34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 5b:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 33:T4d2,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Dacic.D6DFC400.A.Generic Sample d05a2053a4e0… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample d05a2053a4e0…. Malware family: Dacic.D6DFC400.A.Generic. Threat score 100/100. 20/27 AV engines flagged this file. 4 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/d05a2053a4e0f1e22debe07c069c8a51e42fd481b1fe39e118feb3346bcf485d","keywords":["Malicious","Dacic.D6DFC400.A.Generic","malware analysis","sandbox report","threat intelligence","d05a2053a4e0f1e22debe07c069c8a51e42fd481b1fe39e118feb3346bcf485d"],"about":{"@type":"SoftwareApplication","name":"1520e1599ccc2f116ca0f89e5a935fe0.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"d05a2053a4e0f1e22debe07c069c8a51e42fd481b1fe39e118feb3346bcf485d","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Dacic.D6DFC400.A.Generic","antivirusDetections":{"malicious":20,"total":27},"behavioralIndicators":{"malicious":4,"suspicious":19},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T916,"1520e1599ccc2f116ca0f89e5a935fe0.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\INPROCSERVER32") "1520e1599ccc2f116ca0f89e5a935fe0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\INPROCSERVER32") "1520e1599ccc2f116ca0f89e5a935fe0.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\INPROCHANDLER32") "1520e1599ccc2f116ca0f89e5a935fe0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\INPROCHANDLER32") "1520e1599ccc2f116ca0f89e5a935fe0.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\INPROCHANDLER") "1520e1599ccc2f116ca0f89e5a935fe0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\INPROCHANDLER") "1520e1599ccc2f116ca0f89e5a935fe0.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\TREATAS") "1520e1599ccc2f116ca0f89e5a935fe0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\TREATAS") "1520e1599ccc2f116ca0f89e5a935fe0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\INPROCSERVER32") "1520e1599ccc2f116ca0f89e5a935fe0.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\LOCALSERVER32") "1520e1599ccc2f116ca0f89e5a935fe0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\LOCALSERVER32") "1520e1599ccc2f116ca0f89e5a935fe0.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\LOCALSERVER") "1520e1599ccc2f116ca0f89e5a935fe0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\LOCALSERVER") "1520e1599ccc2f116ca0f89e5a935fe0.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\ELEVATION") "1520e1599ccc2f116ca0f89e5a935fe0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\ELEVATION")37:T4e0,"1520e1599ccc2f116ca0f89e5a935fe0.exe" queried SystemProcessInformation at 00000000-00007332-00000C15-689849586 [PID: 7332] "1520e1599ccc2f116ca0f89e5a935fe0.exe" queried SystemProcessInformation at 00000000-00007332-00000C15-689859033 [PID: 7332] "1520e1599ccc2f116ca0f89e5a935fe0.exe" queried SystemProcessInformation at 00000000-00007332-00000C15-690062404 [PID: 7332] "1520e1599ccc2f116ca0f89e5a935fe0.exe" queried SystemProcessInformation at 00000000-00007332-00000C15-690071724 [PID: 7332] "1520e1599ccc2f116ca0f89e5a935fe0.exe" queried SystemProcessInformation at 00000000-00007332-00000C15-690176996 [PID: 7332] "1520e1599ccc2f116ca0f89e5a935fe0.exe" queried SystemProcessInformation at 00000000-00007332-00000C15-690186426 [PID: 7332] "1520e1599ccc2f116ca0f89e5a935fe0.exe" queried SystemProcessInformation at 00000000-00007332-00000C15-690742942 [PID: 7332] "1520e1599ccc2f116ca0f89e5a935fe0.exe" queried SystemProcessInformation at 00000000-00007332-00000C15-690752804 [PID: 7332] "1520e1599ccc2f116ca0f89e5a935fe0.exe" queried SystemProcessInformation at 00000000-00007332-00000C15-692718355 [PID: 7332] "1520e1599ccc2f116ca0f89e5a935fe0.exe" queried SystemProcessInformation at 00000000-00007332-00000C15-692732179 [PID: 7332]38:T587,Found reference to API "SendMessage" (Indicator: "sendmessage"; File: "1520e1599ccc2f116ca0f89e5a935fe0.exe") Found reference to API "FindWindow" (Indicator: "findwindow"; File: "1520e1599ccc2f116ca0f89e5a935fe0.exe") Found reference to API "SendMessageA" (Indicator: "sendmessage"; File: "1520e1599ccc2f116ca0f89e5a935fe0.exe") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; File: "1520e1599ccc2f116ca0f89e5a935fe0.exe") Found reference to API "SendMessageTimeout" (Indicator: "sendmessage"; Source: "00000000-00007332-00000C2C-691903980") Found reference to API "SendMessageTimeoutA" (Indicator: "sendmessage"; Source: "00000000-00007332-00000C2C-691904022") Found reference to API "SendMessage" (Indicator: "sendmessage"; Source: "00000000-00007332.00000000.165054.00EE2000.00000002.mdmp") Found reference to API "FindWindow" (Indicator: "findwindow"; Source: "00000000-00007332.00000000.165054.00EE2000.00000002.mdmp") Found reference to API "SendMessageA" (Indicator: "sendmessage"; Source: "00000000-00007332.00000000.165054.00EE2000.00000002.mdmp") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; Source: "00000000-00007332.00000000.165054.00EE2000.00000002.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00007332.00000000.165054.03440000.00000004.mdmp")39:T266e,"1520e1599ccc2f116ca0f89e5a935fe0.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000009e29b07740c845030000000028000000240000000000440360f02f010000000000000000000000000000000000000000d007fc003000000000000000020000000000fc0000000000f2ce0000000000000000000058c7450348bb44030400000000000000200000000000fc00d001fc00d40bfc0000000000d00bfc000000000058f02f0150f5af7740c84503c0f02f010cf12f01 (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000fc009c0afc0000000000980afc006d00650098f72f015916b0774000000000000000000000000000440320f82f0148000000000000000000000009000000020000000000440340000000000000005a000000bcf72f01ee13b07700000000ee13b07700000000000000002c8d14742cf82f0100000000f8f72f01cc47be730000440300000000eb47be73233b069e010000002c8d1474000000000c00000000000000205c357634f82f010c1a0d74ffffffffeb47be734a48be7300004403000000004000000040f82f018543be73087545038848be739b34069e010000002c8d147400000000cb0000000200000068f82f01b0fc0e74ffffffff8848be73 (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000020000000000fc009c0afc0000000000980afc006d00650098f72f015916b0774000000000000000000000000000440320f82f0148000000000000000000000009000000020000000000440340000000000000005a000000bcf72f01ee13b07700000000ee13b07700000000000000002c8d14742cf82f0100000000f8f72f01cc47be730000440300000000eb47be73233b069eaf67cd73233b069e010000002c8d14740000000060f82f0114f82f0158750a74ffffffffaf67cd73cd67cd73fb34069e010000002c8d14740000000060f82f013cf82f0158760a74ffffffffcd67cd73eb67cd739334069e010000002c8d14740000000060f82f01 (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000450300000000000000000000000000000000b0ee4503688f4503000000000000000001000000708f4503c0364403000000000000000094f62f013fc5b0770000000094f62f015dc5b077d4ee450328ff4503ccb6dc7308d51474000000000000000000000000bcee45032a00147428ff4503e0f62f01f301b277ccf62f01020000000096dc7328ff4503c0f62f0114d51474e072ab751e02b277e99cb177b0ee45032a0000000096dc73bacb2bccb616f34c8990d74c2e8af5001b9aa2391cf72f0184b6dc730096dc7308754503bcb6dc73010000001cf72f0199b6dc731cd514740100000008754503b050ab7500000000000000000000000048f82f01 (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000060e92f0104e92f01226e877400004103000000002d6e8774391db6442d000000ecb7437688e92f010000fc0040264703702d46031300000080000000c8e82f010000fc004ce92f0170c88874c5851431feffffff2d000000d0cc5276270000001ce92f01856a89741c238e745ce92f01f85f897408000000bb698874b2698874611db6442d000000ecb7437627000000d0cc527630e92f012d000000d0cc52762700000060e92f01856a89741c238e74a8e92f017e8a5176ee8c5176738a517618b2f0602d000000ecb7437627000000d0cc52763c274103d026410318b2f06070e92f01fc528f765cea2f01e084517688aa5217feffffff738a5176 (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000ffffd39cc373199ec3736323069eb890480370284603010000000000000000000000000000000000000000000000000000000000000000000000d2000000d20000000c0000003891480301000000020000000200000010000000d426147401000000383d1474d4ef2f010100000064ef2f017e44be73b00d470394ef2f013f44be735844be734f23069eb8904803d4ef2f01010000000000000000000000b0ef2f01e88b0c74ffffffff5844be731d44be736723069eb890480318654703010000001241c4732723069eb89048037028460300000000fb9ec3732f23069eb89048037028460300000000383d14740000000069a7c37300000000b8904803 (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000002f01a4ee2f01010000000000000002000000005bab75000000000000000000e0000000002c05d0ee2f01de812b76180300000400000000000000000000000000000000000000ffffffff38ef2f014336c47318030000040000000000000000000000000000007136c473e323069e02000000a0ef2f010000000001000000030000002cef2f018ecd29761c0300000000000002000000000000000000000002000000a0ef2f010000000044ef2f0130edc47380002c050000000000dc00005cef2f0195f0c47380002c0500002c050000000000dc00007cef2f0187f1c47380002c0500002c050000000000dc0000185a470300000000e0ef2f0163efc473 (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000ffffd39cc373199ec373ff04069e18f04803b021460301000000000000000000000000000000000000000000000000000000000000000000000004010000040100000c000000b879490301000000020000000200000010000000d426147401000000383d147440c82f0101000000d0c72f017e44be73b00d470300c82f013f44be735844be73db04069e18f0480340c82f010100000000000000000000001cc82f01e88b0c74ffffffff5844be731d44be73f304069e18f04803385e4703010000001241c473b304069e18f04803b021460300000000fb9ec373bb04069e18f04803b021460300000000383d14740000000069a7c3730000000018f04803 (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000ffffd39cc373199ec3736b09069e3810490350244603010000000000000000000000000000000000000000000000000000000000000000000000ca000000ca0000000c00000098af490301000000020000000200000010000000d426147401000000383d1474ccc52f01010000005cc52f017e44be73b00d47038cc52f013f44be735844be735709069e38104903ccc52f01010000000000000000000000a8c52f01e88b0c74ffffffff5844be731d44be736f09069e3810490348604703010000001241c4732f09069e381049035024460300000000fb9ec3733709069e381049035024460300000000383d14740000000069a7c3730000000038104903 (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000ffffd39cc373199ec373a30e069e48fb4903b027460301000000000000000000000000000000000000000000000000000000000000000000000002010000020100000c000000482c490301000000020000000200000010000000d426147401000000383d147494c22f010100000024c22f017e44be73b00d470354c22f013f44be735844be738f0e069e48fb490394c22f0101000000000000000000000070c22f01e88b0c74ffffffff5844be731d44be73a70e069e48fb490308584703010000001241c473670e069e48fb4903b027460300000000fb9ec3736f0e069e48fb4903b027460300000000383d14740000000069a7c3730000000048fb4903 (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000ffffd39cc373199ec373df0c069e602a4a0310284603010000000000000000000000000000000000000000000000000000000000000000000000ea000000ea0000000c000000e02a4a0301000000020000000200000010000000d426147401000000383d147420c02f0101000000b0bf2f017e44be73b00d4703e0bf2f013f44be735844be733b73069e602a4a0320c02f01010000000000000000000000fcbf2f01e88b0c74ffffffff5844be731d44be73d30c069e602a4a03785b4703010000001241c473930c069e602a4a031028460300000000fb9ec3739b0c069e602a4a031028460300000000383d14740000000069a7c37300000000602a4a03 (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000ffffd39cc373199ec373372ff498e86649031025460301000000000000000000000000000000000000000000000000000000000000000000000002010000020100000c000000e87b490301000000020000000200000010000000d426147401000000383d147408e4dd070100000098e3dd077e44be73f0354a03c8e3dd073f44be735844be73132ff498e866490308e4dd07010000000000000000000000e4e3dd07e88b0c74ffffffff5844be731d44be732b2ff498e8664903f8604703010000001241c473eb28f498e86649031025460300000000fb9ec373f328f498e86649031025460300000000383d14740000000069a7c37300000000e8664903 (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000ffffd39cc373199ec373132cf498b0134b03f0234603010000000000000000000000000000000000000000000000000000000000000000000000da000000da0000000c000000d83b4b0301000000020000000200000010000000d426147401000000383d1474e4e0dd070100000074e0dd077e44be73f0354a03a4e0dd073f44be735844be737f2cf498b0134b03e4e0dd07010000000000000000000000c0e0dd07e88b0c74ffffffff5844be731d44be73172cf498b0134b03e8694703010000001241c473d72df498b0134b03f023460300000000fb9ec373df2df498b0134b03f023460300000000383d14740000000069a7c37300000000b0134b03 (UID: 