can "determine whether a specified security identifier (SID) is enabled in an access token" [Source: c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll] Observed import api "GetFileSecurityW" which can "obtain specified information about the security of a file or directory" [Source: c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll] Observed import api "SetFileSecurityW" which can "set the security of a file or directory object" [Source: c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll]71:T9ba,"rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000009"; Key: "PACKEDCATALOGITEM"; Value: "")72:T782,Found reference to API "CreateMutexW" (Indicator: "CreateMutex"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "CreateMutexExW" (Indicator: "CreateMutex"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "ReleaseMutex" (Indicator: "ReleaseMutex"; File: "c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll") Found reference to API "ReleaseMutex" (Indicator: "ReleaseMutex"; Source: "00000000-00001332.00000000.214146.00610000.00000004.mdmp") Found reference to API "CreateMutexExW" (Indicator: "CreateMutex"; Source: "00000000-00001332.00000000.214146.00610000.00000004.mdmp") Found reference to API "ReleaseMutex" (Indicator: "ReleaseMutex"; Source: "00000000-00002568.00000000.214499.00920000.00000004.mdmp") Found reference to API "CreateMutexExW" (Indicator: "CreateMutex"; Source: "00000000-00002568.00000000.214499.00920000.00000004.mdmp") Found reference to API "ReleaseMutex" (Indicator: "ReleaseMutex"; Source: "00000000-00004828.00000000.213750.02E20000.00000004.mdmp") Found reference to API "CreateMutexExW" (Indicator: "CreateMutex"; Source: "00000000-00004828.00000000.213750.02E20000.00000004.mdmp") Found reference to API "CreateMutexW" (Indicator: "CreateMutex"; Source: "00000000-00004828.00000000.213750.72B79000.00000002.mdmp") Found reference to API "ReleaseMutex" (Indicator: "ReleaseMutex"; Source: "00000000-00004972.00000001.214568.00B49000.00000002.mdmp") Found reference to API "CreateMutexExW" (Indicator: "CreateMutex"; Source: "00000000-00004972.00000001.214568.00B49000.00000002.mdmp") Found reference to API "ReleaseMutex" (Indicator: "ReleaseMutex"; Source: "00000000-00006368.00000000.213748.02FD0000.00000004.mdmp") Found reference to API "CreateMutexExW" (Indicator: "CreateMutex"; Source: "00000000-00006368.00000000.213748.02FD0000.00000004.mdmp")73:Td38,"NVDisplay.Container.nvi.exe" has type "PE32 executable for MS Windows 10.00 (GUI) Intel i386 6 sections"- Location: [%ALLUSERSPROFILE%\NvContainer.Session.{BFFC80E0-8127-466A-9A65-AC60551DB29D}\nvcontainersession.nvi.pif\NVDisplay.Container.nvi.exe]- [targetUID: 00000000-00002976] "NVDisplay.Container.nvi.exe" has type "PE32 executable for MS Windows 10.00 (GUI) Intel i386 6 sections"- Location: [%ALLUSERSPROFILE%\NvContainer.Session.{2D091FB6-3601-4E2C-8DA0-957318AFDEF0}\nvcontainersession.nvi.pif\NVDisplay.Container.nvi.exe]- [targetUID: 00000000-00002976] "NVDisplay.Container.nvi.exe" has type "PE32 executable for MS Windows 10.00 (GUI) Intel i386 6 sections"- Location: [%ALLUSERSPROFILE%\NvContainer.Session.{AEB845D3-164B-42DF-967F-E5812BEFA07C}\nvcontainersession.nvi.pif\NVDisplay.Container.nvi.exe]- [targetUID: 00000000-00002976] "NVDisplay.Container.nvi.exe" has type "PE32 executable for MS Windows 10.00 (GUI) Intel i386 6 sections"- Location: [%ALLUSERSPROFILE%\NvContainer.Session.{C9A6A134-A801-48BB-9CD1-A2AAC8D0CE62}\nvcontainersession.nvi.pif\NVDisplay.Container.nvi.exe]- [targetUID: 00000000-00002976] "NVDisplay.Container.nvi.exe" has type "PE32 executable for MS Windows 10.00 (GUI) Intel i386 6 sections"- Location: [%ALLUSERSPROFILE%\NvContainer.Session.{B43C0F53-C23A-4AF6-A7E1-51628C9AA0EB}\nvcontainersession.nvi.pif\NVDisplay.Container.nvi.exe]- [targetUID: 00000000-00002976] "NVDisplay.Container.nvi.exe" has type "PE32 executable for MS Windows 10.00 (GUI) Intel i386 6 sections"- Location: [%ALLUSERSPROFILE%\NvContainer.Session.{FB6A8D0A-A463-482E-9894-6E22443FE51D}\nvcontainersession.nvi.pif\NVDisplay.Container.nvi.exe]- [targetUID: 00000000-00002976] "NVDisplay.Container.nvi.exe" has type "PE32 executable for MS Windows 10.00 (GUI) Intel i386 6 sections"- Location: [%ALLUSERSPROFILE%\NvContainer.Session.{F1E59978-E49F-4ADA-BEB7-DAF9D36905D6}\nvcontainersession.nvi.pif\NVDisplay.Container.nvi.exe]- [targetUID: 00000000-00002976] "NVDisplay.Container.nvi.exe" has type "PE32 executable for MS Windows 10.00 (GUI) Intel i386 6 sections"- Location: [%ALLUSERSPROFILE%\NvContainer.Session.{76302604-3989-448B-B2FC-1D27F1533A08}\nvcontainersession.nvi.pif\NVDisplay.Container.nvi.exe]- [targetUID: 00000000-00002976] "NVDisplay.Container.nvi.exe" has type "PE32 executable for MS Windows 10.00 (GUI) Intel i386 6 sections"- Location: [%ALLUSERSPROFILE%\NvContainer.Session.{76D42E9E-E502-47C9-8364-ABD9318C6752}\nvcontainersession.nvi.pif\NVDisplay.Container.nvi.exe]- [targetUID: 00000000-00002976] "NVDisplay.Container.nvi.exe" has type "PE32 executable for MS Windows 10.00 (GUI) Intel i386 6 sections"- Location: [%ALLUSERSPROFILE%\NvContainer.Session.{DE2F907C-64B8-4C9D-BB22-CBA153708D41}\nvcontainersession.nvi.pif\NVDisplay.Container.nvi.exe]- [targetUID: 00000000-00002976] "NVDisplay.Container.nvi.exe" has type "PE32 executable for MS Windows 10.00 (GUI) Intel i386 6 sections"- Location: [%ALLUSERSPROFILE%\NvContainer.Session.{ECA141CF-9DD5-458A-B577-7F397C35A510}\nvcontainersession.nvi.pif\NVDisplay.Container.nvi.exe]- [targetUID: 00000000-00002976] "S-1-5-21-735145574-3570218355-1207367261.eXe" has type "PE32 executable for MS Windows 10.00 (GUI) Intel i386 6 sections"- Location: [%TEMP%\S-1-5-21-735145574-3570218355-1207367261\S-1-5-21-735145574-3570218355-1207367261.eXe]- [targetUID: 00000000-00008384]74:T15f4,"rundll32.exe" wrote 63488 bytes starting with PE header signature to file "C:\ProgramData\NvContainer.Session.{F1E59978-E49F-4ADA-BEB7-DAF9D36905D6}\nvcontainersession.nvi.pif\NVDisplay.Container.nvi.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "rundll32.exe" wrote 63488 bytes starting with PE header signature to file "C:\ProgramData\NvContainer.Session.{FB6A8D0A-A463-482E-9894-6E22443FE51D}\nvcontainersession.nvi.pif\NVDisplay.Container.nvi.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "rundll32.exe" wrote 63488 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\S-1-5-21-735145574-3570218355-1207367261\S-1-5-21-735145574-3570218355-1207367261.eXe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "rundll32.exe" wrote 63488 bytes starting with PE header signature to file "C:\ProgramData\NvContainer.Session.{76D42E9E-E502-47C9-8364-ABD9318C6752}\nvcontainersession.nvi.pif\NVDisplay.Container.nvi.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "rundll32.exe" wrote 63488 bytes starting with PE header signature to file "C:\ProgramData\NvContainer.Session.{2D091FB6-3601-4E2C-8DA0-957318AFDEF0}\nvcontainersession.nvi.pif\NVDisplay.Container.nvi.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "rundll32.exe" wrote 63488 bytes starting with PE header signature to file "C:\ProgramData\NvContainer.Session.{DE2F907C-64B8-4C9D-BB22-CBA153708D41}\nvcontainersession.nvi.pif\NVDisplay.Container.nvi.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "rundll32.exe" wrote 63488 bytes starting with PE header signature to file "C:\ProgramData\NvContainer.Session.{B43C0F53-C23A-4AF6-A7E1-51628C9AA0EB}\nvcontainersession.nvi.pif\NVDisplay.Container.nvi.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "rundll32.exe" wrote 63488 bytes starting with PE header signature to file "C:\ProgramData\NvContainer.Session.{AEB845D3-164B-42DF-967F-E5812BEFA07C}\nvcontainersession.nvi.pif\NVDisplay.Container.nvi.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "rundll32.exe" wrote 63488 bytes starting with PE header signature to file "C:\ProgramData\NvContainer.Session.{ECA141CF-9DD5-458A-B577-7F397C35A510}\nvcontainersession.nvi.pif\NVDisplay.Container.nvi.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "rundll32.exe" wrote 63488 bytes starting with PE header signature to file "C:\ProgramData\NvContainer.Session.{BFFC80E0-8127-466A-9A65-AC60551DB29D}\nvcontainersession.nvi.pif\NVDisplay.Container.nvi.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "rundll32.exe" wrote 63488 bytes starting with PE header signature to file "C:\ProgramData\NvContainer.Session.{C9A6A134-A801-48BB-9CD1-A2AAC8D0CE62}\nvcontainersession.nvi.pif\NVDisplay.Container.nvi.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "rundll32.exe" wrote 63488 bytes starting with PE header signature to file "C:\ProgramData\NvContainer.Session.{76302604-3989-448B-B2FC-1D27F1533A08}\nvcontainersession.nvi.pif\NVDisplay.Container.nvi.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...75:T412,SystemParametersInfoW@USER32.dll at 16558-12072-10023890 SystemParametersInfoW@USER32.dll at 16558-12089-10023655 SystemParametersInfoW@USER32.dll at 16558-13127-10074B77 SystemParametersInfoW@USER32.dll at 16558-14721-1007308F SystemParametersInfoW@USER32.dll at 16558-14783-1004F68A SystemParametersInfoW@USER32.dll at 16558-14902-1005452E SystemParametersInfoW@USER32.dll at 16558-14923-100D345C SystemParametersInfoW@USER32.dll at 16558-15274-101232D5 SystemParametersInfoW@USER32.dll at 16558-15460-1007553D SystemParametersInfoW@USER32.dll at 16558-16590-100CDCAA SystemParametersInfoW@USER32.dll at 16558-16955-100E3715 SystemParametersInfoW@USER32.dll at 16558-17453-10104194 SystemParametersInfoW@USER32.dll at 16558-18210-1013B60F SystemParametersInfoW@USER32.dll at 16558-18292-1015DBC1 SystemParametersInfoW@USER32.dll at 16558-20509-100638E9 SystemParametersInfoW@USER32.dll at 16558-21384-100AD434 SystemParametersInfoW@USER32.dll at 16558-21596-1010E37A SystemParametersInfoW@USER32.dll at 16558-41885-10048BD476:T4ef,GetKeyState@USER32.dll at 16558-13495-10018102 GetAsyncKeyState@USER32.dll at 16558-14193-10033766 GetKeyState@USER32.dll at 16558-14218-10077684 GetAsyncKeyState@USER32.dll at 16558-14295-100C8950 GetKeyboardState@USER32.dll at 16558-14298-100C82BD MapVirtualKeyExW@USER32.dll at 16558-14356-10159A88 GetAsyncKeyState@USER32.dll at 16558-14444-10044A0E GetAsyncKeyState@USER32.dll at 16558-14489-100465A2 GetAsyncKeyState@USER32.dll at 16558-14496-10046F85 GetAsyncKeyState@USER32.dll at 16558-14708-10073FB3 GetAsyncKeyState@USER32.dll at 16558-14714-1004ECF2 GetKeyState@USER32.dll at 16558-14811-1004FAB5 GetAsyncKeyState@USER32.dll at 16558-14815-1007427C GetKeyState@USER32.dll at 16558-14826-10072654 GetKeyState@USER32.dll at 16558-14827-101173A4 GetAsyncKeyState@USER32.dll at 16558-14872-100533C5 GetKeyState@USER32.dll at 16558-14885-1010247C GetKeyState@USER32.dll at 16558-15237-100658B7 GetKeyState@USER32.dll at 16558-15268-100678C7 GetKeyState@USER32.dll at 16558-15332-1006ADFB GetKeyState@USER32.dll at 16558-15498-1007921E GetKeyState@USER32.dll at 16558-16021-100A7997 GetKeyState@USER32.dll at 16558-16030-100A83D2 GetAsyncKeyState@USER32.dll at 16558-16294-100B72AF GetAsyncKeyState@USER32.dll at 16558-16400-100BFE1D77:T4d7,RegCreateKeyW CreateServiceW RegDeleteValueW RegEnumKeyExW RegCloseKey RegCreateKeyExW OpenProcessToken RegDeleteKeyW RegOpenKeyExW RegEnumKeyW StartServiceW GetTempPathW LoadLibraryExW CreateProcessW DeviceIoControl CreateFileMappingW WriteFile OutputDebugStringA DeleteFileW WriteProcessMemory LoadLibraryW VirtualProtect Sleep GetModuleFileNameW LoadLibraryA GetModuleHandleA CreateToolhelp32Snapshot OutputDebugStringW GetVersionExW GetFileAttributesExW GetFileSizeEx FindResourceExW GetModuleHandleExW MapViewOfFile ExitThread GetFileSize GetModuleHandleW FindFirstFileW GetProcAddress CopyFileW GetSystemDirectoryW CreateDirectoryW FindResourceW Process32NextW FindFirstFileExW GetSystemInfo GetFileAttributesW GetTempFileNameW Process32FirstW UnhandledExceptionFilter IsDebuggerPresent GetTickCount GetCommandLineA TerminateProcess CreateThread GetStartupInfoW FindNextFileW LockResource VirtualAlloc CreateFileW GetCommandLineW ShellExecuteW ShellExecuteExW GetUpdateRect GetCursorPos GetWindowThreadProcessId SetWindowsHookExW GetLastActivePopup WSAStartup send closesocket recv connect socket CreateFileMoniker GetModuleFileNameA NtQueryInformationToken78:T9bf,File type "PE32 executable for MS Windows 10.00 (GUI) Intel i386 6 sections" was dropped at "%ALLUSERSPROFILE%\NvContainer.Session.{BFFC80E0-8127-466A-9A65-AC60551DB29D}\nvcontainersession.nvi.pif\NVDisplay.Container.nvi.exe" File type "PE32 executable for MS Windows 10.00 (GUI) Intel i386 6 sections" was dropped at "%ALLUSERSPROFILE%\NvContainer.Session.{2D091FB6-3601-4E2C-8DA0-957318AFDEF0}\nvcontainersession.nvi.pif\NVDisplay.Container.nvi.exe" File type "PE32 executable for MS Windows 10.00 (GUI) Intel i386 6 sections" was dropped at "%ALLUSERSPROFILE%\NvContainer.Session.{AEB845D3-164B-42DF-967F-E5812BEFA07C}\nvcontainersession.nvi.pif\NVDisplay.Container.nvi.exe" File type "PE32 executable for MS Windows 10.00 (GUI) Intel i386 6 sections" was dropped at "%ALLUSERSPROFILE%\NvContainer.Session.{C9A6A134-A801-48BB-9CD1-A2AAC8D0CE62}\nvcontainersession.nvi.pif\NVDisplay.Container.nvi.exe" File type "PE32 executable for MS Windows 10.00 (GUI) Intel i386 6 sections" was dropped at "%ALLUSERSPROFILE%\NvContainer.Session.{B43C0F53-C23A-4AF6-A7E1-51628C9AA0EB}\nvcontainersession.nvi.pif\NVDisplay.Container.nvi.exe" File type "PE32 executable for MS Windows 10.00 (GUI) Intel i386 6 sections" was dropped at "%ALLUSERSPROFILE%\NvContainer.Session.{FB6A8D0A-A463-482E-9894-6E22443FE51D}\nvcontainersession.nvi.pif\NVDisplay.Container.nvi.exe" File type "PE32 executable for MS Windows 10.00 (GUI) Intel i386 6 sections" was dropped at "%ALLUSERSPROFILE%\NvContainer.Session.{F1E59978-E49F-4ADA-BEB7-DAF9D36905D6}\nvcontainersession.nvi.pif\NVDisplay.Container.nvi.exe" File type "PE32 executable for MS Windows 10.00 (GUI) Intel i386 6 sections" was dropped at "%ALLUSERSPROFILE%\NvContainer.Session.