00000000-00007332)3a:Taee,"1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetVersionExA" with parameter 940000000600000002000000f023000002000000002b740334f22f0108000000c8f12f01636db47300007403000000006c6db47336b2a315d8d7147438f22f0134f22f0100000000000000000000000000000000000000008cf12f01d8d7147438f22f0134f22f01ccf12f01ff23b473c83bbd730cf22f013117b4730800000016e9b277270eb277ffffffff24000000f4f12f01 (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000000000005c000000000063000000000000000100000074001400000098824503000000000100000001000000000000002c000000707f460300000000140000000a000000000000000000000000006f00184e4503140000000000000000000000c8b34503000000000000000000000000000069000000000003000003 (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetVersionExA" with parameter 940000000600000002000000f023000002000000000000001800000000000000000000000300000003000000000074030c0000000000000000000000a0eadd07ee13b0770c000000ee13b0770000000000000000000000000f7140a0b013b077834db47300007403000000000c0000007cf4dd07c8efdd07d8eadd0700000000300eb7730c000000cd52f4706416f47000000000 (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000300000003000000000074030c000000000000006da90a762cebdd07ee13b0770c000000ee13b077000000000000000000000000ffffdf70b598705cb013b077834db47300007403000000000c000000f0eddd0780f0dd0764ebdd0700000000300eb7730c000000954ff470184951032cefdd07 (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000300000003000000000074030c0000000000000090e8dd0794eddd07ee13b0770c000000ee13b077000000000000000000000000e173ad5b263ce970b013b077834db47300007403000000000c00000048f0dd07b0f0dd07cceddd0700000000300eb7730c00000048f0dd07fe7ddd702d9e705c (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000300000003000000000074030c00000000000000a0e8dd07a4eddd07ee13b0770c000000ee13b077000000000000000000000000e173ad5b263ce970b013b077834db47300007403000000000c00000058f0dd07c0f0dd07dceddd0700000000300eb7730c00000058f0dd07fe7ddd703d9e705c (UID: 00000000-00007332)3b:T79f,Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; File: "1520e1599ccc2f116ca0f89e5a935fe0.exe") Found reference to API "GetWindowText" (Indicator: "GetWindowText"; File: "1520e1599ccc2f116ca0f89e5a935fe0.exe") Found reference to API "GetWindowTextA" (Indicator: "GetWindowText"; File: "1520e1599ccc2f116ca0f89e5a935fe0.exe") Found reference to API "GetWindowTextLength" (Indicator: "GetWindowText"; File: "1520e1599ccc2f116ca0f89e5a935fe0.exe") Found reference to API "GetWindowTextLengthA" (Indicator: "GetWindowText"; File: "1520e1599ccc2f116ca0f89e5a935fe0.exe") Found reference to API "FindWindow" (Indicator: "FindWindow"; File: "1520e1599ccc2f116ca0f89e5a935fe0.exe") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00007332.00000000.165054.00EE2000.00000002.mdmp") Found reference to API "GetWindowText" (Indicator: "GetWindowText"; Source: "00000000-00007332.00000000.165054.00EE2000.00000002.mdmp") Found reference to API "GetWindowTextA" (Indicator: "GetWindowText"; Source: "00000000-00007332.00000000.165054.00EE2000.00000002.mdmp") Found reference to API "GetWindowTextLength" (Indicator: "GetWindowText"; Source: "00000000-00007332.00000000.165054.00EE2000.00000002.mdmp") Found reference to API "GetWindowTextLengthA" (Indicator: "GetWindowText"; Source: "00000000-00007332.00000000.165054.00EE2000.00000002.mdmp") Found reference to API "FindWindow" (Indicator: "FindWindow"; Source: "00000000-00007332.00000000.165054.00EE2000.00000002.mdmp") Found reference to API "0185800226,7812,108,,GetWindowTextA,user32.dll,"00:42:58.687",RX=0,PX=0" (Indicator: "GetWindowText"; Source: "00000000-00007332.00000000.165054.03440000.00000004.mdmp") Found reference to API "0185336796,7812,105,,GetForegroundWindow,user32.dll,"00:42:58.687",RX=0,PX=0" (Indicator: "GetForegroundWindow"; Source: "00000000-00007332.00000000.165054.03440000.00000004.mdmp")3c:T653,"1520e1599ccc2f116ca0f89e5a935fe0.exe" queries volume information of an entire harddrive"C:\" at 00000000-00007332-00000C17-692899248 "1520e1599ccc2f116ca0f89e5a935fe0.exe" queries volume information of "C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll" at 00000000-00007332-00000C17-694669806 "1520e1599ccc2f116ca0f89e5a935fe0.exe" queries volume information of "C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll" at 00000000-00007332-00000C17-694669996 "1520e1599ccc2f116ca0f89e5a935fe0.exe" queries volume information of an entire harddrive"C:\" at 00000000-00007332-00000C17-699717401 "1520e1599ccc2f116ca0f89e5a935fe0.exe" queries volume information of an entire harddrive"C:\" at 00000000-00007332-00000C17-701406915 "1520e1599ccc2f116ca0f89e5a935fe0.exe" queries volume information of an entire harddrive"C:\" at 00000000-00007332-00000C17-703315590 "1520e1599ccc2f116ca0f89e5a935fe0.exe" queries volume information of an entire harddrive"C:\" at 00000000-00007332-00000C17-705307327 "1520e1599ccc2f116ca0f89e5a935fe0.exe" queries volume information of an entire harddrive"C:\" at 00000000-00007332-00000C17-709606068 "1520e1599ccc2f116ca0f89e5a935fe0.exe" queries volume information of an entire harddrive"C:\" at 00000000-00007332-00000C17-711276602 "1520e1599ccc2f116ca0f89e5a935fe0.exe" queries volume information of an entire harddrive"C:\" at 00000000-00007332-00000C17-712978891 "1520e1599ccc2f116ca0f89e5a935fe0.exe" queries volume information of an entire harddrive"C:\" at 00000000-00007332-00000C17-7148084893d:T1b1f,"1520e1599ccc2f116ca0f89e5a935fe0.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\mscorlib\7aa13700a6fcdcb57e6cb353e54d0ab9\mscorlib.ni.dll (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ole32.dll (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "LoadLibrary" with a parameter AdvApi32.dll (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System\61e9a201160f8baed9f7e00a4969992e\System.ni.dll (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\5f0a85c2a45c0fb0d1d12e010857a907\Microsoft.VisualBasic.ni.dll (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Drawing\d6163e1c32eba738e42523885580dc48\System.Drawing.ni.dll (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\860a4e79adbd2eb86ade9317e1cd9d2a\System.Windows.Forms.ni.dll (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "LoadLibrary" with a parameter user32 (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Configuration\cd4b9b7e793d3fe3ad5c9542420992be\System.Configuration.ni.dll (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Xml\c7a2f551c65c81870e822e9e134513f9\System.Xml.ni.dll (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Management\4bce21f4feaffa3bf49bd0bf3f73bb80\System.Management.ni.dll (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\\wminet_utils.dll (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\OLEAUT32.dll (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "LoadLibrary" with a parameter shfolder.dll (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "LoadLibrary" with a parameter C:\avicap32.dll (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "LoadLibrary" with a parameter avicap32.dll (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "LoadLibrary" with a parameter sxs.dll (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\CustomMarshalers\a09860bedb30c5d398a308a74c74a680\CustomMarshalers.ni.dll (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\oleaut32 (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00007332)3e:T9b12,"1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionAndSpinCount (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter IsProcessorFeaturePresent (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter _set_error_mode (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter ?set_terminate@@YAP6AXXZP6AXXZ@Z (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter _get_terminate (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter FindActCtxSectionStringW (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter SetLoadedByMscoree (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter GetCLRFunction (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter GetTraceLoggerHandle (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter GetTraceEnableLevel (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter GetTraceEnableFlags (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter TraceEvent (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter IEE (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter IEE_RetAddr (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter GetStartupFlags (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter GetStartupFlags_RetAddr (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter GetHostConfigurationFile (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter GetHostConfigurationFile_RetAddr (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter GetCORVersion_RetAddr (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter GetCORVersion (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter GetCORSystemDirectory (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter GetCORSystemDirectory_RetAddr (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter RtlUnwind (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter SetThreadStackGuarantee (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter AddVectoredContinueHandler (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter RemoveVectoredContinueHandler (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter GetWriteWatch (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter ResetWriteWatch (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter CreateMemoryResourceNotification (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter QueryMemoryResourceNotification (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter GetVersionEx (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter GetVersionExW (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter CryptAcquireContextA (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter CryptGetHashParam (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter CryptExportKey (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter CryptGenKey (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter CryptGetKeyParam (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter CryptVerifySignatureA (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter CryptSignHashA (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter CryptGetProvParam (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter CryptGetUserKey (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter CryptEnumProvidersA (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter GetMetaDataInternalInterface (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter GetMetaDataInternalInterface_RetAddr (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter lstrlen (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter lstrlenW (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter RegSetValueEx (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter CreateMutex (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter CreateMutexW (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter SendMessageTimeout (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter SendMessageTimeoutA (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter SwitchToThread (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter GetAsyncKeyState (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter RegisterWindowMessage (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter RegisterWindowMessageW (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter GetKeyState (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter RegisterClass (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter RegisterClassW (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter CreateWindowEx (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter SetWindowLong (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter SetWindowLongW (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter GetWindowLong (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter GetWindowLongW (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter CallWindowProc (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter CallWindowProcW (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter GetParent (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter OleInitialize (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter CoRegisterMessageFilter (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter PeekMessage (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter PeekMessageW (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter SetErrorMode (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter ND_RI2 (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter ND_RI2_RetAddr (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter WSASocket (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter setsockopt (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter WSAEventSelect (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter ioctlsocket (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter closesocket (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter GetComputerName (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter GetComputerNameW (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter ConvertStringSecurityDescriptorToSecurityDescriptor (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter ConvertStringSecurityDescriptorToSecurityDescriptorW (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter CreateFileMapping (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter CreateFileMappingW (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter MapViewOfFile (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter VirtualQuery (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter CreateWellKnownSidW (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter OpenMutex (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter OpenMutexW (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter GetProcessTimes (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter GetProcessTimesW (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter getaddrinfo (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter freeaddrinfo (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter WSAConnect (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter GetVolumeInformationA (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter CoGetObjectContext (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter LoadLibrary (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter ResetSecurity (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter SetSecurity (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter BlessIWbemServices (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter BlessIWbemServicesObject (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter GetPropertyHandle (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter WritePropertyValue (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter Clone (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter VerifyClientKey (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter GetQualifierSet (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter Get (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter Put (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter Delete (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter GetNames (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter BeginEnumeration (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter Next (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter EndEnumeration (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter GetPropertyQualifierSet (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter GetObjectText (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter SpawnDerivedClass (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter SpawnInstance (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter CompareTo (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter GetPropertyOrigin (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter InheritsFrom (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter GetMethod (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter PutMethod (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter DeleteMethod (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter BeginMethodEnumeration (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter NextMethod (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter EndMethodEnumeration (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter GetMethodQualifierSet (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter GetMethodOrigin (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter QualifierSet_Get (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter QualifierSet_Put (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter QualifierSet_Delete (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter QualifierSet_GetNames (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter QualifierSet_BeginEnumeration (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter QualifierSet_Next (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter QualifierSet_EndEnumeration (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter GetCurrentApartmentType (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter GetDemultiplexedStub (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter CreateInstanceEnumWmi (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter CreateClassEnumWmi (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter ExecQueryWmi (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter ExecNotificationQueryWmi (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter PutInstanceWmi (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter PutClassWmi (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter CloneEnumWbemClassObject (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter ConnectServerWmi (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter GetErrorInfo (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter Initialize (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter IIDFromString (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter GetProcessWorkingSetSize (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter GetProcessWorkingSetSizeW (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter SetProcessWorkingSetSize (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter SetProcessWorkingSetSizeW (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter SysStringLen (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter ZeroMemory (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter ZeroMemoryA (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter RtlZeroMemory (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter ImmCreateContext (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter ImmDestroyContext (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter ImmNotifyIME (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringA (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringA (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringW (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringW (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter ImmSetCandidateWindow (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter capGetDriverDescriptionA (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter CreateBindCtx (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter MkParseDisplayName (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter BindMoniker (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter GetForegroundWindow (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter GetWindowTextLengthA (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter GetWindowTextA (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter SxsLookupClrGuid (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter _CorDllMain_RetAddr (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry_RetAddr (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry_RetAddr (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry_RetAddr (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter VariantInit (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter VariantClear (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter RegCreateKeyEx (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter RegQueryInfoKey (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter send (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter select (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "GetProcAddress" with a parameter shutdown (UID: 00000000-00007332)3f:T24f0,Found reference to API (Indicator: "CompareString"; File: "1520e1599ccc2f116ca0f89e5a935fe0.exe") Found reference to API (Indicator: "Sleep"; File: "1520e1599ccc2f116ca0f89e5a935fe0.exe") Found reference to API (Indicator: "GetProcessById"; File: "1520e1599ccc2f116ca0f89e5a935fe0.exe") Found reference to API (Indicator: "GetObject"; File: "1520e1599ccc2f116ca0f89e5a935fe0.exe") Found reference to API (Indicator: "GetTempPath"; File: "1520e1599ccc2f116ca0f89e5a935fe0.exe") Found reference to API (Indicator: "SetEnvironmentVariable"; File: "1520e1599ccc2f116ca0f89e5a935fe0.exe") Found reference to API (Indicator: "GetLogicalDrives"; File: "1520e1599ccc2f116ca0f89e5a935fe0.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "1520e1599ccc2f116ca0f89e5a935fe0.exe") Found reference to API (Indicator: "GetForegroundWindow"; File: "1520e1599ccc2f116ca0f89e5a935fe0.exe") Found reference to API (Indicator: "GetVolumeInformation"; File: "1520e1599ccc2f116ca0f89e5a935fe0.exe") Found reference to API (Indicator: "GetVolumeInformationA"; File: "1520e1599ccc2f116ca0f89e5a935fe0.exe") Found reference to API (Indicator: "GetWindowText"; File: "1520e1599ccc2f116ca0f89e5a935fe0.exe") Found reference to API (Indicator: "GetWindowTextA"; File: "1520e1599ccc2f116ca0f89e5a935fe0.exe") Found reference to API (Indicator: "GetWindowTextLength"; File: "1520e1599ccc2f116ca0f89e5a935fe0.exe") Found reference to API (Indicator: "GetWindow"; File: "1520e1599ccc2f116ca0f89e5a935fe0.exe") Found reference to API (Indicator: "SendMessage"; File: "1520e1599ccc2f116ca0f89e5a935fe0.exe") Found reference to API (Indicator: "FindWindow"; File: "1520e1599ccc2f116ca0f89e5a935fe0.exe") Found reference to API (Indicator: "ShowWindow"; File: "1520e1599ccc2f116ca0f89e5a935fe0.exe") Found reference to API (Indicator: "ReleaseDC"; File: "1520e1599ccc2f116ca0f89e5a935fe0.exe") Found reference to API (Indicator: "CreateSolidBrush"; File: "1520e1599ccc2f116ca0f89e5a935fe0.exe") Found reference to API (Indicator: "BitBlt"; File: "1520e1599ccc2f116ca0f89e5a935fe0.exe") Found reference to API (Indicator: "StretchBlt"; File: "1520e1599ccc2f116ca0f89e5a935fe0.exe") Found reference to API (Indicator: "GetDesktopWindow"; File: "1520e1599ccc2f116ca0f89e5a935fe0.exe") Found reference to API (Indicator: "GetWindowDC"; File: "1520e1599ccc2f116ca0f89e5a935fe0.exe") Found reference to API (Indicator: "SelectObject"; File: "1520e1599ccc2f116ca0f89e5a935fe0.exe") Found reference to API (Indicator: "DeleteObject"; File: "1520e1599ccc2f116ca0f89e5a935fe0.exe") Found reference to API (Indicator: "NtSetInformationProcess"; File: "1520e1599ccc2f116ca0f89e5a935fe0.exe") Found reference to API (Indicator: "CreateFile"; File: "1520e1599ccc2f116ca0f89e5a935fe0.exe") Found reference to API (Indicator: "WriteFile"; File: "1520e1599ccc2f116ca0f89e5a935fe0.exe") Found reference to API (Indicator: "EnableWindow"; File: "1520e1599ccc2f116ca0f89e5a935fe0.exe") Found reference to API (Indicator: "GetWindowThreadProcessId"; File: "1520e1599ccc2f116ca0f89e5a935fe0.exe") Found reference to API (Indicator: "GetClassName"; File: "1520e1599ccc2f116ca0f89e5a935fe0.exe") Found reference to API (Indicator: "GetClassNameA"; File: "1520e1599ccc2f116ca0f89e5a935fe0.exe") Found reference to API (Indicator: "SendMessageA"; File: "1520e1599ccc2f116ca0f89e5a935fe0.exe") Found reference to API (Indicator: "EnumChildWindows"; File: "1520e1599ccc2f116ca0f89e5a935fe0.exe") Found reference to API (Indicator: "GetAsyncKeyState"; File: "1520e1599ccc2f116ca0f89e5a935fe0.exe") Found reference to API (Indicator: "GetKeyboardLayout"; File: "1520e1599ccc2f116ca0f89e5a935fe0.exe") Found reference to API (Indicator: "GetKeyboardState"; File: "1520e1599ccc2f116ca0f89e5a935fe0.exe") Found reference to API (Indicator: "MapVirtualKey"; File: "1520e1599ccc2f116ca0f89e5a935fe0.exe") Found reference to API (Indicator: "ToUnicodeEx"; File: "1520e1599ccc2f116ca0f89e5a935fe0.exe") Found reference to API (Indicator: "CompareString"; Source: "00000000-00007332.00000000.165054.00EE2000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00007332.00000000.165054.00EE2000.00000002.mdmp") Found reference to API (Indicator: "GetProcessById"; Source: "00000000-00007332.00000000.165054.00EE2000.00000002.mdmp") Found reference to API (Indicator: "GetObject"; Source: "00000000-00007332.00000000.165054.00EE2000.00000002.mdmp") Found reference to API (Indicator: "GetTempPath"; Source: "00000000-00007332.00000000.165054.00EE2000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariable"; Source: "00000000-00007332.00000000.165054.00EE2000.00000002.mdmp") Found reference to API (Indicator: "GetLogicalDrives"; Source: "00000000-00007332.00000000.165054.00EE2000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00007332.00000000.165054.00EE2000.00000002.mdmp") Found reference to API (Indicator: "GetForegroundWindow"; Source: "00000000-00007332.00000000.165054.00EE2000.00000002.mdmp") Found reference to API (Indicator: "GetVolumeInformation"; Source: "00000000-00007332.00000000.165054.00EE2000.00000002.mdmp") Found reference to API (Indicator: "GetVolumeInformationA"; Source: "00000000-00007332.00000000.165054.00EE2000.00000002.mdmp") Found reference to API (Indicator: "GetWindowText"; Source: "00000000-00007332.00000000.165054.00EE2000.00000002.mdmp") Found reference to API (Indicator: "GetWindowTextA"; Source: "00000000-00007332.00000000.165054.00EE2000.00000002.mdmp") Found reference to API (Indicator: "GetWindowTextLength"; Source: "00000000-00007332.00000000.165054.00EE2000.00000002.mdmp") Found reference to API (Indicator: "GetWindow"; Source: "00000000-00007332.00000000.165054.00EE2000.00000002.mdmp") Found reference to API (Indicator: "SendMessage"; Source: "00000000-00007332.00000000.165054.00EE2000.00000002.mdmp") Found reference to API (Indicator: "FindWindow"; Source: "00000000-00007332.00000000.165054.00EE2000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00007332.00000000.165054.00EE2000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00007332.00000000.165054.00EE2000.00000002.mdmp") Found reference to API (Indicator: "CreateSolidBrush"; Source: "00000000-00007332.00000000.165054.00EE2000.00000002.mdmp") Found reference to API (Indicator: "Beep"; Source: "00000000-00007332.00000000.165054.00EE2000.00000002.mdmp") Found reference to API (Indicator: "BitBlt"; Source: "00000000-00007332.00000000.165054.00EE2000.00000002.mdmp") Found reference to API (Indicator: "StretchBlt"; Source: "00000000-00007332.00000000.165054.00EE2000.00000002.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00007332.00000000.165054.00EE2000.00000002.mdmp") Found reference to API (Indicator: "GetWindowDC"; Source: "00000000-00007332.00000000.165054.00EE2000.00000002.mdmp") Found reference to API (Indicator: "SelectObject"; Source: "00000000-00007332.00000000.165054.00EE2000.00000002.mdmp") Found reference to API (Indicator: "DeleteObject"; Source: "00000000-00007332.00000000.165054.00EE2000.00000002.mdmp") Found reference to API (Indicator: "NtSetInformationProcess"; Source: "00000000-00007332.00000000.165054.00EE2000.00000002.mdmp") Found reference to API (Indicator: "CreateFile"; Source: "00000000-00007332.00000000.165054.00EE2000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00007332.00000000.165054.00EE2000.00000002.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00007332.00000000.165054.00EE2000.00000002.mdmp") Found reference to API (Indicator: "GetWindowThreadProcessId"; Source: "00000000-00007332.00000000.165054.00EE2000.00000002.mdmp") Found reference to API (Indicator: "GetClassName"; Source: "00000000-00007332.00000000.165054.00EE2000.00000002.mdmp") Found reference to API (Indicator: "GetClassNameA"; Source: "00000000-00007332.00000000.165054.00EE2000.00000002.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00007332.00000000.165054.00EE2000.00000002.mdmp") Found reference to API (Indicator: "EnumChildWindows"; Source: "00000000-00007332.00000000.165054.00EE2000.00000002.mdmp") Found reference to API (Indicator: "GetAsyncKeyState"; Source: "00000000-00007332.00000000.165054.00EE2000.00000002.mdmp") Found reference to API (Indicator: "GetKeyboardLayout"; Source: "00000000-00007332.00000000.165054.00EE2000.00000002.mdmp") Found reference to API (Indicator: "GetKeyboardState"; Source: "00000000-00007332.00000000.165054.00EE2000.00000002.mdmp") Found reference to API (Indicator: "MapVirtualKey"; Source: "00000000-00007332.00000000.165054.00EE2000.00000002.mdmp") Found reference to API (Indicator: "ToUnicodeEx"; Source: "00000000-00007332.00000000.165054.00EE2000.00000002.mdmp") Found reference to API (Indicator: "DefWindowProcW"; Source: "00000000-00007332.00000000.165054.05B70000.00000004.mdmp") Found reference to API (Indicator: "DefWindowProcA"; Source: "00000000-00007332.00000000.165054.05B70000.00000004.mdmp") Found reference to API (Indicator: "GetErrorInfo"; Source: "00000000-00007332.00000000.165054.05B70000.00000004.mdmp") Found reference to API (Indicator: "SeDebugPrivilege"; Source: "00000000-00007332.00000000.165054.05B70000.00000004.mdmp")40:T2377,"Software\Microsoft\Windows\CurrentVersion\Run" in Source: 1520e1599ccc2f116ca0f89e5a935fe0.exe "Software\" in Source: 1520e1599ccc2f116ca0f89e5a935fe0.exe "Software\\Microsoft\\Windows\\CurrentVersion\\Run" in Source: 6000015-cctor "Software\\" in Source: 6000026-OK~DLV "cmd /c reg ADD HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System /v EnableLUA /t REG_DWORD /d 0 /f" in Source: 6000042-OK~INS "Software\Microsoft\Windows\CurrentVersion\Run\394f23fb4c8c32d52df2198922e095fd" in Source: 00000000-00007332-00000BC0-692385769 "md /c reg ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f" in Source: 00000000-00007332.00000000.165054.00EE2000.00000002.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Drivers32" in Source: 00000000-00007332.00000000.165054.03440000.00000004.mdmp "e\Software\Microsoft\Windows NT\CurrentVersion\Drivers32" in Source: 00000000-00007332.00000000.165054.03440000.00000004.mdmp ":\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{08D9DFDF-C6F7-404A-A20" in Source: 00000000-00007332.00000000.165054.03440000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}" in Source: 00000000-00007332.00000000.165054.03440000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{172BDD!" in Source: 00000000-00007332.00000000.165054.03440000.00000004.mdmp "Registry\Machine\Software\Classes\C[" in Source: 00000000-00007332.00000000.165054.03440000.00000004.mdmp "stry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00007332.00000000.165054.03440000.00000004.mdmp "_LOCAL_MACHINE\Software\Microsoft\Windows NT\Cur" in Source: 00000000-00007332.00000000.165054.03440000.00000004.mdmp "Read?HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007332.00000000.165054.03440000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|Plu" in Source: 00000000-00007332.00000000.165054.03440000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|ProductId" in Source: 00000000-00007332.00000000.165054.03440000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows\CurrentVersion|CurrentType" in Source: 00000000-00007332.00000000.165054.03440000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\PriorityControl|Win32PrioritySeparation" in Source: 00000000-00007332.00000000.165054.03440000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows\CurrentVersion|RegisteredOrganization" in Source: 00000000-00007332.00000000.165054.03440000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\ProductOptions|ProductSuite" in Source: 00000000-00007332.00000000.165054.03440000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|Plus! ProductId" in Source: 00000000-00007332.00000000.165054.03440000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|Plus! VersionNumber" in Source: 00000000-00007332.00000000.165054.03440000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|RegisteredOwner" in Source: 00000000-00007332.00000000.165054.03440000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\PriorityControl|Win32PrioritySeparatio" in Source: 00000000-00007332.00000000.165054.03440000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00007332.00000000.165054.05B70000.00000004.mdmp "cmd /c reg ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f" in Source: 00000000-00007332.00000000.165054.05B70000.00000004.mdmp "System\CurrentControlSet\Control\Session Manager\Environment" in Source: 00000000-00007332.00000000.165054.05B70000.00000004.mdmp "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\." in Source: 00000000-00007332.00000000.165054.05B70000.00000004.mdmp "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00007332.00000000.165054.05B70000.00000004.mdmp "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\394f23fb4c8c32d52df2198922e095fd" in Source: 00000000-00007332.00000000.165054.05B70000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\." in Source: 00000000-00007332.00000000.165054.05B70000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00007332.00000000.165054.05B70000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\394f23fb4c8c32d52df2198922e095fd" in Source: 00000000-00007332.00000000.165054.05B70000.00000004.mdmp "Software\" in Source: 00000000-00007332.00000000.165054.05B70000.00000004.mdmp "Software\394f23fb4c8c32d52df2198922e095fd" in Source: 00000000-00007332.00000000.165054.05B70000.00000004.mdmp "HKEY_CURRENT_USER\Software\394f23fb4c8c32d52df2198922e095fd\." in Source: 00000000-00007332.00000000.165054.05B70000.00000004.mdmp "Software\Microsoft\.NETFramework" in Source: 00000000-00007332.00000000.165054.05B70000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\." in Source: 00000000-00007332.00000000.165054.05B70000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework" in Source: 00000000-00007332.00000000.165054.05B70000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\DbgJITDebugLaunchSetting" in Source: 00000000-00007332.00000000.165054.05B70000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\DbgManagedDebugger" in Source: 00000000-00007332.00000000.165054.05B70000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Run\394f23fb4c8c32d52df2198922e095fd" in Source: 00000000-00007332.00000000.165054.05B70000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007332.00000000.165054.05B70000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\." in Source: 00000000-00007332.00000000.165054.05B70000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007332.00000000.165054.05B70000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\InstallationType" in Source: 00000000-00007332.00000000.165054.05B70000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\" in Source: 00000000-00007332.00000000.165054.05B70000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance" in Source: 00000000-00007332.00000000.165054.05B70000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance\." in Source: 00000000-00007332.00000000.165054.05B70000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance" in Source: 00000000-00007332.00000000.165054.05B70000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance\Library" in Source: 00000000-00007332.00000000.165054.05B70000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance\IsMultiInstance" in Source: 00000000-00007332.00000000.165054.05B70000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance\First Counter" in Source: 00000000-00007332.00000000.165054.05B70000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\.net clr networking\Performance" in Source: 00000000-00007332.00000000.165054.05B70000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance\." in Source: 00000000-00007332.00000000.165054.05B70000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance" in Source: 00000000-00007332.00000000.165054.05B70000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance\CategoryOptions" in Source: 00000000-00007332.00000000.165054.05B70000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance\FileMappingSize" in Source: 00000000-00007332.00000000.165054.05B70000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance\Counter Names" in Source: 00000000-00007332.00000000.165054.05B70000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v2.0.50727" in Source: 00000000-00007332.00000000.165054.05B70000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\." in Source: 00000000-00007332.00000000.165054.05B70000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727" in Source: 00000000-00007332.00000000.165054.05B70000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\WMIDisableCOMSecurity" in Source: 00000000-00007332.00000000.165054.05B70000.00000004.mdmp41:T4f8,Process 1520e1599ccc2f116ca0f89e5a935fe0.