{76302604-3989-448B-B2FC-1D27F1533A08}\nvcontainersession.nvi.pif\NVDisplay.Container.nvi.exe" File type "PE32 executable for MS Windows 10.00 (GUI) Intel i386 6 sections" was dropped at "%ALLUSERSPROFILE%\NvContainer.Session.{76D42E9E-E502-47C9-8364-ABD9318C6752}\nvcontainersession.nvi.pif\NVDisplay.Container.nvi.exe" File type "PE32 executable for MS Windows 10.00 (GUI) Intel i386 6 sections" was dropped at "%ALLUSERSPROFILE%\NvContainer.Session.{DE2F907C-64B8-4C9D-BB22-CBA153708D41}\nvcontainersession.nvi.pif\NVDisplay.Container.nvi.exe" File type "PE32 executable for MS Windows 10.00 (GUI) Intel i386 6 sections" was dropped at "%ALLUSERSPROFILE%\NvContainer.Session.{ECA141CF-9DD5-458A-B577-7F397C35A510}\nvcontainersession.nvi.pif\NVDisplay.Container.nvi.exe"79:T400,AAABAAEAICAQRgAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAIiIiIiIiIiIiIiIAAAAAAiIiIiI///4iIiIiIAAAACHiIiP+IiI+I+IiIiIAAAIiIiP+IiIiPiIiIiIiIAAg4iI+Pj4iIiI+Ij/iIh4CIiIiPj/iIiIiIiI+IiIiIiIiPiPiI/4iI/4iIiPiIiIiI+IiI+HdmZnePiPiIiIiIj4iIj3ZmZmZmd/iIiPiIeI+IiPdndniHd3Z/iIj4iIj4iIh3d2f/+Hd3Z/iP/4iI+IiId3d3//93d3aIiI+IiIiIh3dn+HeI/3d3f4j/iIiIiIeIZoiIh4hmd3iIiPiP+Ih4dmeH/4d4dmd4iP/4j/+Ih2ePhnd3ePh3eIj/+I//iId4/4d3d3j/h2iI//iP/4iHj/93d3d3//h4iP/4j/+I+P+Hd3d3d3j/j4j/+IiIiP//d4d4h3d3//+IiIiI+IiP93hmaPdmhn/4iI+IiP/4j4d3Znj3ZoZ4+PiIiIiIiPh2eGZ3dmaHZ4//+IiIj/+HZndmZmZmeHd4j/iIiIj/d3j4dmZmZ4+IiIiIeIiIj4iIiPiIiI+Ij4j4iIiIiI/4iIiIiIiIiIiIiIiICIiIiIiIiIiIiIiI+IiIgACIiIj4+IiIj4iI/4iIiAAAeIiIiPj4+IiPj4iIiIcAAACIiIiIj///iIiIiIgAAAAACIiIiIiIiIiIiIiAAAD4AAAf4AAAB8AAAAOAAAABgAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAABgAAAAcAAAAPgAAAH+AAAHw==7a:T400,AAABAAEAICAQRgAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAIiIiIiIiIiIiIiIAAAAAAiIiIiI///4iIiIiIAAAACHiIiP+IiI+I+IiIiIAAAIiIiP+IiIiPiIiIiIiIAAg4iI+Pj4iIiI+Ij/iIh4CIiIiPj/iIiIiIiI+IiIiIiIiPiPiI/4iI/4iIiPiIiIiI+IiI+HdmZnePiPiIiIiIj4iIj3ZmZmZmd/iIiPiIeI+IiPdndniHd3Z/iIj4iIj4iIh3d2f/+Hd3Z/iP/4iI+IiId3d3//93d3aIiI+IiIiIh3dn+HeI/3d3f4j/iIiIiIeIZoiIh4hmd3iIiPiP+Ih4dmeH/4d4dmd4iP/4j/+Ih2ePhnd3ePh3eIj/+I//iId4/4d3d3j/h2iI//iP/4iHj/93d3d3//h4iP/4j/+I+P+Hd3d3d3j/j4j/+IiIiP//d4d4h3d3//+IiIiI+IiP93hmaPdmhn/4iI+IiP/4j4d3Znj3ZoZ4+PiIiIiIiPh2eGZ3dmaHZ4//+IiIj/+HZndmZmZmeHd4j/iIiIj/d3j4dmZmZ4+IiIiIeIiIj4iIiPiIiI+Ij4j4iIiIiI/4iIiIiIiIiIiIiIiICIiIiIiIiIiIiIiI+IiIgACIiIj4+IiIj4iI/4iIiAAAeIiIiPj4+IiPj4iIiIcAAACIiIiIj///iIiIiIgAAAAACIiIiIiIiIiIiIiAAAD4AAAf4AAAB8AAAAOAAAABgAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAABgAAAAcAAAAPgAAAH+AAAHw==7b:T400,AAABAAEAICAQRgAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAIiIiIiIiIiIiIiIAAAAAAiIiIiI///4iIiIiIAAAACHiIiP+IiI+I+IiIiIAAAIiIiP+IiIiPiIiIiIiIAAg4iI+Pj4iIiI+Ij/iIh4CIiIiPj/iIiIiIiI+IiIiIiIiPiPiI/4iI/4iIiPiIiIiI+IiI+HdmZnePiPiIiIiIj4iIj3ZmZmZmd/iIiPiIeI+IiPdndniHd3Z/iIj4iIj4iIh3d2f/+Hd3Z/iP/4iI+IiId3d3//93d3aIiI+IiIiIh3dn+HeI/3d3f4j/iIiIiIeIZoiIh4hmd3iIiPiP+Ih4dmeH/4d4dmd4iP/4j/+Ih2ePhnd3ePh3eIj/+I//iId4/4d3d3j/h2iI//iP/4iHj/93d3d3//h4iP/4j/+I+P+Hd3d3d3j/j4j/+IiIiP//d4d4h3d3//+IiIiI+IiP93hmaPdmhn/4iI+IiP/4j4d3Znj3ZoZ4+PiIiIiIiPh2eGZ3dmaHZ4//+IiIj/+HZndmZmZmeHd4j/iIiIj/d3j4dmZmZ4+IiIiIeIiIj4iIiPiIiI+Ij4j4iIiIiI/4iIiIiIiIiIiIiIiICIiIiIiIiIiIiIiI+IiIgACIiIj4+IiIj4iI/4iIiAAAeIiIiPj4+IiPj4iIiIcAAACIiIiIj///iIiIiIgAAAAACIiIiIiIiIiIiIiAAAD4AAAf4AAAB8AAAAOAAAABgAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAABgAAAAcAAAAPgAAAH+AAAHw==7c:T400,AAABAAEAICAQRgAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAIiIiIiIiIiIiIiIAAAAAAiIiIiI///4iIiIiIAAAACHiIiP+IiI+I+IiIiIAAAIiIiP+IiIiPiIiIiIiIAAg4iI+Pj4iIiI+Ij/iIh4CIiIiPj/iIiIiIiI+IiIiIiIiPiPiI/4iI/4iIiPiIiIiI+IiI+HdmZnePiPiIiIiIj4iIj3ZmZmZmd/iIiPiIeI+IiPdndniHd3Z/iIj4iIj4iIh3d2f/+Hd3Z/iP/4iI+IiId3d3//93d3aIiI+IiIiIh3dn+HeI/3d3f4j/iIiIiIeIZoiIh4hmd3iIiPiP+Ih4dmeH/4d4dmd4iP/4j/+Ih2ePhnd3ePh3eIj/+I//iId4/4d3d3j/h2iI//iP/4iHj/93d3d3//h4iP/4j/+I+P+Hd3d3d3j/j4j/+IiIiP//d4d4h3d3//+IiIiI+IiP93hmaPdmhn/4iI+IiP/4j4d3Znj3ZoZ4+PiIiIiIiPh2eGZ3dmaHZ4//+IiIj/+HZndmZmZmeHd4j/iIiIj/d3j4dmZmZ4+IiIiIeIiIj4iIiPiIiI+Ij4j4iIiIiI/4iIiIiIiIiIiIiIiICIiIiIiIiIiIiIiI+IiIgACIiIj4+IiIj4iI/4iIiAAAeIiIiPj4+IiPj4iIiIcAAACIiIiIj///iIiIiIgAAAAACIiIiIiIiIiIiIiAAAD4AAAf4AAAB8AAAAOAAAABgAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAABgAAAAcAAAAPgAAAH+AAAHw==7d:T400,AAABAAEAICAQRgAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAIiIiIiIiIiIiIiIAAAAAAiIiIiI///4iIiIiIAAAACHiIiP+IiI+I+IiIiIAAAIiIiP+IiIiPiIiIiIiIAAg4iI+Pj4iIiI+Ij/iIh4CIiIiPj/iIiIiIiI+IiIiIiIiPiPiI/4iI/4iIiPiIiIiI+IiI+HdmZnePiPiIiIiIj4iIj3ZmZmZmd/iIiPiIeI+IiPdndniHd3Z/iIj4iIj4iIh3d2f/+Hd3Z/iP/4iI+IiId3d3//93d3aIiI+IiIiIh3dn+HeI/3d3f4j/iIiIiIeIZoiIh4hmd3iIiPiP+Ih4dmeH/4d4dmd4iP/4j/+Ih2ePhnd3ePh3eIj/+I//iId4/4d3d3j/h2iI//iP/4iHj/93d3d3//h4iP/4j/+I+P+Hd3d3d3j/j4j/+IiIiP//d4d4h3d3//+IiIiI+IiP93hmaPdmhn/4iI+IiP/4j4d3Znj3ZoZ4+PiIiIiIiPh2eGZ3dmaHZ4//+IiIj/+HZndmZmZmeHd4j/iIiIj/d3j4dmZmZ4+IiIiIeIiIj4iIiPiIiI+Ij4j4iIiIiI/4iIiIiIiIiIiIiIiICIiIiIiIiIiIiIiI+IiIgACIiIj4+IiIj4iI/4iIiAAAeIiIiPj4+IiPj4iIiIcAAACIiIiIj///iIiIiIgAAAAACIiIiIiIiIiIiIiAAAD4AAAf4AAAB8AAAAOAAAABgAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAABgAAAAcAAAAPgAAAH+AAAHw==7e:T400,AAABAAEAICAQRgAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAIiIiIiIiIiIiIiIAAAAAAiIiIiI///4iIiIiIAAAACHiIiP+IiI+I+IiIiIAAAIiIiP+IiIiPiIiIiIiIAAg4iI+Pj4iIiI+Ij/iIh4CIiIiPj/iIiIiIiI+IiIiIiIiPiPiI/4iI/4iIiPiIiIiI+IiI+HdmZnePiPiIiIiIj4iIj3ZmZmZmd/iIiPiIeI+IiPdndniHd3Z/iIj4iIj4iIh3d2f/+Hd3Z/iP/4iI+IiId3d3//93d3aIiI+IiIiIh3dn+HeI/3d3f4j/iIiIiIeIZoiIh4hmd3iIiPiP+Ih4dmeH/4d4dmd4iP/4j/+Ih2ePhnd3ePh3eIj/+I//iId4/4d3d3j/h2iI//iP/4iHj/93d3d3//h4iP/4j/+I+P+Hd3d3d3j/j4j/+IiIiP//d4d4h3d3//+IiIiI+IiP93hmaPdmhn/4iI+IiP/4j4d3Znj3ZoZ4+PiIiIiIiPh2eGZ3dmaHZ4//+IiIj/+HZndmZmZmeHd4j/iIiIj/d3j4dmZmZ4+IiIiIeIiIj4iIiPiIiI+Ij4j4iIiIiI/4iIiIiIiIiIiIiIiICIiIiIiIiIiIiIiI+IiIgACIiIj4+IiIj4iI/4iIiAAAeIiIiPj4+IiPj4iIiIcAAACIiIiIj///iIiIiIgAAAAACIiIiIiIiIiIiIiAAAD4AAAf4AAAB8AAAAOAAAABgAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAABgAAAAcAAAAPgAAAH+AAAHw==7f:T400,AAABAAEAICAQRgAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAIiIiIiIiIiIiIiIAAAAAAiIiIiI///4iIiIiIAAAACHiIiP+IiI+I+IiIiIAAAIiIiP+IiIiPiIiIiIiIAAg4iI+Pj4iIiI+Ij/iIh4CIiIiPj/iIiIiIiI+IiIiIiIiPiPiI/4iI/4iIiPiIiIiI+IiI+HdmZnePiPiIiIiIj4iIj3ZmZmZmd/iIiPiIeI+IiPdndniHd3Z/iIj4iIj4iIh3d2f/+Hd3Z/iP/4iI+IiId3d3//93d3aIiI+IiIiIh3dn+HeI/3d3f4j/iIiIiIeIZoiIh4hmd3iIiPiP+Ih4dmeH/4d4dmd4iP/4j/+Ih2ePhnd3ePh3eIj/+I//iId4/4d3d3j/h2iI//iP/4iHj/93d3d3//h4iP/4j/+I+P+Hd3d3d3j/j4j/+IiIiP//d4d4h3d3//+IiIiI+IiP93hmaPdmhn/4iI+IiP/4j4d3Znj3ZoZ4+PiIiIiIiPh2eGZ3dmaHZ4//+IiIj/+HZndmZmZmeHd4j/iIiIj/d3j4dmZmZ4+IiIiIeIiIj4iIiPiIiI+Ij4j4iIiIiI/4iIiIiIiIiIiIiIiICIiIiIiIiIiIiIiI+IiIgACIiIj4+IiIj4iI/4iIiAAAeIiIiPj4+IiPj4iIiIcAAACIiIiIj///iIiIiIgAAAAACIiIiIiIiIiIiIiAAAD4AAAf4AAAB8AAAAOAAAABgAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAABgAAAAcAAAAPgAAAH+AAAHw==80:T400,AAABAAEAICAQRgAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAIiIiIiIiIiIiIiIAAAAAAiIiIiI///4iIiIiIAAAACHiIiP+IiI+I+IiIiIAAAIiIiP+IiIiPiIiIiIiIAAg4iI+Pj4iIiI+Ij/iIh4CIiIiPj/iIiIiIiI+IiIiIiIiPiPiI/4iI/4iIiPiIiIiI+IiI+HdmZnePiPiIiIiIj4iIj3ZmZmZmd/iIiPiIeI+IiPdndniHd3Z/iIj4iIj4iIh3d2f/+Hd3Z/iP/4iI+IiId3d3//93d3aIiI+IiIiIh3dn+HeI/3d3f4j/iIiIiIeIZoiIh4hmd3iIiPiP+Ih4dmeH/4d4dmd4iP/4j/+Ih2ePhnd3ePh3eIj/+I//iId4/4d3d3j/h2iI//iP/4iHj/93d3d3//h4iP/4j/+I+P+Hd3d3d3j/j4j/+IiIiP//d4d4h3d3//+IiIiI+IiP93hmaPdmhn/4iI+IiP/4j4d3Znj3ZoZ4+PiIiIiIiPh2eGZ3dmaHZ4//+IiIj/+HZndmZmZmeHd4j/iIiIj/d3j4dmZmZ4+IiIiIeIiIj4iIiPiIiI+Ij4j4iIiIiI/4iIiIiIiIiIiIiIiICIiIiIiIiIiIiIiI+IiIgACIiIj4+IiIj4iI/4iIiAAAeIiIiPj4+IiPj4iIiIcAAACIiIiIj///iIiIiIgAAAAACIiIiIiIiIiIiIiAAAD4AAAf4AAAB8AAAAOAAAABgAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAABgAAAAcAAAAPgAAAH+AAAHw==81:T400,AAABAAEAICAQRgAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAIiIiIiIiIiIiIiIAAAAAAiIiIiI///4iIiIiIAAAACHiIiP+IiI+I+IiIiIAAAIiIiP+IiIiPiIiIiIiIAAg4iI+Pj4iIiI+Ij/iIh4CIiIiPj/iIiIiIiI+IiIiIiIiPiPiI/4iI/4iIiPiIiIiI+IiI+HdmZnePiPiIiIiIj4iIj3ZmZmZmd/iIiPiIeI+IiPdndniHd3Z/iIj4iIj4iIh3d2f/+Hd3Z/iP/4iI+IiId3d3//93d3aIiI+IiIiIh3dn+HeI/3d3f4j/iIiIiIeIZoiIh4hmd3iIiPiP+Ih4dmeH/4d4dmd4iP/4j/+Ih2ePhnd3ePh3eIj/+I//iId4/4d3d3j/h2iI//iP/4iHj/93d3d3//h4iP/4j/+I+P+Hd3d3d3j/j4j/+IiIiP//d4d4h3d3//+IiIiI+IiP93hmaPdmhn/4iI+IiP/4j4d3Znj3ZoZ4+PiIiIiIiPh2eGZ3dmaHZ4//+IiIj/+HZndmZmZmeHd4j/iIiIj/d3j4dmZmZ4+IiIiIeIiIj4iIiPiIiI+Ij4j4iIiIiI/4iIiIiIiIiIiIiIiICIiIiIiIiIiIiIiI+IiIgACIiIj4+IiIj4iI/4iIiAAAeIiIiPj4+IiPj4iIiIcAAACIiIiIj///iIiIiIgAAAAACIiIiIiIiIiIiIiAAAD4AAAf4AAAB8AAAAOAAAABgAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAABgAAAAcAAAAPgAAAH+AAAHw==82:T400,AAABAAEAICAQRgAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAIiIiIiIiIiIiIiIAAAAAAiIiIiI///4iIiIiIAAAACHiIiP+IiI+I+IiIiIAAAIiIiP+IiIiPiIiIiIiIAAg4iI+Pj4iIiI+Ij/iIh4CIiIiPj/iIiIiIiI+IiIiIiIiPiPiI/4iI/4iIiPiIiIiI+IiI+HdmZnePiPiIiIiIj4iIj3ZmZmZmd/iIiPiIeI+IiPdndniHd3Z/iIj4iIj4iIh3d2f/+Hd3Z/iP/4iI+IiId3d3//93d3aIiI+IiIiIh3dn+HeI/3d3f4j/iIiIiIeIZoiIh4hmd3iIiPiP+Ih4dmeH/4d4dmd4iP/4j/+Ih2ePhnd3ePh3eIj/+I//iId4/4d3d3j/h2iI//iP/4iHj/93d3d3//h4iP/4j/+I+P+Hd3d3d3j/j4j/+IiIiP//d4d4h3d3//+IiIiI+IiP93hmaPdmhn/4iI+IiP/4j4d3Znj3ZoZ4+PiIiIiIiPh2eGZ3dmaHZ4//+IiIj/+HZndmZmZmeHd4j/iIiIj/d3j4dmZmZ4+IiIiIeIiIj4iIiPiIiI+Ij4j4iIiIiI/4iIiIiIiIiIiIiIiICIiIiIiIiIiIiIiI+IiIgACIiIj4+IiIj4iI/4iIiAAAeIiIiPj4+IiPj4iIiIcAAACIiIiIj///iIiIiIgAAAAACIiIiIiIiIiIiIiAAAD4AAAf4AAAB8AAAAOAAAABgAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAABgAAAAcAAAAPgAAAH+AAAHw==83:T400,AAABAAEAICAQRgAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAIiIiIiIiIiIiIiIAAAAAAiIiIiI///4iIiIiIAAAACHiIiP+IiI+I+IiIiIAAAIiIiP+IiIiPiIiIiIiIAAg4iI+Pj4iIiI+Ij/iIh4CIiIiPj/iIiIiIiI+IiIiIiIiPiPiI/4iI/4iIiPiIiIiI+IiI+HdmZnePiPiIiIiIj4iIj3ZmZmZmd/iIiPiIeI+IiPdndniHd3Z/iIj4iIj4iIh3d2f/+Hd3Z/iP/4iI+IiId3d3//93d3aIiI+IiIiIh3dn+HeI/3d3f4j/iIiIiIeIZoiIh4hmd3iIiPiP+Ih4dmeH/4d4dmd4iP/4j/+Ih2ePhnd3ePh3eIj/+I//iId4/4d3d3j/h2iI//iP/4iHj/93d3d3//h4iP/4j/+I+P+Hd3d3d3j/j4j/+IiIiP//d4d4h3d3//+IiIiI+IiP93hmaPdmhn/4iI+IiP/4j4d3Znj3ZoZ4+PiIiIiIiPh2eGZ3dmaHZ4//+IiIj/+HZndmZmZmeHd4j/iIiIj/d3j4dmZmZ4+IiIiIeIiIj4iIiPiIiI+Ij4j4iIiIiI/4iIiIiIiIiIiIiIiICIiIiIiIiIiIiIiI+IiIgACIiIj4+IiIj4iI/4iIiAAAeIiIiPj4+IiPj4iIiIcAAACIiIiIj///iIiIiIgAAAAACIiIiIiIiIiIiIiAAAD4AAAf4AAAB8AAAAOAAAABgAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAABgAAAAcAAAAPgAAAH+AAAHw==30:["$","$Lc",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$33"}}],["$","$L35",null,{"initialData":{"schema_version":"1.0.17","sha256":"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1794227268377,"unified_at":"2026-11-09T12:27:48.377Z","metadata":{"hashes":{"sha256":"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0","sha1":"8c9c8177c9730ebfabfe6b84defba2541d6506f6","md5":"2a64fe2ac59921ad4bf054ddb5cb15b4","sha512":"91fa52db9ead8833247537d612372b58c48e13a5c0d2b65def6c334ef4e6825ee3af889078035bce0e5974a9484ed15a6081797c36ba8257460dc51be9c52c7a","ssdeep":"98304:n+592Sc6kY2bI6bD5E6RGxKrJajDw3ivZJyJtCZ4OiZrq1DfPHNADtV6v+zM+rwy:+5sY2vCKrJajDYivatCZ4O7NADtV6v+d","ssdeep_chunks":["98304:n+592Sc","98304:+592Sc6","98304:592Sc6k","98304:92Sc6kY","98304:2Sc6kY2","98304:Sc6kY2b","98304:c6kY2bI","98304:6kY2bI6","98304:kY2bI6b","98304:Y2bI6bD","98304:2bI6bD5","98304:bI6bD5E","98304:I6bD5E6","98304:6bD5E6R","98304:bD5E6RG","98304:D5E6RGx","98304:5E6RGxK","98304:E6RGxKr","98304:6RGxKrJ","98304:RGxKrJa","98304:GxKrJaj","98304:xKrJajD","98304:KrJajDw","98304:rJajDw3","98304:JajDw3i","98304:ajDw3iv","98304:jDw3ivZ","98304:Dw3ivZJ","98304:w3ivZJy","98304:3ivZJyJ","98304:ivZJyJt","98304:vZJyJtC","98304:ZJyJtCZ","98304:JyJtCZ4","98304:yJtCZ4O","98304:JtCZ4Oi","98304:tCZ4OiZ","98304:CZ4OiZr","98304:Z4OiZrq","98304:4OiZrq1","98304:OiZrq1D","98304:iZrq1Df","98304:Zrq1DfP","98304:rq1DfPH","98304:q1DfPHN","98304:1DfPHNA","98304:DfPHNAD","98304:fPHNADt","98304:PHNADtV","98304:HNADtV6","98304:NADtV6v","98304:ADtV6v+","98304:DtV6v+z","98304:tV6v+zM","98304:V6v+zM+","98304:6v+zM+r","98304:v+zM+rw","98304:+zM+rwy","196608:n+592Sc","196608:+592Sc6","196608:592Sc6k","196608:92Sc6kY","196608:2Sc6kY2","196608:Sc6kY2b","196608:c6kY2bI","196608:6kY2bI6","196608:kY2bI6b","196608:Y2bI6bD","196608:2bI6bD5","196608:bI6bD5E","196608:I6bD5E6","196608:6bD5E6R","196608:bD5E6RG","196608:D5E6RGx","196608:5E6RGxK","196608:E6RGxKr","196608:6RGxKrJ","196608:RGxKrJa","196608:GxKrJaj","196608:xKrJajD","196608:KrJajDw","196608:rJajDw3","196608:JajDw3i","196608:ajDw3iv","196608:jDw3ivZ","196608:Dw3ivZJ","196608:w3ivZJy","196608:3ivZJyJ","196608:ivZJyJt","196608:vZJyJtC","196608:ZJyJtCZ","196608:JyJtCZ4","196608:yJtCZ4O","196608:JtCZ4Oi","196608:tCZ4OiZ","196608:CZ4OiZr","196608:Z4OiZrq","196608:4OiZrq1","196608:OiZrq1D","196608:iZrq1Df","196608:Zrq1DfP","196608:rq1DfPH","196608:q1DfPHN","196608:1DfPHNA","196608:DfPHNAD","196608:fPHNADt","196608:PHNADtV","196608:HNADtV6","196608:NADtV6v","196608:ADtV6v+","196608:DtV6v+z","196608:tV6v+zM","196608:V6v+zM+","196608:6v+zM+r","196608:v+zM+rw","196608:+zM+rwy","98304:+5sY2vC","98304:5sY2vCK","98304:sY2vCKr","98304:Y2vCKrJ","98304:2vCKrJa","98304:vCKrJaj","98304:CKrJajD","98304:KrJajDY","98304:rJajDYi","98304:JajDYiv","98304:ajDYiva","98304:jDYivat","98304:DYivatC","98304:YivatCZ","98304:ivatCZ4","98304:vatCZ4O","98304:atCZ4O7","98304:tCZ4O7N","98304:CZ4O7NA","98304:Z4O7NAD","98304:4O7NADt","98304:O7NADtV","98304:7NADtV6","98304:DtV6v+d"],"imphash":"40cf81d7b90d369a5cd511a276c353b5","pehash":"35dd034ff296775f27c9e1d7835563d66ce6e3fc"},"file_info":{"file_name":"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll","file_type":["pedll","executable"],"file_type_id":"dll","file_size":5729280,"entropy":7.2,"compile_timestamp":"2026-08-17T16:05:48","is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1787094779000,"last_seen":1788036995000,"last_multi_scan":1788036995000},"pe_metadata":{"is_dll":true,"is_packed":false,"section_count":9,"import_count":0,"export_count":0,"embedded_file_count":10,"sections":[{"name":".text","virtual_address":"0x1000","virtual_size":1799961,"raw_size":1800192},{"name":".rdata","virtual_address":"0x1b9000","virtual_size":435066,"raw_size":435200},{"name":".data","virtual_address":"0x224000","virtual_size":71972,"raw_size":32768},{"name":".gfids","virtual_address":"0x236000","virtual_size":118964,"raw_size":119296},{"name":".giats","virtual_address":"0x254000","virtual_size":16,"raw_size":512},{"name":".tls","virtual_address":"0x255000","virtual_size":9,"raw_size":512},{"name":".Session","virtual_address":"0x256000","virtual_size":1025348,"raw_size":1025536},{"name":".rsrc","virtual_address":"0x351000","virtual_size":2162388,"raw_size":2162688},{"name":".reloc","virtual_address":"0x561000","virtual_size":151528,"raw_size":151552}],"section_names":[".text",".rdata",".data",".gfids",".giats",".tls",".Session",".rsrc",".reloc"],"imported_dlls":null,"imported_functions":null}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["new_domain","evasive","malicious"]},"stats":{"av":{"malicious_count":13,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":79},"sandbox_signatures":{"informative_count":208,"suspicious_count":22,"malicious_count":9,"total":239},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.MalwareX-gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Valley","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W32.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Yogi.50556","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"malicious","threat_name":"Trojan_Win32_Egairtigado_rfn","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Yogi.50556 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Valley.J trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"malicious","threat_name":"Backdoor.Xkcp.gen.kgcp","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Trojan/Agent.cuhm!crit","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Backdoor ( 005cef161 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Agent.MZP.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Valley.Win32.611","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Yogi.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Defense Evasion","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Found anti-virus related strings names"},{"type":"informative","value":"Contains ability to modify process attributes (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Contains registry location strings"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to executes commands or batch file"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Able to import GetCommandLine API, which retrieves the command line string for the current process"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"PE file contains large number of import functions"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Able to use GrayString API for text rendering"},{"type":"suspicious","value":"Contains ability to retrieve the fully qualified path of module"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"suspicious","value":"Contains ability to retrieve the command-line string for the current process"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Possibly checks for the presence of an Antivirus engine"},{"type":"informative","value":"Observed security product related strings in binary/memory"},{"type":"informative","value":"Loads the debugger/analysis tool module"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"malicious","value":"Recently registered domain detected"}],"sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","identifiers":[{"type":"malicious","value":"Application communicates with a malicious domain"},{"type":"suspicious","value":"Detected network traffic to commonly abused domain"}],"sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"}],"sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Able to unregister service from Service Control Manager"},{"type":"informative","value":"Contains ability to create a service (API string)"},{"type":"informative","value":"Contains ability to start a service (API string)"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to modify system service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"},{"type":"suspicious","value":"Contains ability to update the user profile"}],"sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1547.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/006","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Imports system security related APIs"}],"sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Windows system process connects to a network"},{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"},{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"tactic":"Privilege Escalation","technique":"Make and Impersonate Token","attack_id":"T1134.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/003","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"}],"sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Contains ability to query local/system time as file time"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"tactic":"Defense Evasion","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Contains ability to modify file system redirection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"Dropped file has high entropy (likely encrypted/compressed content)"},{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"}],"sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"tactic":"Defense Evasion","technique":"Rundll32","attack_id":"T1218.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1218/011","identifiers":[{"type":"informative","value":"Executes a DLL using Rundll32 process"}],"sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"malicious","value":"Drops executable files to the application program directory (%ProgramData%)"}],"sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"tactic":"Defense Evasion","technique":"Double File Extension","attack_id":"T1036.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/007","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"},{"type":"informative","value":"YARA signature match – PEB traversal"}],"sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Contains ability to detect sandbox (imports API)"},{"type":"informative","value":"Contains ability to detect virtual environment (API)"},{"type":"informative","value":"Makes a code branch decision directly after an API that is environment aware"}],"sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"tactic":"Defense Evasion","technique":"Junk Code Insertion","attack_id":"T1027.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/016","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"},{"type":"informative","value":"Found strings related to keylogger"},{"type":"suspicious","value":"Contains ability to retrieve keyboard strokes"},{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Contains ability to retrieve system language"}],"sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Calls APIs used for find file/directory path"},{"type":"informative","value":"Contains ability to verify if file exist on disk"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Contains references to file movement (imports API)"},{"type":"informative","value":"Contains ability to lookup its own filename"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to verify if file exist on disk (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"}],"sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to retrieve information about the current system"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"suspicious","value":"Contains ability to enumerate processes/modules/threads"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Calls an API used to retrieve process information"},{"type":"suspicious","value":"Calls an API typically used to enumerate process encountered in a system snapshot"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Spawns new processes"}],"sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Contains ability to query the system locale"}],"sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Able to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Contains ability to query the machine timezone"},{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"suspicious","value":"Tries to access/write temporary files"},{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"suspicious","value":"Contains ability to open the clipboard"},{"type":"informative","value":"Able to capture drag-drop file operations"},{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Contains ability to find and load resources of a specific module"},{"type":"informative","value":"Calls an API typically used to copy file from one location to another"},{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"tactic":"Collection","technique":"Archive via Custom Method","attack_id":"T1560.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/003","identifiers":[{"type":"informative","value":"Drops file with high entropy, indicating encryption/obfuscation"}],"sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contacts server"},{"type":"suspicious","value":"Spawned process connects to a network"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"malicious","value":"Uses network protocols on unusual ports"},{"type":"suspicious","value":"Contains ability to open a port and listen for incoming connection"},{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Contacts random domain names"}],"sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Able to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"malicious","value":"Terminates other processes using tskill/taskkill"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"},{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Calls APIs used for Remove Service"},{"type":"informative","value":"Calls an API used to open a process handle"}],"sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"},{"type":"informative","value":"Able to import cryptographic keys (seen in ransomware)"}],"sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]}],"sandbox_signatures":[{"level":"informative","category":"General","name":"Possibly checks for the presence of an Antivirus engine","description":"\"SOPHOSFS\" (Indicator: \"sophos\") in Source: sample.bin, \"BDAGENT\" (Indicator: \"bdagent\") in Source: sample.bin, \"SOPHOSUI\" (Indicator: \"sophos\") in Source: sample.bin, \"AVASTSVC\" (Indicator: \"avast\") in Source: sample.bin, \"SHIELDANTIVIRUS\" (Indicator: \"antivirus\") in Source: sample.bin, \"NORTONUI\" (Indicator: \"norton\") in Source: sample.bin, \"AVASTUI\" (Indicator: \"avast\") in Source: sample.bin, \"SOPHOSHEALTH\" (Indicator: \"sophos\") in Source: sample.bin, \"TRENDMICROSVC\" (Indicator: \"trendmicro\") in Source: sample.bin, \"NORTONSVC\" (Indicator: \"norton\") in Source: sample.bin, \"SOPHOSCLEAN\" (Indicator: \"sophos\") in Source: sample.bin, \"SHIELDANTIVIRUSWS\" (Indicator: \"antivirus\") in Source: sample.bin, \"ALYAC\" (Indicator: \"alyac\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1518.001","id":"string-8","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\" in Source: sample.bin, \"WSoftware\\\" in Source: sample.bin, \"Software\\Microsoft\\Windows\\CurrentVersion\\PreviewHandlers\" in Source: sample.bin, \"Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Comdlg32\" in Source: sample.bin, \"Software\\Classes\\\" in Source: sample.bin, \"Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Network\" in Source: sample.bin, \"nSOFTWARE\\\" in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-120","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"Found reference to API (Indicator: \"SeDebugPrivilege\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"SeTakeOwnershipPrivilege\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"General","name":"Contains ability to executes commands or batch file","description":"Found string \"cmd.exe /c start \"\" /B cmd /C %s\" (Indicator: \"cmd.exe /c\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.003","id":"string-174","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\BootRepair; Source: \"sample.bin\"), Found string - \\\\.