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7332:168:WilStaging_02" Process 1520e1599ccc2f116ca0f89e5a935fe0.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7332:168:WilStaging_02" Process 1520e1599ccc2f116ca0f89e5a935fe0.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7332:64:WilError_01" Process 1520e1599ccc2f116ca0f89e5a935fe0.exe created mutex with name "\Sessions\1\BaseNamedObjects\394f23fb4c8c32d52df2198922e095fd" Process 1520e1599ccc2f116ca0f89e5a935fe0.exe created mutex with name "Local\SM0:7332:168:WilStaging_02" Process 1520e1599ccc2f116ca0f89e5a935fe0.exe created mutex with name "SM0:7332:168:WilStaging_02" Process 1520e1599ccc2f116ca0f89e5a935fe0.exe created mutex with name "394f23fb4c8c32d52df2198922e095fd" Process 1520e1599ccc2f116ca0f89e5a935fe0.exe created mutex with name "SM0:7332:64:WilError_01" Process 1520e1599ccc2f116ca0f89e5a935fe0.exe created mutex with name "Global\.net clr networking" Process 1520e1599ccc2f116ca0f89e5a935fe0.exe created mutex with name "\BaseNamedObjects\.net clr networking" Process 1520e1599ccc2f116ca0f89e5a935fe0.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\.net clr networking"42:T875,Observed unmanaged function "BlockInput" in "1520e1599ccc2f116ca0f89e5a935fe0.exe" Observed unmanaged function "capGetDriverDescriptionA" in "1520e1599ccc2f116ca0f89e5a935fe0.exe" Observed unmanaged function "GetForegroundWindow" in "1520e1599ccc2f116ca0f89e5a935fe0.exe" Observed unmanaged function "GetVolumeInformationA" in "1520e1599ccc2f116ca0f89e5a935fe0.exe" Observed unmanaged function "GetWindowTextA" in "1520e1599ccc2f116ca0f89e5a935fe0.exe" Observed unmanaged function "GetWindowTextLengthA" in "1520e1599ccc2f116ca0f89e5a935fe0.exe" Observed unmanaged function "GetWindow" in "1520e1599ccc2f116ca0f89e5a935fe0.exe" Observed unmanaged function "SendMessage" in "1520e1599ccc2f116ca0f89e5a935fe0.exe" Observed unmanaged function "FindWindow" in "1520e1599ccc2f116ca0f89e5a935fe0.exe" Observed unmanaged function "ShowWindow" in "1520e1599ccc2f116ca0f89e5a935fe0.exe" Observed unmanaged function "mciSendString" in "1520e1599ccc2f116ca0f89e5a935fe0.exe" Observed unmanaged function "ReleaseDC" in "1520e1599ccc2f116ca0f89e5a935fe0.exe" Observed unmanaged function "CreateSolidBrush" in "1520e1599ccc2f116ca0f89e5a935fe0.exe" Observed unmanaged function "Beep" in "1520e1599ccc2f116ca0f89e5a935fe0.exe" Observed unmanaged function "PatBlt" in "1520e1599ccc2f116ca0f89e5a935fe0.exe" Observed unmanaged function "BitBlt" in "1520e1599ccc2f116ca0f89e5a935fe0.exe" Observed unmanaged function "StretchBlt" in "1520e1599ccc2f116ca0f89e5a935fe0.exe" Observed unmanaged function "GetDesktopWindow" in "1520e1599ccc2f116ca0f89e5a935fe0.exe" Observed unmanaged function "GetWindowDC" in "1520e1599ccc2f116ca0f89e5a935fe0.exe" Observed unmanaged function "SelectObject" in "1520e1599ccc2f116ca0f89e5a935fe0.exe" Observed unmanaged function "DeleteObject" in "1520e1599ccc2f116ca0f89e5a935fe0.exe" Observed unmanaged function "NtSetInformationProcess" in "1520e1599ccc2f116ca0f89e5a935fe0.exe" Observed unmanaged function "CreateFile" in "1520e1599ccc2f116ca0f89e5a935fe0.exe" Observed unmanaged function "WriteFile" in "1520e1599ccc2f116ca0f89e5a935fe0.exe" Observed unmanaged function "EnableWindow" in "1520e1599ccc2f116ca0f89e5a935fe0.exe"43:T214e,"md /c reg ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f" in Source: 00000000-00007332.00000000.165054.00EE2000.00000002.mdmp "_LOCAL_MACHINE\Software\Microsoft\Windows NT\Cur" in Source: 00000000-00007332.00000000.165054.03440000.00000004.mdmp "Read?HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007332.00000000.165054.03440000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|Plu" in Source: 00000000-00007332.00000000.165054.03440000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|ProductId" in Source: 00000000-00007332.00000000.165054.03440000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows\CurrentVersion|CurrentType" in Source: 00000000-00007332.00000000.165054.03440000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\PriorityControl|Win32PrioritySeparation" in Source: 00000000-00007332.00000000.165054.03440000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows\CurrentVersion|RegisteredOrganization" in Source: 00000000-00007332.00000000.165054.03440000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\ProductOptions|ProductSuite" in Source: 00000000-00007332.00000000.165054.03440000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|Plus! ProductId" in Source: 00000000-00007332.00000000.165054.03440000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|Plus! VersionNumber" in Source: 00000000-00007332.00000000.165054.03440000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|RegisteredOwner" in Source: 00000000-00007332.00000000.165054.03440000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\PriorityControl|Win32PrioritySeparatio" in Source: 00000000-00007332.00000000.165054.03440000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Drivers32" in Source: 00000000-00007332.00000000.165054.03440000.00000004.mdmp "e\Software\Microsoft\Windows NT\CurrentVersion\Drivers32" in Source: 00000000-00007332.00000000.165054.03440000.00000004.mdmp ":\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{08D9DFDF-C6F7-404A-A20" in Source: 00000000-00007332.00000000.165054.03440000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}" in Source: 00000000-00007332.00000000.165054.03440000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{172BDD!" in Source: 00000000-00007332.00000000.165054.03440000.00000004.mdmp "Registry\Machine\Software\Classes\C[" in Source: 00000000-00007332.00000000.165054.03440000.00000004.mdmp "stry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00007332.00000000.165054.03440000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00007332.00000000.165054.05B70000.00000004.mdmp "cmd /c reg ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f" in Source: 00000000-00007332.00000000.165054.05B70000.00000004.mdmp "System\CurrentControlSet\Control\Session Manager\Environment" in Source: 00000000-00007332.00000000.165054.05B70000.00000004.mdmp "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\." in Source: 00000000-00007332.00000000.165054.05B70000.00000004.mdmp "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00007332.00000000.165054.05B70000.00000004.mdmp "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\394f23fb4c8c32d52df2198922e095fd" in Source: 00000000-00007332.00000000.165054.05B70000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\." in Source: 00000000-00007332.00000000.165054.05B70000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00007332.00000000.165054.05B70000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\394f23fb4c8c32d52df2198922e095fd" in Source: 00000000-00007332.00000000.165054.05B70000.00000004.mdmp "Software\" in Source: 00000000-00007332.00000000.165054.05B70000.00000004.mdmp "Software\394f23fb4c8c32d52df2198922e095fd" in Source: 00000000-00007332.00000000.165054.05B70000.00000004.mdmp "HKEY_CURRENT_USER\Software\394f23fb4c8c32d52df2198922e095fd\." in Source: 00000000-00007332.00000000.165054.05B70000.00000004.mdmp "Software\Microsoft\.NETFramework" in Source: 00000000-00007332.00000000.165054.05B70000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\." in Source: 00000000-00007332.00000000.165054.05B70000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework" in Source: 00000000-00007332.00000000.165054.05B70000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\DbgJITDebugLaunchSetting" in Source: 00000000-00007332.00000000.165054.05B70000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\DbgManagedDebugger" in Source: 00000000-00007332.00000000.165054.05B70000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Run\394f23fb4c8c32d52df2198922e095fd" in Source: 00000000-00007332.00000000.165054.05B70000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007332.00000000.165054.05B70000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\." in Source: 00000000-00007332.00000000.165054.05B70000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007332.00000000.165054.05B70000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\InstallationType" in Source: 00000000-00007332.00000000.165054.05B70000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\" in Source: 00000000-00007332.00000000.165054.05B70000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance" in Source: 00000000-00007332.00000000.165054.05B70000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance\." in Source: 00000000-00007332.00000000.165054.05B70000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance" in Source: 00000000-00007332.00000000.165054.05B70000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance\Library" in Source: 00000000-00007332.00000000.165054.05B70000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance\IsMultiInstance" in Source: 00000000-00007332.00000000.165054.05B70000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance\First Counter" in Source: 00000000-00007332.00000000.165054.05B70000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\.net clr networking\Performance" in Source: 00000000-00007332.00000000.165054.05B70000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance\." in Source: 00000000-00007332.00000000.165054.05B70000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance" in Source: 00000000-00007332.00000000.165054.05B70000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance\CategoryOptions" in Source: 00000000-00007332.00000000.165054.05B70000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance\FileMappingSize" in Source: 00000000-00007332.00000000.165054.05B70000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance\Counter Names" in Source: 00000000-00007332.00000000.165054.05B70000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v2.0.50727" in Source: 00000000-00007332.00000000.165054.05B70000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\." in Source: 00000000-00007332.00000000.165054.05B70000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727" in Source: 00000000-00007332.00000000.165054.05B70000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\WMIDisableCOMSecurity" in Source: 00000000-00007332.00000000.165054.05B70000.00000004.mdmp44:T182c,"1520e1599ccc2f116ca0f89e5a935fe0.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 74250000 "1520e1599ccc2f116ca0f89e5a935fe0.exe" loaded module "ADVAPI32.DLL" at base 76390000 "1520e1599ccc2f116ca0f89e5a935fe0.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 761b0000 "1520e1599ccc2f116ca0f89e5a935fe0.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 761b0000 "1520e1599ccc2f116ca0f89e5a935fe0.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 761b0000 "1520e1599ccc2f116ca0f89e5a935fe0.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 741a0000 "1520e1599ccc2f116ca0f89e5a935fe0.exe" loaded module "SHLWAPI.DLL" at base 747d0000 "1520e1599ccc2f116ca0f89e5a935fe0.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 74820000 "1520e1599ccc2f116ca0f89e5a935fe0.exe" loaded module "VERSION.DLL" at base 74190000 "1520e1599ccc2f116ca0f89e5a935fe0.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORWKS.DLL" at base 73be0000 "1520e1599ccc2f116ca0f89e5a935fe0.exe" loaded module "USER32.DLL" at base 77760000 "1520e1599ccc2f116ca0f89e5a935fe0.exe" loaded module "MSCOREE.DLL" at base 74470000 "1520e1599ccc2f116ca0f89e5a935fe0.exe" loaded module "NTDLL" at base 77ac0000 "1520e1599ccc2f116ca0f89e5a935fe0.exe" loaded module "SHELL32.DLL" at base 76410000 "1520e1599ccc2f116ca0f89e5a935fe0.exe" loaded module "KERNEL32.DLL" at base 75aa0000 "1520e1599ccc2f116ca0f89e5a935fe0.