\\Warsaw_PM; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1564","id":"string-145","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"SeLoadDriverPrivilege\" (Indicator: \"SeLoadDriverPrivilege\"; Source: \"sample.bin\"), Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134","id":"string-77","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"Found reference to API \"SeIncreaseBasePriorityPrivilege\" (Indicator: \"SeIncreaseBasePriorityPrivilege\"; Source: \"sample.bin\"), Found reference to API \"SeTcbPrivilege\" (Indicator: \"SeTcbPrivilege\"; Source: \"sample.bin\"), Found reference to API \"SeTakeOwnershipPrivilege\" (Indicator: \"SeTakeOwnershipPrivilege\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1548","id":"string-97","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"System Security","name":"Found anti-virus related strings names","description":"Found string \"AVGNT\" (Indicator: \"avgnt\"; Source: \"sample.bin\"), Found string \"FRESHCLAM\" (Indicator: \"freshclam\"; Source: \"sample.bin\"), Found string \"CLAMTRAY\" (Indicator: \"clamtray\"; Source: \"sample.bin\"), Found string \"NORTONUI\" (Indicator: \"norton\"; Source: \"sample.bin\"), Found string \"CLAMSCAN\" (Indicator: \"clamscan\"; Source: \"sample.bin\"), Found string \"NORTONSVC\" (Indicator: \"norton\"; Source: \"sample.bin\"), Found string \"AVGSERV\" (Indicator: \"avgserv\"; Source: \"sample.bin\"), Found string \"MCSHIELD\" (Indicator: \"mcshield\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1562.001","id":"string-134","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$36","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\")\n Found reference to API \"AGetSystemDirectoGetThreadContextSetThreadContext\" (Indicator: \"SetThreadContext\"; File: \"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\")\n Found reference to API \"AGetSystemDirectoGetThreadContextSetThreadContext\" (Indicator: \"GetThreadContext\"; File: \"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\")\n Found reference to API \"AGetSystemDirectoGetThreadContextSetThreadContext\" (Indicator: \"SetThreadContext\"; Source: \"00000000-00004828.00000000.213750.72B79000.00000002.mdmp\")\n Found reference to API \"AGetSystemDirectoGetThreadContextSetThreadContext\" (Indicator: \"GetThreadContext\"; Source: \"00000000-00004828.00000000.213750.72B79000.00000002.mdmp\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00004828.00000000.213750.72B79000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to unregister service from Service Control Manager","description":"Found string \"DeleteService\" (File: \"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\")\n Found string \"DeleteService\" (Source: \"00000000-00004828.00000000.213750.72B79000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-690","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"rundll32.exe\" called \"FindResourceW\" with parameter \"315\" - (UID: 00000000-00008384)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"rundll32.exe\" called \"LoadResource with parameter {'hModule': '1922826240', 'hResInfo': '1926332336'}\" (UID: 00000000-00008384)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$39","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to lookup its own filename","description":"PathFindFileNameW@SHLWAPI.dll at 16558-15010-10162270\n PathFindFileNameW@SHLWAPI.dll at 16558-22808-101546E2","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":5,"id":"stream-65","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\")\n Found reference to API \"RegSetValueW\" (Indicator: \"RegSetValue\"; File: \"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00004828.00000000.213750.72B79000.00000002.mdmp\")\n Found reference to API \"RegSetValueW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00004828.00000000.213750.72B79000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify system service (API string)","description":"Found reference to API \"ControlService\" (Indicator: \"ControlService\"; File: \"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\")\n Found reference to API \"ControlService\" (Indicator: \"ControlService\"; Source: \"00000000-00004828.00000000.213750.72B79000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-192","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; File: \"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\")\n Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; Source: \"00000000-00004828.00000000.213750.72B79000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; File: \"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\")\n Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00004828.00000000.213750.72B79000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\")\n Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00004828.00000000.213750.72B79000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00008384.00000001.215355.04DB0000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Loads the debugger/analysis tool module","description":"\"taskkill.exe\" loaded module \"%WINDIR%\\SysWOW64\\dbghelp.dll\" at 724D0000","origin":"Loaded Module","mitre_attack_id":"T1518.001","relevance":3,"id":"module-16","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$3a","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"OutputDebugStringA\" (Indicator: \"OutputDebugString\"; File: \"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\")\n Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; File: \"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\")\n Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 16558-12826-10179AAF","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to import cryptographic keys (seen in ransomware)","description":"Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00001332.00000001.214176.00610000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-603","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00001332.00000001.214176.00610000.00000004.mdmp\")\n Found api reference \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00002188.00000001.215057.03150000.00000004.mdmp\")\n Found api reference \"CryptExportKey\" (Indicator: \"CryptExportKey\"; Source: \"00000000-00002976.00000001.214173.008F0000.00000004.mdmp\")\n Found api reference \"CryptEncrypt\" (Indicator: \"CryptEncrypt\"; Source: \"00000000-00002976.00000001.214173.008F0000.00000004.mdmp\")\n Found api reference \"CryptExportKey\" (Indicator: \"CryptExportKey\"; Source: \"00000000-00004972.00000001.214568.02E10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$3b","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00002188.00000001.215057.03150000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.23653","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains reference to crypto DLLs\n Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Able to import cryptographic keys (seen in ransomware)\n Matched sigs: Contains ability to perform decryption (API string)\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Detected Suricata alert – Encrypted channel\n Matched sigs: Drops file with high entropy\n indicating encryption/obfuscation\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$3d","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"etUserNameExA\" (Source: \"00000000-00002976.00000001.214173.008F0000.00000004.mdmp\")\n Found string \"etUserNameExA\" (Source: \"00000000-00004972.00000001.214568.02E10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"file/memory contains long string with (Indicator: \"NtQuerySystemInformation\"; File: \"NVDisplay.Container.nvi.exe\")\n Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; File: \"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\")\n Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00001332.00000000.214146.00610000.00000004.mdmp\")\n Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002568.00000000.214499.00920000.00000004.mdmp\")\n Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004828.00000000.213750.02E20000.00000004.mdmp\")\n Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004972.00000001.214568.00B49000.00000002.mdmp\")\n Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006368.00000000.213748.02FD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00004828.00000000.213750.72B79000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; File: \"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\")\n Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; File: \"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\")\n Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00004828.00000000.213750.72B79000.00000002.mdmp\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00004828.00000000.213750.72B79000.00000002.mdmp\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00004828.00000000.213750.72B79000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"$40","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; File: \"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\")\n Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00004828.00000000.213750.72B79000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetDateFormatEx\" (Indicator: \"GetDateFormat\"; File: \"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\")\n Found reference to API \"GetTimeFormatEx\" (Indicator: \"GetTimeFormat\"; File: \"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\")\n Found reference to API \"GetDateFormatEx\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00004828.00000000.213750.72B79000.00000002.mdmp\")\n Found reference to API \"GetTimeFormatEx\" (Indicator: \"GetTimeFormat\"; Source: \"00000000-00004828.00000000.213750.72B79000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"$41","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00004828.00000000.213750.72B79000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"$42","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$43","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"rundll32.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00006368)\n \"rundll32.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00006368)\n \"rundll32.exe\" called \"EnumDisplayMonitors\" with parameters (UID: 00000000-00006368)\n \"rundll32.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00008384)\n \"rundll32.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00008384)\n \"rundll32.exe\" called \"EnumDisplayMonitors\" with parameters (UID: 00000000-00008384)\n \"rundll32.exe\" called \"Process32FirstW\" with parameters (UID: 00000000-00008384)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"rundll32.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00006368)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Environment Awareness","name":"Calls APIs used for find file/directory path","description":"Observed import api PathFindFileName (Source: c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll)","origin":"Static Parser","mitre_attack_id":"T1083","relevance":1,"id":"static-183","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"rundll32.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00006368)\n \"rundll32.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00008384)\n \"rundll32.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00006948)\n \"rundll32.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00004828)\n \"rundll32.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00000612)\n \"rundll32.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002976)\n \"rundll32.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00001332)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$44","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API used to retrieve process information","description":"Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll]\n Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: NVDisplay.Container.nvi.exe]","origin":"Static Parser","mitre_attack_id":"T1057","relevance":5,"id":"static-189","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount@KERNEL32.dll at 16558-1123-10011096\n GetTickCount@KERNEL32.dll at 16558-16084-100AA904\n GetTickCount@KERNEL32.dll at 16558-17292-100FA479\n GetTickCount@KERNEL32.dll at 16558-42678-1016089B","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process2\" (Indicator: \"IsWow64Process\"; File: \"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\")\n Found reference to API \"IsWow64Process2\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00001332.00000000.214146.00610000.00000004.mdmp\")\n Found reference to API \"IsWow64Process2\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00002568.00000000.214499.00920000.00000004.mdmp\")\n Found reference to API \"IsWow64Process2\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00004828.00000000.213750.02E20000.00000004.mdmp\")\n Found reference to API \"IsWow64Process2\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00004972.00000001.214568.00B49000.00000002.mdmp\")\n Found reference to API \"IsWow64Process2\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00006368.00000000.213748.02FD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileW@KERNEL32.dll at 16558-14167-101059FF","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"FileTimeToSystemTime@KERNEL32.dll at 16558-17821-1011DD35\n FileTimeToLocalFileTime@KERNEL32.dll at 16558-17832-1011E493","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetLocalTime@KERNEL32.dll at 16558-29561-10343978","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine timezone","description":"GetTimeZoneInformation@KERNEL32.dll at 16558-19500-1019AA66","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-48","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExW@KERNEL32.dll at 16558-19535-100A8E24\n GetVersionExW@KERNEL32.dll at 16558-21451-101533B7","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"GetUserDefaultLCID@KERNEL32.dll at 16558-12777-101976CC\n EnumSystemLocalesW@KERNEL32.dll at 16558-12784-10197102\n GetLocaleInfoW@KERNEL32.dll at 16558-12789-1019768D\n GetUserDefaultLCID@KERNEL32.dll at 16558-12813-101A2334\n EnumSystemLocalesW@KERNEL32.dll at 16558-12814-101A1C6B\n EnumSystemLocalesW@KERNEL32.dll at 16558-12815-101A1D51\n GetLocaleInfoW@KERNEL32.dll at 16558-12817-101A2158\n EnumSystemLocalesW@KERNEL32.dll at 16558-12818-101A1CB6\n GetLocaleInfoW@KERNEL32.dll at 16558-16053-100C4DFB\n GetLocaleInfoW@KERNEL32.dll at 16558-19519-101A1BC6\n GetLocaleInfoW@KERNEL32.dll at 16558-19522-101A1DDE\n GetLocaleInfoW@KERNEL32.dll at 16558-19523-101A225E\n GetLocaleInfoW@KERNEL32.dll at 16558-19524-101A2031","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"rundll32.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"rundll32.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"file/memory contains long string with (Indicator: \"\"set \"; File: \"S-1-5-21-735145574-3570218355-1207367261.CMD\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"$45","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system","description":"GetSystemInfo@KERNEL32.dll at 16558-19424-1018FD66","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":4,"id":"stream-86","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\")\n Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00004828.00000000.213750.72B79000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"$46","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; File: \"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\")\n Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00004828.00000000.213750.72B79000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language","description":"GetTextCharsetInfo@GDI32.dll at 16558-12073-10023CB3\n GetUserDefaultUILanguage@KERNEL32.dll at 16558-13175-10159827\n GetKeyboardLayout@USER32.dll at 16558-14295-100C8950\n GetKeyboardLayout@USER32.dll at 16558-14298-100C82BD\n GetKeyboardLayout@USER32.dll at 16558-14356-10159A88\n GetUserDefaultUILanguage@KERNEL32.dll at 16558-16054-100C4E73","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614.001","relevance":3,"id":"stream-79","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$47","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; File: \"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\")\n Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00004828.00000000.213750.72B79000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"OpenProcessToken@ADVAPI32.dll at 16558-3392-100076D9\n OpenProcessToken@ADVAPI32.dll at 16558-13137-1000E610\n GetProcessHeap@KERNEL32.dll at 16558-42163-1019B5A1","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to verify if file exist on disk","description":"PathFileExistsW@SHLWAPI.dll at 16558-1123-10011096","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":1,"id":"stream-124","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to verify if file exist on disk (API string)","description":"Found reference to API \"PathFileExistsW\" (Indicator: \"PathFileExist\"; File: \"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\")\n Found reference to API \"PathFileExistsW\" (Indicator: \"PathFileExist\"; Source: \"00000000-00004828.00000000.213750.72B79000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-140","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetTimeZoneInformation@KERNEL32.dll directly followed by \"cmp eax, FFFFFFFFh\" and \"je 1019AB90h\" at 16558-19500-1019AA66\n Found API call GetVersionExW@KERNEL32.dll directly followed by \"cmp dword ptr [ebp-00000120h], 06h\" and \"jne 100A8F4Eh\" at 16558-19535-100A8E24\n Found API call GetVersionExW@KERNEL32.dll directly followed by \"cmp dword ptr [ebp-00000120h], 06h\" and \"jc 10153463h\" at 16558-21451-101533B7","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"rundll32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyW\" in file \"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\"\n Found registry modification API: \"RegCreateKeyExW\" in file \"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\"\n Found registry modification API: \"RegCreateKeyTransactedW\" in file \"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\"\n Found registry modification API: \"RegCreateKeyTransactedW\" in \"00000000-00004828.00000000.213750.72B79000.00000002.mdmp\"\n Found registry modification API: \"RegCreateKeyW\" in \"00000000-00004828.00000000.213750.72B79000.00000002.mdmp\"\n Found registry modification API: \"RegCreateKeyExW\" in \"00000000-00004828.00000000.213750.72B79000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; File: \"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\")\n Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00004828.00000000.213750.72B79000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; File: \"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\")\n Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; Source: \"00000000-00004828.00000000.213750.72B79000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"file/memory contains long string(File: \"NVDisplay.Container.nvi.exe\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00001332.00000000.214146.00610000.00000004.mdmp\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00002568.00000000.214499.00920000.00000004.mdmp\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00004828.00000000.213750.02E20000.00000004.mdmp, 00000000-00004828.00000000.213750.72B79000.00000002.mdmp\")\n Found string \"GetCommandLineA\" (Source: \"00000000-00004828.00000000.213750.72B79000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00004972.00000001.214568.00B49000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00006368.00000000.213748.02FD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"$48","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"General","name":"Able to use GrayString API for text rendering","description":"Found reference to API \"GrayStringW\" (Indicator: \"GrayStringW\"; File: \"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\")\n Found reference to API \"GrayStringW\" (Indicator: \"GrayStringW\"; Source: \"00000000-00004828.00000000.213750.72B79000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-900","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"General","name":"Calls an API typically used to copy file from one location to another","description":"$49","origin":"API Call","mitre_attack_id":"T1005","relevance":3,"id":"api-123","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$4a","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"rundll32.exe\" called \"CreateProcessW\" with parameter \"taskkill /f /im cmd.exe\" - (UID: 00000000-00008384)\n \"rundll32.exe\" called \"CreateProcessW\" with parameter \"cmd.exe /c start \"\" /B cmd /C %TEMP%\\S-1-5-21-735145574-3570218355-1207367261\\S-1-5-21-735145574-3570\" - (UID: 00000000-00008384)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$4b","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$4c","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"121.127.253.206:8856\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"F:\\iProject\\NvPluginWatchdog\\Release\\NvPluginWatchdog.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; File: \"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\")\n Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00004828.00000000.213750.72B79000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00004828.00000000.213750.72B79000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; File: \"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\")\n Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00004828.00000000.213750.72B79000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"$4f","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00004828.00000000.213750.72B79000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryW@KERNEL32.dll at 16558-12229-1001DA7E\n LoadLibraryW@KERNEL32.dll at 16558-12389-100048A5\n LoadLibraryW@KERNEL32.dll at 16558-13058-1000CB16\n LoadLibraryW@KERNEL32.dll at 16558-13059-1000C9AC\n LoadLibraryW@KERNEL32.dll at 16558-13061-1000C4FC\n LoadLibraryExW@KERNEL32.dll at 16558-13477-10017FBA\n LoadLibraryW@KERNEL32.dll at 16558-13478-1001D83D\n LoadLibraryW@KERNEL32.dll at 16558-13698-1001D989\n LoadLibraryA@KERNEL32.dll at 16558-13699-1001D993\n LoadLibraryExW@KERNEL32.dll at 16558-16050-100AA3F9\n LoadLibraryExW@KERNEL32.dll at 16558-16052-100AA2F3\n LoadLibraryExW@KERNEL32.dll at 16558-17469-101053B7\n LoadLibraryW@KERNEL32.dll at 16558-41447-1001138F","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"$50","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"$51","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; File: \"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\")\n Found reference to API \"MoveFileTransactedW\" (Indicator: \"MoveFile\"; File: \"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\")\n Found reference to API \"MoveFileTransactedW\" (Indicator: \"MoveFile\"; Source: \"00000000-00004828.00000000.213750.72B79000.00000002.mdmp\")\n Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; Source: \"00000000-00004828.00000000.213750.72B79000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"$52","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"$53","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"$54","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; File: \"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00004828.00000000.213750.72B79000.00000002.mdmp\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00004828.00000000.213750.72B79000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"Found reference to API \"StartServiceW\" (Indicator: \"StartService\"; File: \"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\")\n Found reference to API \"StartServiceW\" (Indicator: \"StartService\"; Source: \"00000000-00004828.00000000.213750.72B79000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"$55","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"General","name":"Contains references to file movement (imports API)","description":"Found MoveFileW in import section (Source: c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll)","origin":"Static Parser","mitre_attack_id":"T1083","relevance":1,"id":"static-205","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$56","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"General","name":"DLL with no export directory","description":"\"NVDisplay.Container.nvi.exe\" has no export directory \"IMAGE_DIRECTORY_ENTRY_EXPORT\"","origin":"Static Parser","relevance":1,"id":"static-91","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"S-1-5-21-735145574-3570218355-1207367261.CMD\" as clean (type is \"Unicode text UTF-8 text with CRLF line terminators\")\n Antivirus vendors marked dropped file \"NVDisplay.Container.nvi.exe\" as clean (type is \"PE32 executable for MS Windows 10.00 (GUI) Intel i386 6 sections\"), Antivirus vendors marked dropped file \"S-1-5-21-735145574-3570218355-1207367261.eXe\" as clean (type is \"PE32 executable for MS Windows 10.00 (GUI) Intel i386 6 sections\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"General","name":"Executes a DLL using Rundll32 process","description":"$57","origin":"Monitored Target","mitre_attack_id":"T1218.011","relevance":1,"id":"target-400","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\" in Source: 00000000-00004828.00000000.213750.72B79000.00000002.mdmp\n \"Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Network\" in Source: 00000000-00004828.00000000.213750.72B79000.00000002.mdmp\n \"Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Comdlg32\" in Source: 00000000-00004828.00000000.213750.72B79000.00000002.mdmp\n \"Software\\\" in Source: 00000000-00004828.00000000.213750.72B79000.00000002.mdmp\n \"Software\\Classes\\\" in Source: 00000000-00004828.00000000.213750.72B79000.00000002.mdmp\n \"SOFTWARE\\\" in Source: 00000000-00004828.00000000.213750.72B79000.00000002.mdmp\n \"Software\\Microsoft\\Windows\\CurrentVersion\\PreviewHandlers\" in Source: 00000000-00004828.00000000.213750.72B79000.00000002.mdmp","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$58","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"rundll32.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 74040000\n \"rundll32.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 734E0000\n \"taskkill.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 74040000\n \"taskkill.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 734E0000\n \"cmd.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 74040000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"rundll32.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75B80000\n \"taskkill.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75B80000\n \"cmd.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75B80000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"\n \"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"NVDisplay.Container.nvi.exe\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"\n \"NVDisplay.Container.nvi.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"NVDisplay.Container.nvi.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\" has an executable section named \".text\"\n \"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\" has an executable section named \".Session\"\n \"NVDisplay.Container.nvi.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"General","name":"PE file contains large number of import functions","description":"Observed large number of imported APIs from \"USER32.dll\" : \"227\" [Source: c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-145","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\" has an writable section named \".data\"\n \"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\" has an writable section named \".tls\"\n \"NVDisplay.Container.nvi.exe\" has an writable section named \".data\"\n \"NVDisplay.Container.nvi.exe\" has an writable section named \".didat\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$59","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x1b7800\" greater than 0x100000\n Raw size of \".rsrc\" is \"0x210000\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x1b7719\" greater than 0x100000\n Virtual size of \".rsrc\" is \"0x20fed4\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\SysWOW64\\rundll32.exe\" [Source: 00000000-00006368-00000C3D-4422801787]\n Observed system executable string:\"%WINDIR%\\SysWOW64\\taskkill.exe\" [Source: 00000000-00008384-00000BC0-2343281623]\n Observed system executable string:\"%WINDIR%\\SysWOW64\\cmd.exe\" [Source: 00000000-00008384-00000BC0-2343552875]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"rundll32.exe\" (UID: 00000000-00006368) was launched with new environment variables: \"PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"rundll32.exe\" (UID: 00000000-00006368) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles\"\n Process \"taskkill.exe\" (UID: 00000000-00007528) was launched with new environment variables: \"USERDNSDOMAIN=\"DESKTOP-FVVF82A\"\"\n Process \"taskkill.exe\" (UID: 00000000-00007528) was launched with modified environment variables: \"NUMBER_OF_PROCESSORS\"\n Process \"rundll32.exe\" (UID: 00000000-00007940) was launched with modified environment variables: \"NUMBER_OF_PROCESSORS\"\n Process \"rundll32.exe\" (UID: 00000000-00007940) was launched with missing environment variables: \"USERDNSDOMAIN\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"fshsjlk.cc\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"rundll32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"rundll32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"rundll32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\SysWOW64\\HDPGMS.DLL\" [Source: 00000000-00006368-00000C3D-4424152825]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$5a","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$5b","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"NVDisplay.Container.nvi.