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MSCORLIB\7AA13700A6FCDCB57E6CB353E54D0AB9\MSCORLIB.NI.DLL" at base 73040000 "1520e1599ccc2f116ca0f89e5a935fe0.exe" loaded module "OLE32.DLL" at base 746d0000 "1520e1599ccc2f116ca0f89e5a935fe0.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 72fc0000 "1520e1599ccc2f116ca0f89e5a935fe0.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORJIT.DLL" at base 72f60000 "1520e1599ccc2f116ca0f89e5a935fe0.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM\61E9A201160F8BAED9F7E00A4969992E\SYSTEM.NI.DLL" at base 727b0000 "1520e1599ccc2f116ca0f89e5a935fe0.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.VISUALBAS#\5F0A85C2A45C0FB0D1D12E010857A907\MICROSOFT.VISUALBASIC.NI.DLL" at base 72600000 "1520e1599ccc2f116ca0f89e5a935fe0.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.DRAWING\D6163E1C32EBA738E42523885580DC48\SYSTEM.DRAWING.NI.DLL" at base 72470000 "1520e1599ccc2f116ca0f89e5a935fe0.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.WINDOWS.FORMS\860A4E79ADBD2EB86ADE9317E1CD9D2A\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 71890000 "1520e1599ccc2f116ca0f89e5a935fe0.exe" loaded module "USER32" at base 77760000 "1520e1599ccc2f116ca0f89e5a935fe0.exe" loaded module "GDI32.DLL" at base 75210000 "1520e1599ccc2f116ca0f89e5a935fe0.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CONFIGURATION\CD4B9B7E793D3FE3AD5C9542420992BE\SYSTEM.CONFIGURATION.NI.DLL" at base 71760000 "1520e1599ccc2f116ca0f89e5a935fe0.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.XML\C7A2F551C65C81870E822E9E134513F9\SYSTEM.XML.NI.DLL" at base 71220000 "1520e1599ccc2f116ca0f89e5a935fe0.exe" loaded module "WS2_32.DLL" at base 75480000 "1520e1599ccc2f116ca0f89e5a935fe0.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 711c0000 "1520e1599ccc2f116ca0f89e5a935fe0.exe" loaded module "RPCRT4.DLL" at base 75b70000 "1520e1599ccc2f116ca0f89e5a935fe0.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 710e0000 "1520e1599ccc2f116ca0f89e5a935fe0.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 71090000 "1520e1599ccc2f116ca0f89e5a935fe0.exe" loaded module "KERNEL32" at base 75aa0000 "1520e1599ccc2f116ca0f89e5a935fe0.exe" loaded module "SSPICLI.DLL" at base 744e0000 "1520e1599ccc2f116ca0f89e5a935fe0.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.MANAGEMENT\4BCE21F4FEAFFA3BF49BD0BF3F73BB80\SYSTEM.MANAGEMENT.NI.DLL" at base 70f60000 "1520e1599ccc2f116ca0f89e5a935fe0.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\\WMINET_UTILS.DLL" at base 70f40000 "1520e1599ccc2f116ca0f89e5a935fe0.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 761b0000 "1520e1599ccc2f116ca0f89e5a935fe0.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 70f20000 "1520e1599ccc2f116ca0f89e5a935fe0.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 70ea0000 "1520e1599ccc2f116ca0f89e5a935fe0.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 70e90000 "1520e1599ccc2f116ca0f89e5a935fe0.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 70dd0000 "1520e1599ccc2f116ca0f89e5a935fe0.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 761b0000 "1520e1599ccc2f116ca0f89e5a935fe0.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 761b0000 "1520e1599ccc2f116ca0f89e5a935fe0.exe" loaded module "OLEAUT32.DLL" at base 76090000 "1520e1599ccc2f116ca0f89e5a935fe0.exe" loaded module "SHFOLDER.DLL" at base 70dc0000 "1520e1599ccc2f116ca0f89e5a935fe0.exe" loaded module "IMM32.DLL" at base 75c30000 "1520e1599ccc2f116ca0f89e5a935fe0.exe" loaded module "AVICAP32.DLL" at base 70da0000 "1520e1599ccc2f116ca0f89e5a935fe0.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMDISP.DLL" at base 70c40000 "1520e1599ccc2f116ca0f89e5a935fe0.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 76390000 "1520e1599ccc2f116ca0f89e5a935fe0.exe" loaded module "%WINDIR%\SYSWOW64\OLEAUT32.DLL" at base 76090000 "1520e1599ccc2f116ca0f89e5a935fe0.exe" loaded module "SXS.DLL" at base 70bb0000 "1520e1599ccc2f116ca0f89e5a935fe0.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\CUSTOMMARSHALERS\A09860BEDB30C5D398A308A74C74A680\CUSTOMMARSHALERS.NI.DLL" at base 70b70000 "1520e1599ccc2f116ca0f89e5a935fe0.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_32\CUSTOMMARSHALERS\2.0.0.0__B03F5F7F11D50A3A\CUSTOMMARSHALERS.DLL" at base 70b50000 "1520e1599ccc2f116ca0f89e5a935fe0.exe" loaded module "OLEAUT32" at base 7609000045:T749,"1520e1599ccc2f116ca0f89e5a935fe0.exe" touched "Wbem Scripting Object Path" (Path: "HKCU\WOW6432NODE\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}") "1520e1599ccc2f116ca0f89e5a935fe0.exe" touched "WBEM Locator" (Path: "HKCU\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\PROGID") "1520e1599ccc2f116ca0f89e5a935fe0.exe" touched "WbemDefaultPathParser" (Path: "HKCU\WOW6432NODE\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\PROGID") "1520e1599ccc2f116ca0f89e5a935fe0.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\WOW6432NODE\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\PROGID") "1520e1599ccc2f116ca0f89e5a935fe0.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\PROGID") "1520e1599ccc2f116ca0f89e5a935fe0.exe" touched "PSFactoryBuffer" (Path: "HKCU\WOW6432NODE\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\TREATAS") "1520e1599ccc2f116ca0f89e5a935fe0.exe" touched "PSTypeInfo" (Path: "HKCU\WOW6432NODE\CLSID\{00020422-0000-0000-C000-000000000046}\TREATAS") "1520e1599ccc2f116ca0f89e5a935fe0.exe" touched "PSDispatch" (Path: "HKCU\WOW6432NODE\CLSID\{00020420-0000-0000-C000-000000000046}\TREATAS") "1520e1599ccc2f116ca0f89e5a935fe0.exe" touched "PSEnumVariant" (Path: "HKCU\WOW6432NODE\CLSID\{00020421-0000-0000-C000-000000000046}\TREATAS") "1520e1599ccc2f116ca0f89e5a935fe0.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "1520e1599ccc2f116ca0f89e5a935fe0.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\WOW6432NODE\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "1520e1599ccc2f116ca0f89e5a935fe0.exe" touched "PointerMoniker" (Path: "HKCU\WOW6432NODE\CLSID\{00000306-0000-0000-C000-000000000046}\TREATAS")46:T4a1,"1520e1599ccc2f116ca0f89e5a935fe0.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"47:Tc3d,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00007332-00000C2B-690400766] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll" [Source: 00000000-00007332-00000C2B-690560149] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_32\mscorlib\7aa13700a6fcdcb57e6cb353e54d0ab9\mscorlib.ni.dll" [Source: 00000000-00007332-00000C2B-690855932] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ole32.dll" [Source: 00000000-00007332-00000C2B-690879883] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll" [Source: 00000000-00007332-00000C2B-691009998] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_32\System\61e9a201160f8baed9f7e00a4969992e\System.ni.dll" [Source: 00000000-00007332-00000C2B-691046085] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\5f0a85c2a45c0fb0d1d12e010857a907\Microsoft.VisualBasic.ni.dll" [Source: 00000000-00007332-00000C2B-691073756] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Drawing\d6163e1c32eba738e42523885580dc48\System.Drawing.ni.dll" [Source: 00000000-00007332-00000C2B-691279859] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\860a4e79adbd2eb86ade9317e1cd9d2a\System.Windows.Forms.ni.dll" [Source: 00000000-00007332-00000C2B-691331369] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Configuration\cd4b9b7e793d3fe3ad5c9542420992be\System.Configuration.ni.dll" [Source: 00000000-00007332-00000C2B-692338772] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Xml\c7a2f551c65c81870e822e9e134513f9\System.Xml.ni.dll" [Source: 00000000-00007332-00000C2B-692376535] Observed system executable string:"%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ws2_32.dll" [Source: 00000000-00007332-00000C2B-692466382] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Management\4bce21f4feaffa3bf49bd0bf3f73bb80\System.Management.ni.dll" [Source: 00000000-00007332-00000C2B-692925943] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v2.0.50727\\wminet_utils.dll" [Source: 00000000-00007332-00000C2B-693033849] Observed system executable string:"%WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00007332-00000C2B-693354858] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v2.0.50727\OLEAUT32.dll" [Source: 00000000-00007332-00000C2B-693525373] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_32\CustomMarshalers\a09860bedb30c5d398a308a74c74a680\CustomMarshalers.ni.dll" [Source: 00000000-00007332-00000C2B-694636473] Observed system executable string:"%WINDIR%\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll" [Source: 00000000-00007332-00000C2B-694676602]48:T9ab,"1520e1599ccc2f116ca0f89e5a935fe0.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{00000344-0000-0000-C000-000000000046}"; Key: ""; Value: "") "1520e1599ccc2f116ca0f89e5a935fe0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{00000344-0000-0000-C000-000000000046}"; Key: ""; Value: "") "1520e1599ccc2f116ca0f89e5a935fe0.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{00000344-0000-0000-C000-000000000046}"; Key: ""; Value: "") "1520e1599ccc2f116ca0f89e5a935fe0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{00000344-0000-0000-C000-000000000046}"; Key: ""; Value: "") "1520e1599ccc2f116ca0f89e5a935fe0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\TREATASCLASSINDEX"; Key: ""; Value: "") "1520e1599ccc2f116ca0f89e5a935fe0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\CLASSINDEX\{00000344-0000-0000-C000-000000000046}"; Key: ""; Value: "") "1520e1599ccc2f116ca0f89e5a935fe0.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}"; Key: ""; Value: "") "1520e1599ccc2f116ca0f89e5a935fe0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}"; Key: ""; Value: "") "1520e1599ccc2f116ca0f89e5a935fe0.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\TREATAS"; Key: ""; Value: "") "1520e1599ccc2f116ca0f89e5a935fe0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\TREATAS"; Key: ""; Value: "") "1520e1599ccc2f116ca0f89e5a935fe0.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\INPROCSERVER32"; Key: ""; Value: "") "1520e1599ccc2f116ca0f89e5a935fe0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\INPROCSERVER32"; Key: ""; Value: "") "1520e1599ccc2f116ca0f89e5a935fe0.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\INPROCHANDLER32"; Key: ""; Value: "") "1520e1599ccc2f116ca0f89e5a935fe0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\INPROCHANDLER32"; Key: ""; Value: "") "1520e1599ccc2f116ca0f89e5a935fe0.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\INPROCHANDLER"; Key: ""; Value: "")49:Ta1a,"1520e1599ccc2f116ca0f89e5a935fe0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}"; Key: ""; Value: "") "1520e1599ccc2f116ca0f89e5a935fe0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "") "1520e1599ccc2f116ca0f89e5a935fe0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\INPROCSERVER32"; Key: ""; Value: "") "1520e1599ccc2f116ca0f89e5a935fe0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\INPROCSERVER32"; Key: "THREADINGMODEL"; Value: "") "1520e1599ccc2f116ca0f89e5a935fe0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}"; Key: "APPID"; Value: "") "1520e1599ccc2f116ca0f89e5a935fe0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WBEM\SCRIPTING"; Key: "DEFAULT IMPERSONATION LEVEL"; Value: "") "1520e1599ccc2f116ca0f89e5a935fe0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{0000011A-0000-0000-C000-000000000046}\PROXYSTUBCLSID32"; Key: ""; Value: "") "1520e1599ccc2f116ca0f89e5a935fe0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "1520e1599ccc2f116ca0f89e5a935fe0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "1520e1599ccc2f116ca0f89e5a935fe0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{B196B283-BAB4-101A-B69C-00AA00341D07}\PROXYSTUBCLSID32"; Key: ""; Value: "") "1520e1599ccc2f116ca0f89e5a935fe0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}"; Key: ""; Value: "") "1520e1599ccc2f116ca0f89e5a935fe0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "") "1520e1599ccc2f116ca0f89e5a935fe0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\INPROCSERVER32"; Key: ""; Value: "") "1520e1599ccc2f116ca0f89e5a935fe0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\INPROCSERVER32"; Key: "THREADINGMODEL"; Value: "")4a:T41f,"1520e1599ccc2f116ca0f89e5a935fe0.exe" trying to touch file "C:\Windows\System32\WOW64LOG.DLL" "1520e1599ccc2f116ca0f89e5a935fe0.exe" trying to touch file "C:\WINDOWS\system32\wow64log.dll" "1520e1599ccc2f116ca0f89e5a935fe0.exe" trying to touch file "C:\Windows\SysWOW64\mscoree.dll" "1520e1599ccc2f116ca0f89e5a935fe0.exe" trying to touch file "C:\WINDOWS\SysWOW64\MSCOREE.DLL" "1520e1599ccc2f116ca0f89e5a935fe0.exe" trying to touch file "C:\Windows\SysWOW64\apphelp.dll" "1520e1599ccc2f116ca0f89e5a935fe0.exe" trying to touch file "C:\WINDOWS\SysWOW64\apphelp.dll" "1520e1599ccc2f116ca0f89e5a935fe0.exe" trying to touch file "C:\1520e1599ccc2f116ca0f89e5a935fe0.exe" "1520e1599ccc2f116ca0f89e5a935fe0.exe" trying to touch file "C:\Windows\SysWOW64\ntdll.dll" "1520e1599ccc2f116ca0f89e5a935fe0.exe" trying to touch file "C:\Windows\SysWOW64\kernel32.dll" "1520e1599ccc2f116ca0f89e5a935fe0.exe" trying to touch file "C:\Windows\SysWOW64\KernelBase.dll" "1520e1599ccc2f116ca0f89e5a935fe0.