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"rundll32.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\S-1-5-21-735145574-3570218355-1207367261\\S-1-5-21-735145574-3570218355-1207367261.eXe\"\n \"rundll32.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\S-1-5-21-735145574-3570218355-1207367261\\S-1-5-21-735145574-3570218355-1207367261.CMD.ini\"\n \"rundll32.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\S-1-5-21-735145574-3570218355-1207367261\\S-1-5-21-735145574-3570218355-1207367261.CMD\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create a service (API string)","description":"Found reference to API \"CreateServiceW\" (Indicator: \"CreateService\"; File: \"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\")\n Found reference to API \"CreateServiceW\" (Indicator: \"CreateService\"; Source: \"00000000-00004828.00000000.213750.72B79000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-199","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"$5c","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"rundll32.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"taskkill.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$5d","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$5e","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"taskkill.exe\" queries basic process information of the \"C:\\Windows\\SysWOW64\\cmd.exe\" (UID: 7528)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$5f","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"rundll32.exe\" reads file \"c:\\windows\\syswow64\\rundll32.exe\"\n \"rundll32.exe\" reads file \"c:\\users\\%osuser%\\appdata\\local\\temp\\s-1-5-21-735145574-3570218355-1207367261\\s-1-5-21-735145574-3570218355-1207367261.cmd\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Contains ability to detect sandbox (imports API)\n Matched sigs: Able to perform sandbox evasion using APIs\n Matched sigs: Contains ability to delay the execution of current thread\n Matched sigs: Contains ability to detect virtual environment (API)\n Matched sigs: Makes a code branch decision directly after an API that is environment aware","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"rundll32.exe\" trying to touch file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"rundll32.exe\" trying to touch file \"C:\\WINDOWS\\system32\\wow64log.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\apphelp.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\WINDOWS\\SysWOW64\\apphelp.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\rundll32.exe\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ntdll.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\kernel32.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\AcLayers.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\WINDOWS\\SysWOW64\\AcLayers.DLL\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\mpr.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$60","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$61","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"$62","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"wsastartup\"; File: \"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\")\n Found reference to API \"WSACleanup\" (Indicator: \"wsacleanup\"; File: \"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\")\n Found reference to API \"WSAGetLastError\" (Indicator: \"wsagetlasterror\"; File: \"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\")\n Found reference to API \"gethostbyname\" (Indicator: \"gethostbyname\"; File: \"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"(#@.fj\"\n Heuristic match: \"fshsjlk.cc\"\n Pattern match: \"http://www.w3.org/2001/xmlschema-instance\"\n Heuristic match: \"microsoft-windows-client-features-wow64-package0018~31bf3856ad364e35~amd64~~10.0.16299.15.cat\"\n Heuristic match: \"shsjlk.cc\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – PEB traversal","description":"YARA signature for PEB traversal process \"00000000-00008384\"","origin":"YARA Signature","mitre_attack_id":"T1027.007","relevance":1,"id":"yara-166","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to modify file system redirection (API string)","description":"Found reference to API \"Wow64DisableWow64FsRedirection\" (Indicator: \"Wow64DisableWow64FsRedirection\"; File: \"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\")\n Found reference to API \"Wow64RevertWow64FsRedirection\" (Indicator: \"Wow64RevertWow64FsRedirection\"; File: \"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\")\n Found reference to API \"Wow64DisableWow64FsRedirection\" (Indicator: \"Wow64DisableWow64FsRedirection\"; Source: \"00000000-00004828.00000000.213750.72B79000.00000002.mdmp\")\n Found reference to API \"Wow64RevertWow64FsRedirection\" (Indicator: \"Wow64RevertWow64FsRedirection\"; Source: \"00000000-00004828.00000000.213750.72B79000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-553","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture drag-drop file operations","description":"Found string \"DragQueryFileW\" (File: \"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\")\n Found string \"DragQueryFileW\" (Source: \"00000000-00004828.00000000.213750.72B79000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-915","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"$63","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; File: \"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\")\n Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00004828.00000000.213750.72B79000.00000002.mdmp\")\n Found reference to API \"5,,RtlGetNtProductType,NTDLL.dll,\"00:55:40.6\" (Indicator: \"RtlGetNtProductType\"; Source: \"00000000-00008384.00000001.215355.02D40000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll]","origin":"Static Parser","mitre_attack_id":"T1059.003","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"$64","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"$65","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"$66","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"rundll32.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"rundll32.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"2\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"YAEsN\" (Indicator: \"aes\"; Source: \"00000000-00008384.00000001.215355.04DB0000.00000004.mdmp, 00000000-00008384.00000001.215355.04E60000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; File: \"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\")\n Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"00000000-00004828.00000000.213750.72B79000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to detect sandbox (imports API)","description":"Found GetCursorPos() in an import section (Source: c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll)","origin":"Static Parser","mitre_attack_id":"T1497","relevance":1,"id":"static-132","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; File: \"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\")\n Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; File: \"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; File: \"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\")\n Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00004828.00000000.213750.72B79000.00000002.mdmp\")\n Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00004828.00000000.213750.72B79000.00000002.mdmp\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"00000000-00004828.00000000.213750.72B79000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$67","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00001332.00000000.214146.00610000.00000004.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00002568.00000000.214499.00920000.00000004.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00004828.00000000.213750.02E20000.00000004.mdmp, 00000000-00004828.00000000.213750.72B79000.00000002.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00004972.00000001.214568.00B49000.00000002.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00006368.00000000.213748.02FD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"$68","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00001332.00000000.214146.00610000.00000004.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00002568.00000000.214499.00920000.00000004.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00004828.00000000.213750.02E20000.00000004.mdmp, 00000000-00004828.00000000.213750.72B79000.00000002.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00004972.00000001.214568.00B49000.00000002.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00006368.00000000.213748.02FD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$69","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"$6a","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00004828.00000000.213750.72B79000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"$6b","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00004828.00000000.213750.72B79000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; File: \"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\")\n Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00004828.00000000.213750.72B79000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found strings related to keylogger","description":"file/memory contains long string with (Indicator: \"\"; File: \"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-556","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"file/memory contains long string with (Indicator: \"tasklist\"; File: \"S-1-5-21-735145574-3570218355-1207367261.CMD\")\n file/memory contains long string with (Indicator: \"tasklist /fi\"; File: \"S-1-5-21-735145574-3570218355-1207367261.CMD\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Observed security product related strings in binary/memory","description":"Found string -CSFALCONSERVICE","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":1,"id":"string-123","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"$6c","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"System Security","name":"Calls APIs used for Remove Service","description":"Observed import api \"DeleteService\" which can \"Deregister service in Service Control Manager database\" [Source: c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-188","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"rundll32.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00008384)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll]\n Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: NVDisplay.Container.nvi.exe]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$6d","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\")\n Found reference to API \"DeleteFileTransactedW\" (Indicator: \"DeleteFile\"; File: \"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\")\n Found reference to API \"DeleteFileTransactedW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00004828.00000000.213750.72B79000.00000002.mdmp\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00004828.00000000.213750.72B79000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; File: \"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\")\n Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; File: \"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\")\n Found reference to API \"SetWindowsHookExW\" (Indicator: \"SetWindowsHook\"; File: \"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\")\n Found reference to API \"SetWindowsHookExW\" (Indicator: \"SetWindowsHook\"; Source: \"00000000-00004828.00000000.213750.72B79000.00000002.mdmp\")\n Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; Source: \"00000000-00004828.00000000.213750.72B79000.00000002.mdmp\")\n Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; Source: \"00000000-00004828.00000000.213750.72B79000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify process attributes (API string)","description":"Found reference to API \"SetProcessMitigationPolicy\" (Indicator: \"SetProcessMitigationPolicy\"; File: \"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\")\n Found reference to API \"SetProcessMitigationPolicy\" (Indicator: \"SetProcessMitigationPolicy\"; Source: \"00000000-00001332.00000000.214146.00610000.00000004.mdmp\")\n Found reference to API \"SetProcessMitigationPolicy\" (Indicator: \"SetProcessMitigationPolicy\"; Source: \"00000000-00002568.00000000.214499.00920000.00000004.mdmp\")\n Found reference to API \"SetProcessMitigationPolicy\" (Indicator: \"SetProcessMitigationPolicy\"; Source: \"00000000-00004828.00000000.213750.02E20000.00000004.mdmp\")\n Found reference to API \"SetProcessMitigationPolicy\" (Indicator: \"SetProcessMitigationPolicy\"; Source: \"00000000-00004972.00000001.214568.00B49000.00000002.mdmp\")\n Found reference to API \"SetProcessMitigationPolicy\" (Indicator: \"SetProcessMitigationPolicy\"; Source: \"00000000-00006368.00000000.213748.02FD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-402","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; File: \"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\")\n Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00004828.00000000.213750.72B79000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$6e","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"$6f","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00004828.00000000.213750.72B79000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"rundll32.