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb"4b:T964,"1520e1599ccc2f116ca0f89e5a935fe0.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "1520e1599ccc2f116ca0f89e5a935fe0.exe" trying to access non-existent file "C:\WINDOWS\system32\wow64log.dll" "1520e1599ccc2f116ca0f89e5a935fe0.exe" trying to access non-existent file "C:\FLTLIB.DLL" "1520e1599ccc2f116ca0f89e5a935fe0.exe" trying to access non-existent file "C:\MSVCP140.DLL" "1520e1599ccc2f116ca0f89e5a935fe0.exe" trying to access non-existent file "C:\MSVCP140.dll" "1520e1599ccc2f116ca0f89e5a935fe0.exe" trying to access non-existent file "C:\VCRUNTIME140.DLL" "1520e1599ccc2f116ca0f89e5a935fe0.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "1520e1599ccc2f116ca0f89e5a935fe0.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "1520e1599ccc2f116ca0f89e5a935fe0.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\CLR.DLL" "1520e1599ccc2f116ca0f89e5a935fe0.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\MSCORWKS.DLL" "1520e1599ccc2f116ca0f89e5a935fe0.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\CLR.DLL" "1520e1599ccc2f116ca0f89e5a935fe0.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\MSCORWKS.DLL" "1520e1599ccc2f116ca0f89e5a935fe0.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CLR.DLL" "1520e1599ccc2f116ca0f89e5a935fe0.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\OLE32.DLL" "1520e1599ccc2f116ca0f89e5a935fe0.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\ole32.dll" "1520e1599ccc2f116ca0f89e5a935fe0.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "1520e1599ccc2f116ca0f89e5a935fe0.exe" trying to access non-existent file "C:\WINDOWS\SysWOW64\rpcss.dll" "1520e1599ccc2f116ca0f89e5a935fe0.exe" trying to access non-existent file "C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\WS2_32.DLL" "1520e1599ccc2f116ca0f89e5a935fe0.exe" trying to access non-existent file "C:\WINDOWS\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ws2_32.dll" "1520e1599ccc2f116ca0f89e5a935fe0.exe" trying to access non-existent file "C:\BCRYPT.DLL" "1520e1599ccc2f116ca0f89e5a935fe0.exe" trying to access non-existent file "C:\bcrypt.dll"4c:T86c,"1520e1599ccc2f116ca0f89e5a935fe0.exe" trying to access non-existent file "C:\Windows\SysWOW64\MSCOREE.DLL.LOCAL" "1520e1599ccc2f116ca0f89e5a935fe0.exe" trying to access non-existent file "C:\WINDOWS\SysWOW64\MSCOREE.DLL.local" "1520e1599ccc2f116ca0f89e5a935fe0.exe" trying to access non-existent file "C:\1520E1599CCC2F116CA0F89E5A935FE0.EXE.CONFIG" "1520e1599ccc2f116ca0f89e5a935fe0.exe" trying to access non-existent file "C:\1520E1599CCC2F116CA0F89E5A935FE0.EXE.LOCAL" "1520e1599ccc2f116ca0f89e5a935fe0.exe" trying to access non-existent file "C:\1520e1599ccc2f116ca0f89e5a935fe0.exe.Local\" "1520e1599ccc2f116ca0f89e5a935fe0.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\FUSION.LOCALGAC" "1520e1599ccc2f116ca0f89e5a935fe0.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\fusion.localgac" "1520e1599ccc2f116ca0f89e5a935fe0.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\SECURITY.CONFIG" "1520e1599ccc2f116ca0f89e5a935fe0.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\SECURITY.CONFIG.CCH" "1520e1599ccc2f116ca0f89e5a935fe0.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\ENTERPRISESEC.CONFIG" "1520e1599ccc2f116ca0f89e5a935fe0.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\ENTERPRISESEC.CONFIG.CCH" "1520e1599ccc2f116ca0f89e5a935fe0.exe" trying to access non-existent file "C:\1520E1599CCC2F116CA0F89E5A935FE0.CONFIG" "1520e1599ccc2f116ca0f89e5a935fe0.exe" trying to access non-existent file "C:\1520e1599ccc2f116ca0f89e5a935fe0.config" "1520e1599ccc2f116ca0f89e5a935fe0.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "1520e1599ccc2f116ca0f89e5a935fe0.exe" trying to access non-existent file "C:\Windows\Globalization\EN-US.NLP" "1520e1599ccc2f116ca0f89e5a935fe0.exe" trying to access non-existent file "C:\WINDOWS\Globalization\en-us.nlp" "1520e1599ccc2f116ca0f89e5a935fe0.exe" trying to access non-existent file "\Device\RasAcd"4d:T65b,Observed Namespace "System.Net.Sockets.TcpClient" and MemberReference "Close" in "1520e1599ccc2f116ca0f89e5a935fe0.exe" Observed Namespace "System.Net.Sockets.TcpClient" and MemberReference ".ctor" in "1520e1599ccc2f116ca0f89e5a935fe0.exe" Observed Namespace "System.Net.Sockets.TcpClient" and MemberReference "set_ReceiveBufferSize" in "1520e1599ccc2f116ca0f89e5a935fe0.exe" Observed Namespace "System.Net.Sockets.TcpClient" and MemberReference "set_SendBufferSize" in "1520e1599ccc2f116ca0f89e5a935fe0.exe" Observed Namespace "System.Net.Sockets.TcpClient" and MemberReference "get_Client" in "1520e1599ccc2f116ca0f89e5a935fe0.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "set_SendTimeout" in "1520e1599ccc2f116ca0f89e5a935fe0.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "set_ReceiveTimeout" in "1520e1599ccc2f116ca0f89e5a935fe0.exe" Observed Namespace "System.Net.Sockets.TcpClient" and MemberReference "Connect" in "1520e1599ccc2f116ca0f89e5a935fe0.exe" Observed Namespace "System.Net.Sockets.TcpClient" and MemberReference "get_Available" in "1520e1599ccc2f116ca0f89e5a935fe0.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Poll" in "1520e1599ccc2f116ca0f89e5a935fe0.exe" Observed Namespace "System.Net.Sockets.TcpClient" and MemberReference "GetStream" in "1520e1599ccc2f116ca0f89e5a935fe0.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Receive" in "1520e1599ccc2f116ca0f89e5a935fe0.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Send" in "1520e1599ccc2f116ca0f89e5a935fe0.exe"4e:T768,Found reference to API "cmd /c start shutdown /s /f /t 0" (Indicator: " shutdown "; File: "1520e1599ccc2f116ca0f89e5a935fe0.exe") Found reference to API "cmd /c start shutdown /r /f /t 0" (Indicator: " shutdown "; File: "1520e1599ccc2f116ca0f89e5a935fe0.exe") Found reference to API "cmd /c start shutdown /l /f" (Indicator: " shutdown "; File: "1520e1599ccc2f116ca0f89e5a935fe0.exe") Found reference to API "cmd /c shutdown /s /f /t 60" (Indicator: " shutdown "; File: "1520e1599ccc2f116ca0f89e5a935fe0.exe") Found reference to API "cmd /c start shutdown /r /f /t 3" (Indicator: " shutdown "; File: "1520e1599ccc2f116ca0f89e5a935fe0.exe") Found reference to API "cmd /c shutdown -a" (Indicator: " shutdown "; File: "1520e1599ccc2f116ca0f89e5a935fe0.exe") Found reference to API "WSAStartup" (Indicator: "wsastartup"; Source: "00000000-00007332-00000C2C-692520127") Found reference to API "md /c start shutdown /s /f /t 0" (Indicator: " shutdown "; Source: "00000000-00007332.00000000.165054.00EE2000.00000002.mdmp") Found reference to API "md /c start shutdown /r /f /t 0" (Indicator: " shutdown "; Source: "00000000-00007332.00000000.165054.00EE2000.00000002.mdmp") Found reference to API "md /c start shutdown /l /f" (Indicator: " shutdown "; Source: "00000000-00007332.00000000.165054.00EE2000.00000002.mdmp") Found reference to API "md /c shutdown /s /f /t 60" (Indicator: " shutdown "; Source: "00000000-00007332.00000000.165054.00EE2000.00000002.mdmp") Found reference to API "md /c start shutdown /r /f /t 3" (Indicator: " shutdown "; Source: "00000000-00007332.00000000.165054.00EE2000.00000002.mdmp") Found reference to API "md /c shutdown -a" (Indicator: " shutdown "; Source: "00000000-00007332.00000000.165054.00EE2000.00000002.mdmp") Found reference to API "GetHostByName" (Indicator: "gethostbyname"; Source: "00000000-00007332.00000000.165054.05B70000.00000004.mdmp")4f:T541,"11.0.0.0" Potential IP "2.0.0.0" found in string "mscorlib,2.0.0.0,,b77a5c561934e089,x86" Potential IP "8.0.0.0" found in string "Microsoft.VisualBasic,8.0.0.0,,b03f5f7f11d50a3a,MSIL" Potential IP "2.0.0.0" found in string "System,2.0.0.0,,b77a5c561934e089,MSIL" Potential IP "2.0.0.0" found in string "System.Xml,2.0.0.0,,b77a5c561934e089,MSIL" Potential IP "2.0.0.0" found in string "System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL" Potential IP "2.0.0.0" found in string "System.Web,2.0.0.0,,b03f5f7f11d50a3a,x86" Potential IP "2.0.0.0" found in string "System.Management,2.0.0.0,,b03f5f7f11d50a3a,MSIL" Potential IP "2.0.0.0" found in string "System.Runtime.Remoting,2.0.0.0,,b77a5c561934e089,MSIL" Potential IP "2.0.0.0" found in string "System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL" Potential IP "2.0.0.0" found in string "System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL" Potential IP "2.0.0.0" found in string "System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL" Potential IP "2.0.0.0" found in string "System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL" Potential IP "2.0.0.0" found in string "Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL" Potential IP "2.0.0.0" found in string "System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL" "192.168.0.2" "2.0.0.0" "255.255.255.255" "124.222.18.236"50:T9ad,Heuristic match: "6.tcp.vip.cpolar.cn" Pattern match: "https://pastebin.com/raw/" Heuristic match: ".tcp.vip.cpolar.cn" Pattern match: "pastebin.com/raw/" Pattern match: "microsoft.net/framework/v2.0.50727/" Heuristic match: "6.tcp.vi" Pattern match: "http://www.w3.org/2001/xmlschema-instance" Heuristic match: "cim_computersystem.name" Pattern match: "http://www.w3.org/2000/xmlns/" Pattern match: "http://www.w3.org/xml/1998/namespace" Pattern match: "http://schemas.microsoft.com/.netconfiguration/v2.0" Pattern match: "system.web/anonymousidentification" Pattern match: "system.web/authentication" Pattern match: "system.web/authorization" Pattern match: "system.web/browsercaps" Pattern match: "system.web/clienttarget" Pattern match: "system.web/compilation" Pattern match: "system.web/customerrors" Pattern match: "system.web/deployment" Pattern match: "system.web/devicefilters" Pattern match: "system.web/globalization" Pattern match: "system.web/healthmonitoring" Pattern match: "system.web/hostingenvironment" Pattern match: "system.web/httpcookies" Pattern match: "system.web/httphandlers" Pattern match: "system.web/httpmodules" Pattern match: "system.web/httpruntime" Pattern match: "system.web/identity" Pattern match: "system.web/machinekey" Pattern match: "system.web/membership" Pattern match: "system.web/mobilecontrols" Pattern match: "system.web/pages" Pattern match: "system.web/processmodel" Pattern match: "system.web/profile" Pattern match: "system.web/protocols" Pattern match: "system.web/rolemanager" Pattern match: "system.web/securitypolicy" Pattern match: "system.web/sessionpagestate" Pattern match: "system.web/sessionstate" Pattern match: "system.web/sitemap" Pattern match: "system.web/trace" Pattern match: "system.web/trust" Pattern match: "system.web/urlmappings" Pattern match: "system.web/webcontrols" Pattern match: "system.web/webparts" Pattern match: "system.web/webservices" Pattern match: "system.web/xhtmlconformance" Pattern match: "system.web/caching" Pattern match: "system.web/caching/cache" Pattern match: "system.web/caching/outputcache" Pattern match: "system.web/caching/outputcachesettings" Pattern match: "system.web/caching/sqlcachedependency" Pattern match: "http://schemas.microsoft.com/clr/" Pattern match: "http://schemas.microsoft.com/clr/assem/" Pattern match: "http://schemas.microsoft.com/clr/ns/" Pattern match: "http://schemas.microsoft.com/clr/nsassem/"51:T92f,Found reference to API "CopyFromScreen" (Indicator: "CopyFromScreen"; File: "1520e1599ccc2f116ca0f89e5a935fe0.exe") Found reference to API "BitBlt" (Indicator: "BitBlt"; File: "1520e1599ccc2f116ca0f89e5a935fe0.exe") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; File: "1520e1599ccc2f116ca0f89e5a935fe0.exe") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; File: "1520e1599ccc2f116ca0f89e5a935fe0.exe") Found reference to API "CopyFromScreen" (Indicator: "CopyFromScreen"; Source: "00000000-00007332.00000000.165054.00EE2000.00000002.