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"$70","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"rundll32.exe\" opened \"\\Device\\KsecDD\"\n \"taskkill.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$71","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"$72","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"S-1-5-21-735145574-3570218355-1207367261.eXe\" has type \"PE32 executable for MS Windows 10.00 (GUI) Intel i386 6 sections\"- Location: [%TEMP%\\S-1-5-21-735145574-3570218355-1207367261\\S-1-5-21-735145574-3570218355-1207367261.eXe]- [targetUID: 00000000-00008384]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops file with high entropy, indicating encryption/obfuscation","description":"\"S-1-5-21-735145574-3570218355-1207367261.CMD.ini has high entropy\"","origin":"Binary File","mitre_attack_id":"T1560.003","relevance":3,"id":"binary-90","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\" was detected as \"Borland Delphi 3.0 (???)\"\n \"NVDisplay.Container.nvi.exe\" was detected as \"Visual C++ 2005 Release -> Microsoft\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"rundll32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\" has section name .Session with entropy \"7.27298679893396\"\n \"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\" has section name .rsrc with entropy \"7.473314491469794\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Dropped file has high entropy (likely encrypted/compressed content)","description":"Dropped file \"%TEMP%\\S-1-5-21-735145574-3570218355-1207367261\\S-1-5-21-735145574-3570218355-1207367261.CMD.ini\" has high entropy 7.86124","origin":"Binary File","mitre_attack_id":"T1027","relevance":5,"id":"binary-60","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"10/24 Antivirus vendors marked sample as malicious (41% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceW@KERNEL32.dll at 16558-1843-100057F3\n LoadResource@KERNEL32.dll at 16558-1844-10005792\n FindResourceW@KERNEL32.dll at 16558-12140-100401A0\n FindResourceW@KERNEL32.dll at 16558-12220-100AEC7F\n FindResourceW@KERNEL32.dll at 16558-12604-1000745A\n FindResourceW@KERNEL32.dll at 16558-13173-100C73C4\n FindResourceExW@KERNEL32.dll at 16558-13175-10159827\n FindResourceW@KERNEL32.dll at 16558-13267-100AEC1A\n LockResource@KERNEL32.dll at 16558-13268-100AEED8\n FindResourceW@KERNEL32.dll at 16558-13505-10018A1E\n FindResourceW@KERNEL32.dll at 16558-13555-10019475\n FindResourceW@KERNEL32.dll at 16558-14123-10031D2A\n FindResourceW@KERNEL32.dll at 16558-15222-100A3A70\n FindResourceW@KERNEL32.dll at 16558-15617-100AEFB3\n FindResourceW@KERNEL32.dll at 16558-16110-100AB1E9\n FreeResource@KERNEL32.dll at 16558-16168-100ADDD9\n FindResourceW@KERNEL32.dll at 16558-16185-100AEB73\n FindResourceW@KERNEL32.dll at 16558-17947-10126436","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1005","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$73","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$74","origin":"API Call","mitre_attack_id":"T1105","relevance":5,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"suspicious","category":"Network Related","name":"Contacts random domain names","description":"\"fshsjlk.cc\" seems to be random","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-6","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection","description":"CreateBindCtx@ole32.dll at 16558-13460-100165E8\n CreateBindCtx@ole32.dll at 16558-15157-10016694\n CreateBindCtx@ole32.dll at 16558-16241-100B1F25","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1571","relevance":5,"id":"stream-85","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"suspicious","category":"Network Related","name":"Detected network traffic to commonly abused domain","description":"Domain: \"fshsjlk.cc\" possible high risk indicator. Domain uses TLD that is commonly abused for malicious purposes.","origin":"Network Traffic","mitre_attack_id":"T1566","relevance":5,"id":"network-84","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"suspicious","category":"Network Related","name":"Spawned process connects to a network","description":"Process \"%WINDIR%\\SysWOW64\\rundll32.exe\" connects to 121.127.253.206 on port 8856 (TCP); Domain: \"fshsjlk.cc\"","origin":"Monitored Target","mitre_attack_id":"T1071","relevance":5,"id":"target-412","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Contains ability to update the user profile","description":"$75","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1098","relevance":5,"id":"stream-123","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate process encountered in a system snapshot","description":"\"rundll32.exe\" called \"Process32FirstW with parameter [System Process]\" (UID: 00000000-00008384)\n \"rundll32.exe\" called \"Process32NextW with parameter System\" (UID: 00000000-00008384)\n \"rundll32.exe\" called \"Process32NextW with parameter smss.exe\" (UID: 00000000-00008384)\n \"rundll32.exe\" called \"Process32NextW with parameter csrss.exe\" (UID: 00000000-00008384)\n \"rundll32.exe\" called \"Process32NextW with parameter wininit.exe\" (UID: 00000000-00008384)\n \"rundll32.exe\" called \"Process32NextW with parameter winlogon.exe\" (UID: 00000000-00008384)\n \"rundll32.exe\" called \"Process32NextW with parameter services.exe\" (UID: 00000000-00008384)\n \"rundll32.exe\" called \"Process32NextW with parameter lsass.exe\" (UID: 00000000-00008384)\n \"rundll32.exe\" called \"Process32NextW with parameter svchost.exe\" (UID: 00000000-00008384)\n \"rundll32.exe\" called \"Process32NextW with parameter fontdrvhost.exe\" (UID: 00000000-00008384)\n \"rundll32.exe\" called \"Process32NextW with parameter dwm.exe\" (UID: 00000000-00008384)","origin":"API Call","mitre_attack_id":"T1057","relevance":5,"id":"api-104","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"CreateToolhelp32Snapshot@KERNEL32.dll at 16558-13138-1000F6C8","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to open the clipboard","description":"OpenClipboard@USER32.dll at 16558-20180-1003D973\n OpenClipboard@USER32.dll at 16558-22048-100FB3FB\n OpenClipboard@USER32.dll at 16558-22970-101696C5\n OpenClipboard@USER32.dll at 16558-43042-1013A711","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1115","relevance":10,"id":"stream-0","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve keyboard strokes","description":"$76","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1056.001","relevance":8,"id":"stream-12","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the command-line string for the current process","description":"GetCommandLineA@KERNEL32.dll at 16558-42164-101902E5","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-118","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module","description":"GetModuleFileNameW@KERNEL32.dll at 16558-1161-102BA550\n GetModuleFileNameW@KERNEL32.dll at 16558-12194-1003FF24\n GetModuleFileNameW@KERNEL32.dll at 16558-12229-1001DA7E\n GetModuleFileNameW@KERNEL32.dll at 16558-13435-10021CEB\n GetModuleFileNameW@KERNEL32.dll at 16558-16048-100A9869\n GetModuleFileNameW@KERNEL32.dll at 16558-17464-10104E25\n GetModuleFileNameW@KERNEL32.dll at 16558-17465-10104E71\n GetModuleFileNameW@KERNEL32.dll at 16558-18819-101752FB","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-131","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Tries to access/write temporary files","description":"Process \"%WINDIR%\\SysWOW64\\cmd.exe\" with commandline \"/c start \"\" /B cmd /C %TEMP%\\\\S-1-5-21-735145574-3570218355-1207367261\\\\S-1-5-21-735145574-3570218355-1207367261.CMD\" (UID: 00000000-00008752)","origin":"Monitored Target","mitre_attack_id":"T1074.001","relevance":5,"id":"target-423","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"rundll32.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\S-1-5-21-735145574-3570218355-1207367261\\S-1-5-21-735145574-3570218355-1207367261.CMD.ini\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"rundll32.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\S-1-5-21-735145574-3570218355-1207367261\\S-1-5-21-735145574-3570218355-1207367261.CMD.ini\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$77","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"NVDisplay.Container.nvi.exe\" claims program is from Wed Apr 1 13:08:11 2065","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Terminates other processes using tskill/taskkill","description":"Process \"taskkill.exe\" with commandline \"taskkill /f /im cmd.exe\" (UID: 00000000-00007528)","origin":"Monitored Target","mitre_attack_id":"T1489","relevance":9,"id":"target-9","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Windows system process connects to a network","description":"Process \"rundll32.exe\" connects to 121.127.253.206:8856","origin":"Monitored Target","mitre_attack_id":"T1055","relevance":7,"id":"target-269","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"malicious","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET MALWARE Winos4.0 Framework CnC Login Message\" (SID: 2052875, Rev: 7, Severity: 1) categorized as \"Malware Command and Control Activity Detected\" (PUA/PUP/Adware)\n Detected alert \"ET MALWARE Winos4.0 Framework CnC Login Message CnC Server Response\" (SID: 2059975, Rev: 2, Severity: 1) categorized as \"Malware Command and Control Activity Detected\" (PUA/PUP/Adware)","origin":"Suricata Alerts","relevance":10,"id":"suricata-2","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"malicious","category":"Installation/Persistence","name":"Drops executable files to the application program directory (%ProgramData%)","description":"$78","origin":"Binary File","mitre_attack_id":"T1036","relevance":7,"id":"binary-27","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"rundll32.exe\" wrote 00000FB8 bytes to a remote process \"C:\\Windows\\SysWOW64\\taskkill.exe\" (Handle: 876)\n \"rundll32.exe\" wrote 00000008 bytes to a remote process \"C:\\Windows\\SysWOW64\\taskkill.exe\" (Handle: 876)\n \"rundll32.exe\" wrote 00000004 bytes to a remote process \"C:\\Windows\\SysWOW64\\taskkill.exe\" (Handle: 876)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"malicious","category":"Network Related","name":"Application communicates with a malicious domain","description":"Contacted Domain: \"fshsjlk.cc\" has been identified as malicious","origin":"Network Traffic","mitre_attack_id":"T1566","relevance":10,"id":"network-88","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"malicious","category":"Network Related","name":"Recently registered domain detected","description":"Recently Registered domain detected: \"fshsjlk.cc\" (5 days old). Commonly seen with phishing or other suspicious domains","origin":"Network Traffic","mitre_attack_id":"T1583.001","relevance":10,"id":"network-8601","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 121.127.253.206 on port 8856","origin":"Network Traffic","mitre_attack_id":"T1571","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]}],"incidents":[{"name":"Spyware","details_count":5,"details":[{"detail":"Hooks API calls"},{"detail":"Contains ability to open the clipboard"},{"detail":"Contains ability to open the clipboard"},{"detail":"Contains ability to retrieve keyboard strokes"},{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"name":"Persistence","details_count":3,"details":[{"detail":"Writes data to a remote process"},{"detail":"Creates new processes"},{"detail":"Drops executable files to the application program directory (%ProgramData%)"}],"sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"name":"Evasive","details_count":5,"details":[{"detail":"Marks file for deletion"},{"detail":"May check for the presence of a forensics/monitoring tool"},{"detail":"Able to check if a debugger is running"},{"detail":"Contains ability to adjust token privileges"},{"detail":"Contains ability to terminate a process"}],"sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]}],"intel_graph":{"map":{"Domain:3a4a2768fc1a5fdaeb08980bc76db7dd8bddd1a7262b8120fe858d5aea4811d5":{"type":"Domain","value":"fshsjlk.cc","verdict":{"verdict":"malicious","verdict_source":"domain reputation data","reasons":["reported malicious domain"]}},"File:45b0e2dbdb30922fa1279c1e1e6cc7606970116f6d6440614e961cb0fc161ef0":{"type":"File","value":"45b0e2dbdb30922fa1279c1e1e6cc7606970116f6d6440614e961cb0fc161ef0"},"File:646665cf2610612e2d72dd0923b1e2c1395b21ef17ce5f71d2e2a9f4492c4bee":{"type":"File","value":"646665cf2610612e2d72dd0923b1e2c1395b21ef17ce5f71d2e2a9f4492c4bee"},"File:c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0":{"type":"File","value":"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0","verdict":{"verdict":"malicious","verdict_source":"domain reputation data","reasons":["reported malicious domain"]},"filetype":"PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 9 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81":{"type":"File","value":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81"},"Ip:121.127.253.206":{"type":"Ip","value":"121.127.253.206"}},"chains":[{"id":"1543363796047930954","root":"File:c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0","edges":[{"edge_kind":"contacted_domain","from_key":"File:c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0","to_key":"Domain:3a4a2768fc1a5fdaeb08980bc76db7dd8bddd1a7262b8120fe858d5aea4811d5"}],"verdict":{"verdict":"malicious","verdict_source":"domain reputation data","reasons":["reported malicious domain"]}},{"id":"sandbox_network","root":"File:c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0","edges":[{"edge_kind":"contacted_ip","from_key":"File:c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0","to_key":"Ip:121.127.253.206"},{"edge_kind":"contacted_domain","from_key":"File:c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0","to_key":"Domain:3a4a2768fc1a5fdaeb08980bc76db7dd8bddd1a7262b8120fe858d5aea4811d5"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0","edges":[{"edge_kind":"extracted","from_key":"File:c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0","to_key":"File:de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81"},{"edge_kind":"extracted","from_key":"File:c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0","to_key":"File:646665cf2610612e2d72dd0923b1e2c1395b21ef17ce5f71d2e2a9f4492c4bee"},{"edge_kind":"extracted","from_key":"File:c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0","to_key":"File:de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81"},{"edge_kind":"extracted","from_key":"File:c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0","to_key":"File:45b0e2dbdb30922fa1279c1e1e6cc7606970116f6d6440614e961cb0fc161ef0"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":14,"spawned_processes_count":14,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":44,"imported_dlls_count":79,"dropped_files_count":0,"extracted_files_count":4,"files_written_count":15,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":1,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":3,"embedded_ips_count":0,"embedded_domains_count":1,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["new_domain","evasive","malicious"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"6a87c407f9c6ad431e0f3d15","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Yogi","contacted_countries":["HKG"],"submit_name":"c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll","analysis_start_time":"2026-08-21T03:20:41+00:00","indicators_count":{"informative":208,"suspicious":59,"malicious":9},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"121.127.253.206","port":8856,"protocol":"TCP","country":"Hong Kong SAR China","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]}],"dns_resolutions":[{"domain":"fshsjlk.cc","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]}],"http_requests":null,"embedded_domains":[{"value":"fshsjlk.cc","sources":[{"report_type":"qsp","report_id":""}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}],"processes":[{"pid":8132,"ppid":0,"name":"","command_line":"","normalized_path":"","uid":"00000000-00008132"},{"pid":6368,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\",#1","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00006368","icon":"$79"},{"pid":8384,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\",#3","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00008384","icon":"$7a"},{"pid":7528,"ppid":8384,"name":"taskkill.exe","command_line":"taskkill /f /im cmd.exe","sha256":"ea3a07c527f431d3c1ae733cf0f1a1c2e221079fdd36f1c56bf71e5eeb96ff1b","normalized_path":"%WINDIR%\\SysWOW64\\taskkill.exe","parent_uid":"00000000-00008384","uid":"00000000-00007528"},{"pid":8752,"ppid":8384,"name":"cmd.exe","command_line":"/c start \"\" /B cmd /C %TEMP%\\S-1-5-21-735145574-3570218355-1207367261\\S-1-5-21-735145574-3570218355-1207367261.CMD","sha256":"4c3ea4c44aab74350355c419826b8c9e6172c3bd8f0bb5817ecf7be50b629051","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00008384","uid":"00000000-00008752"},{"pid":6948,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\",#2","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00006948","icon":"$7b"},{"pid":4828,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\",#4","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00004828","icon":"$7c"},{"pid":612,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\",#5","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00000612","icon":"$7d"},{"pid":2976,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\",#6","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00002976","icon":"$7e"},{"pid":1332,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\",#7","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00001332","icon":"$7f"},{"pid":7940,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\",#8","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00007940","icon":"$80"},{"pid":4972,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\",#10","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00004972","icon":"$81"},{"pid":2568,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\",#9","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00002568","icon":"$82"},{"pid":2188,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll\",#11","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00002188","icon":"$83"}],"all_imported_dlls":["ucrtbase.dll","oleaut32.dll","netutils.dll","msctf.dll","wow64.dll","powrprof.dll","mpr.dll","ole32.dll","comctl32.dll","oledlg.dll","ntmarta.dll","oleacc.dll","gdi32full.dll","IPHLPAPI.DLL","fltLib.dll","mswsock.dll","KernelBase.dll","shell32.dll","cfgmgr32.dll","combase.dll","imagehlp.dll","winmmbase.dll","wbemsvc.dll","kernel32.dll","kernel.appcore.dll","dwmapi.dll","pnrpnsp.dll","winsta.dll","wow64cpu.dll","imm32.dll","framedynos.dll","setupapi.dll","c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0.dll","nlaapi.dll","dbghelp.dll","ntdll.dll","windows.storage.dll","bcrypt.dll","sfc_os.dll","fastprox.dll","uxtheme.dll","dnsapi.dll","wbemprox.dll","user32.dll","msvcrt.dll","win32u.dll","sechost.dll","wbemcomn.dll","bcryptprimitives.dll","advapi32.dll","GdiPlus.dll","clbcatq.dll","wow64win.dll","sfc.dll","ws2_32.dll","msvcp140.dll","msimg32.dll","version.dll","wmiutils.dll","apphelp.dll","SHCore.dll","rpcrt4.dll","sspicli.dll","rasadhlp.dll","srvcli.dll","cryptbase.dll","shlwapi.dll","NapiNSP.dll","AcLayers.dll","msvcp_win.dll","vcruntime140.dll","cryptsp.dll","winmm.dll","nsi.dll","winrnr.dll","FWPUCLNT.DLL","gdi32.dll","profapi.dll","VxSSL32.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"NVDisplay.Container.nvi.exe","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"name":"S-1-5-21-735145574-3570218355-1207367261.CMD","sha256":"646665cf2610612e2d72dd0923b1e2c1395b21ef17ce5f71d2e2a9f4492c4bee","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"name":"S-1-5-21-735145574-3570218355-1207367261.eXe","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"name":"S-1-5-21-735145574-3570218355-1207367261.CMD.ini","sha256":"45b0e2dbdb30922fa1279c1e1e6cc7606970116f6d6440614e961cb0fc161ef0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"path":"%ALLUSERSPROFILE%\\NvContainer.Session.{F1E59978-E49F-4ADA-BEB7-DAF9D36905D6}\\nvcontainersession.nvi.pif\\NVDisplay.Container.nvi.exe","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"path":"%ALLUSERSPROFILE%\\NvContainer.Session.{FB6A8D0A-A463-482E-9894-6E22443FE51D}\\nvcontainersession.nvi.pif\\NVDisplay.Container.nvi.exe","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"path":"%TEMP%\\S-1-5-21-735145574-3570218355-1207367261\\S-1-5-21-735145574-3570218355-1207367261.eXe","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"path":"%TEMP%\\S-1-5-21-735145574-3570218355-1207367261\\S-1-5-21-735145574-3570218355-1207367261.CMD.ini","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"path":"%TEMP%\\S-1-5-21-735145574-3570218355-1207367261\\S-1-5-21-735145574-3570218355-1207367261.CMD","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"path":"%ALLUSERSPROFILE%\\NvContainer.Session.{76D42E9E-E502-47C9-8364-ABD9318C6752}\\nvcontainersession.nvi.pif\\NVDisplay.Container.nvi.exe","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"path":"%ALLUSERSPROFILE%\\NvContainer.Session.{2D091FB6-3601-4E2C-8DA0-957318AFDEF0}\\nvcontainersession.nvi.pif\\NVDisplay.Container.nvi.exe","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"path":"%ALLUSERSPROFILE%\\NvContainer.Session.{DE2F907C-64B8-4C9D-BB22-CBA153708D41}\\nvcontainersession.nvi.pif\\NVDisplay.Container.nvi.exe","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"path":"%ALLUSERSPROFILE%\\NvContainer.Session.{B43C0F53-C23A-4AF6-A7E1-51628C9AA0EB}\\nvcontainersession.nvi.pif\\NVDisplay.Container.nvi.exe","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"path":"%ALLUSERSPROFILE%\\NvContainer.Session.{AEB845D3-164B-42DF-967F-E5812BEFA07C}\\nvcontainersession.nvi.pif\\NVDisplay.Container.nvi.exe","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"path":"%ALLUSERSPROFILE%\\NvContainer.Session.{ECA141CF-9DD5-458A-B577-7F397C35A510}\\nvcontainersession.nvi.pif\\NVDisplay.Container.nvi.exe","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"path":"%ALLUSERSPROFILE%\\NvContainer.Session.{BFFC80E0-8127-466A-9A65-AC60551DB29D}\\nvcontainersession.nvi.pif\\NVDisplay.Container.nvi.exe","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"path":"%ALLUSERSPROFILE%\\NvContainer.Session.{C9A6A134-A801-48BB-9CD1-A2AAC8D0CE62}\\nvcontainersession.nvi.pif\\NVDisplay.Container.nvi.exe","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"path":"%ALLUSERSPROFILE%\\NvContainer.Session.{76302604-3989-448B-B2FC-1D27F1533A08}\\nvcontainersession.nvi.pif\\NVDisplay.Container.nvi.exe","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKLMHKLM\\SOFTWARE\\IPDATES_I4\\IPDATES_I4","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6368:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6368:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"name":"Local\\SM0:6368:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"name":"B7CD47736AE70B846B2D71538483C479AC32026D7A7DD4528966F91FE3E9F92FDA45112612AD4F46A31B885D7B21C1D801BE16581E22B5FF36EAE45006F620200415368506E811EC7DBEDCA8B5CBCA901B026AE47362236AEB2AE5B59C2ADA3DC22E7C9412F9B18CCC5CAAD248303BA1A6B97143AE7BB87AB23BED54EB6E083D2F3AB6C3E86916D2E4E6A196F55DD3B3DCE2597F6EA743F629255DBC70E7A2D3320A87B37687AB654FACE8A319A724A5E87B395DF9A07D11DE89F931F16A8F335D8C2EC6CBF1DBA1DD6E59AA7DE","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"name":"SM0:6368:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\B7CD47736AE70B846B2D71538483C479AC32026D7A7DD4528966F91FE3E9F92FDA45112612AD4F46A31B885D7B21C1D801BE16581E22B5FF36EAE45006F620200415368506E811EC7DBEDCA8B5CBCA901B026AE47362236AEB2AE5B59C2ADA3DC22E7C9412F9B18CCC5CAAD248303BA1A6B97143AE7BB87AB23BED54EB6E083D2F3AB6C3E86916D2E4E6A196F55DD3B3DCE2597F6EA743F629255DBC70E7A2D3320A87B37687AB654FACE8A319A724A5E87B395DF9A07D11DE89F931F16A8F335D8C2EC6CBF1DBA1DD6E59AA7DE","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8384:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8384:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"name":"SM0:8384:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"name":"Local\\SM0:8384:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7528:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"name":"SM0:7528:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"name":"Local\\SM0:6948:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"name":"SM0:6948:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6948:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6948:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"name":"SM0:4828:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"name":"Local\\SM0:4828:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4828:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4828:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:612:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:612:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"name":"SM0:612:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"name":"Local\\SM0:612:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2976:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2976:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"name":"SM0:2976:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"name":"Local\\SM0:2976:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1332:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1332:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"name":"Local\\SM0:1332:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"name":"SM0:1332:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"name":"SM0:7940:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"name":"Local\\SM0:7940:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7940:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7940:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4972:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4972:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"name":"Local\\SM0:4972:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"name":"SM0:4972:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"name":"SM0:2568:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"name":"Local\\SM0:2568:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2568:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2568:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a87c407f9c6ad431e0f3d15"}]}]}},"report_ids":{"sandbox_job_ids":["6a87c407f9c6ad431e0f3d15"]}}}]]}] 2c:[["$","title","0",{"children":"Malicious Yogi.Generic Sample c5e82fca91a7… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample c5e82fca91a7…. Malware family: Yogi.Generic. Threat score 100/100. 13/28 AV engines flagged this file. 9 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0"}],["$","meta","4",{"property":"og:title","content":"Malicious Yogi.Generic Sample c5e82fca91a7… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample c5e82fca91a7…. Malware family: Yogi.Generic. Threat score 100/100. 13/28 AV engines flagged this file. 9 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/c5e82fca91a7b8140781eecbe9f709e96eed638deea3acd5f0ca35ef79a221c0"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Yogi.Generic Sample c5e82fca91a7… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample c5e82fca91a7…. Malware family: Yogi.Generic. Threat score 100/100. 13/28 AV engines flagged this file. 9 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L84","11",{}]] 32:null