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00007332.00000000.165054.00EE2000.00000002.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00007332.00000000.165054.00EE2000.00000002.mdmp") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; Source: "00000000-00007332.00000000.165054.00EE2000.00000002.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007332.00000000.165054.03440000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007332.00000000.165054.03440000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00007332.00000000.165054.03440000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007332.00000000.165054.03440000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007332.00000000.165054.03440000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00007332.00000000.165054.03440000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00007332.00000000.165054.03440000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00007332.00000000.165054.03440000.00000004.mdmp")52:Tb44,Found reference to API "GetAsyncKeyState" (Indicator: "GetAsyncKeyState"; File: "1520e1599ccc2f116ca0f89e5a935fe0.exe") Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; File: "1520e1599ccc2f116ca0f89e5a935fe0.exe") Found reference to API "MapVirtualKey" (Indicator: "MapVirtualKey"; File: "1520e1599ccc2f116ca0f89e5a935fe0.exe") Found reference to API "GetAsyncKeyState" (Indicator: "GetAsyncKeyState"; Source: "00000000-00007332.00000000.165054.00EE2000.00000002.mdmp") Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; Source: "00000000-00007332.00000000.165054.00EE2000.00000002.mdmp") Found reference to API "MapVirtualKey" (Indicator: "MapVirtualKey"; Source: "00000000-00007332.00000000.165054.00EE2000.00000002.mdmp") Found reference to API "235037744,4264,104,,GetKeyState,user32.dll,"00:42:58.281",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00007332.00000000.165054.03440000.00000004.mdmp") Found reference to API "223959020,4264,104,,GetKeyState,user32.dll,"00:42:58.281",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00007332.00000000.165054.03440000.00000004.mdmp") Found reference to API "237491354,4264,103,,GetAsyncKeyState,user32.dll,"00:42:58.281",RX=0,PX=0" (Indicator: "GetAsyncKeyState"; Source: "00000000-00007332.00000000.165054.03440000.00000004.mdmp") Found reference to API "237864170,4264,104,,GetKeyState,user32.dll,"00:42:58.281",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00007332.00000000.165054.03440000.00000004.mdmp") Found reference to API "0829146452,4264,104,,GetKeyState,user32.dll,"00:42:58.953",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00007332.00000000.165054.03440000.00000004.mdmp") Found reference to API "0829650290,4264,104,,GetKeyState,user32.dll,"00:42:58.953",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00007332.00000000.165054.03440000.00000004.mdmp") Found reference to API "0829705982,4264,104,,GetKeyState,user32.dll,"00:42:58.953",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00007332.00000000.165054.03440000.00000004.mdmp") Found reference to API "0829065340,4264,104,,GetKeyState,user32.dll,"00:42:58.953",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00007332.00000000.165054.03440000.00000004.mdmp") Found reference to API "0829528190,4264,103,,GetAsyncKeyState,user32.dll,"00:42:58.953",RX=0,PX=0" (Indicator: "GetAsyncKeyState"; Source: "00000000-00007332.00000000.165054.03440000.00000004.mdmp") Found reference to API "0829593662,4264,104,,GetKeyState,user32.dll,"00:42:58.953",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00007332.00000000.165054.03440000.00000004.mdmp") Found reference to API "0828458752,4264,104,,GetKeyState,user32.dll,"00:42:58.953",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00007332.00000000.165054.03440000.00000004.mdmp")53:Tbac,"1520e1599ccc2f116ca0f89e5a935fe0.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00007332) "1520e1599ccc2f116ca0f89e5a935fe0.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00007332)54:T953,Found string "FromBase64String" (Indicator: "base64"; File: "1520e1599ccc2f116ca0f89e5a935fe0.exe") Found string "FromBase64String" (Indicator: "FromBase64String"; File: "1520e1599ccc2f116ca0f89e5a935fe0.exe") Found string "ToBase64String" (Indicator: "base64"; File: "1520e1599ccc2f116ca0f89e5a935fe0.exe") Found string "ToBase64String" (Indicator: "ToBase64String"; File: "1520e1599ccc2f116ca0f89e5a935fe0.exe") Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; File: "1520e1599ccc2f116ca0f89e5a935fe0.exe") Found string "MD5CryptoServiceProvider" (Indicator: "md5cryptoserviceprovider"; File: "1520e1599ccc2f116ca0f89e5a935fe0.exe") Found string "GZipStream" (Indicator: "GzipStream"; File: "1520e1599ccc2f116ca0f89e5a935fe0.exe") Found string "FromBase64String" (Indicator: "base64"; Source: "00000000-00007332.00000000.165054.00EE2000.00000002.mdmp") Found string "FromBase64String" (Indicator: "FromBase64String"; Source: "00000000-00007332.00000000.165054.00EE2000.00000002.mdmp") Found string "ToBase64String" (Indicator: "base64"; Source: "00000000-00007332.00000000.165054.00EE2000.00000002.mdmp") Found string "ToBase64String" (Indicator: "ToBase64String"; Source: "00000000-00007332.00000000.165054.00EE2000.00000002.mdmp") Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007332.00000000.165054.00EE2000.00000002.mdmp") Found string "MD5CryptoServiceProvider" (Indicator: "md5cryptoserviceprovider"; Source: "00000000-00007332.00000000.165054.00EE2000.00000002.mdmp") Found string "GZipStream" (Indicator: "GzipStream"; Source: "00000000-00007332.00000000.165054.00EE2000.00000002.mdmp") file/memory contains long string with (Indicator: "RsaCryptoServiceProvider"; Source: "00000000-00007332.00000000.165054.05B70000.00000004.mdmp") Found string "Uses RsaCryptoServiceProvider to encrypt and decrypt" (Indicator: "RsaCryptoServiceProvider"; Source: "00000000-00007332.00000000.165054.05B70000.00000004.mdmp") Found string "Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" description="Uses RsaCryptoServiceProvider to encrypt and decrypt" keyContainerName="NetFrameworkConfigurationKey" cspProviderName="" useMachineContainer="true" useOAEP="false"/>" (Indicator: "RsaCryptoServiceProvider"; Source: "00000000-00007332.00000000.165054.05B70000.00000004.mdmp")55:T543,Found reference to API "237051710,596,111,,GetSystemMetrics,user32.dll,"00:42:58.281",RX=0,PX=0" (Indicator: "GetSystemMetrics"; Source: "00000000-00007332.00000000.165054.03440000.00000004.mdmp") Found reference to API "236522594,596,111,,GetSystemMetrics,user32.dll,"00:42:58.281",RX=0,PX=0" (Indicator: "GetSystemMetrics"; Source: "00000000-00007332.00000000.165054.03440000.00000004.mdmp") Found reference to API "235670004,596,111,,GetSystemMetrics,user32.dll,"00:42:58.281",RX=0,PX=0" (Indicator: "GetSystemMetrics"; Source: "00000000-00007332.00000000.165054.03440000.00000004.mdmp") Found reference to API "237186116,596,111,,GetSystemMetrics,user32.dll,"00:42:58.281",RX=0,PX=0" (Indicator: "GetSystemMetrics"; Source: "00000000-00007332.00000000.165054.03440000.00000004.mdmp") Found reference to API "236986358,596,111,,GetSystemMetrics,user32.dll,"00:42:58.281",RX=0,PX=0" (Indicator: "GetSystemMetrics"; Source: "00000000-00007332.00000000.165054.03440000.00000004.mdmp") Found reference to API "236893900,596,111,,GetSystemMetrics,user32.dll,"00:42:58.281",RX=0,PX=0" (Indicator: "GetSystemMetrics"; Source: "00000000-00007332.00000000.165054.03440000.00000004.mdmp") Found reference to API "Win32API|GetSystemMetrics|SM_DEBUG" (Indicator: "GetSystemMetrics"; Source: "00000000-00007332.00000000.165054.03440000.00000004.mdmp")56:T5d4,Found string "cmd /c sc query windefend" (Indicator: "sc query"; File: "1520e1599ccc2f116ca0f89e5a935fe0.exe") Found string "cmd /c sc stop windefend" (Indicator: "sc stop"; File: "1520e1599ccc2f116ca0f89e5a935fe0.exe") Found string "cmd /c sc delete windefend" (Indicator: "sc delete"; File: "1520e1599ccc2f116ca0f89e5a935fe0.exe") Found string "cmd.exe /c ping 0 -n 2 & del \"" (Indicator: "ping"; File: "1520e1599ccc2f116ca0f89e5a935fe0.exe"), Found string "md /c sc query windefend" (Indicator: "sc query"; Source: "00000000-00007332.00000000.165054.00EE2000.00000002.mdmp"), Found string "md /c sc stop windefend" (Indicator: "sc stop"; Source: "00000000-00007332.00000000.165054.00EE2000.00000002.mdmp"), Found string "md /c sc delete windefend" (Indicator: "sc delete"; Source: "00000000-00007332.00000000.165054.00EE2000.00000002.mdmp"), Found string "md.exe /c ping 0 -n 2 & del "" (Indicator: "ping"; Source: "00000000-00007332.00000000.165054.00EE2000.00000002.mdmp") Found string "ping" (Indicator: "ping"; Source: "00000000-00007332.00000000.165054.03440000.00000004.mdmp") Found string "cmd /c sc query windefend" (Indicator: "sc query"; Source: "00000000-00007332.00000000.165054.05B70000.00000004.mdmp") Found string "cmd /c sc stop windefend" (Indicator: "sc stop"; Source: "00000000-00007332.00000000.165054.05B70000.00000004.mdmp") Found string "cmd /c sc delete windefend" (Indicator: "sc delete"; Source: "00000000-00007332.00000000.165054.05B70000.00000004.mdmp")57:T810,"1520e1599ccc2f116ca0f89e5a935fe0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "1520e1599ccc2f116ca0f89e5a935fe0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "1520e1599ccc2f116ca0f89e5a935fe0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "1520e1599ccc2f116ca0f89e5a935fe0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "1520e1599ccc2f116ca0f89e5a935fe0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "1520e1599ccc2f116ca0f89e5a935fe0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "1520e1599ccc2f116ca0f89e5a935fe0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "1520e1599ccc2f116ca0f89e5a935fe0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "1520e1599ccc2f116ca0f89e5a935fe0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "1520e1599ccc2f116ca0f89e5a935fe0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "1520e1599ccc2f116ca0f89e5a935fe0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "")58:Tb12,Found string "Sleep" (Source: 1520e1599ccc2f116ca0f89e5a935fe0.exe, API is part of module: KERNELBASE.DLL) Found string "Rectangle" (Source: 1520e1599ccc2f116ca0f89e5a935fe0.exe, API is part of module: GDI32FULL.DLL) Found string "Delete" (Source: 1520e1599ccc2f116ca0f89e5a935fe0.exe, API is part of module: WMINET_UTILS.DLL) Found string "GetLogicalDrives" (Source: 1520e1599ccc2f116ca0f89e5a935fe0.exe, API is part of module: KERNELBASE.DLL) Found string "GetCurrentProcess" (Source: 1520e1599ccc2f116ca0f89e5a935fe0.exe, API is part of module: KERNELBASE.DLL) Found string "BlockInput" (Source: 1520e1599ccc2f116ca0f89e5a935fe0.exe, API is part of module: USER32.DLL) Found string "capGetDriverDescriptionA" (Source: 1520e1599ccc2f116ca0f89e5a935fe0.exe, API is part of module: AVICAP32.DLL) Found string "connect" (Source: 1520e1599ccc2f116ca0f89e5a935fe0.exe, API is part of module: WS2_32.DLL) Found string "GetForegroundWindow" (Source: 1520e1599ccc2f116ca0f89e5a935fe0.exe, API is part of module: USER32.DLL) Found string "GetVolumeInformationA" (Source: 1520e1599ccc2f116ca0f89e5a935fe0.exe, API is part of module: KERNELBASE.DLL) Found string "GetWindowTextA" (Source: 1520e1599ccc2f116ca0f89e5a935fe0.exe, API is part of module: USER32.DLL) Found string "GetWindowTextLengthA" (Source: 1520e1599ccc2f116ca0f89e5a935fe0.exe, API is part of module: USER32.DLL) Found string "GetWindow" (Source: 1520e1599ccc2f116ca0f89e5a935fe0.exe, API is part of module: USER32.DLL) Found string "ShowWindow" (Source: 1520e1599ccc2f116ca0f89e5a935fe0.exe, API is part of module: USER32.DLL) Found string "ReleaseDC" (Source: 1520e1599ccc2f116ca0f89e5a935fe0.exe, API is part of module: USER32.DLL) Found string "CreateSolidBrush" (Source: 1520e1599ccc2f116ca0f89e5a935fe0.exe, API is part of module: GDI32FULL.DLL) Found string "PatBlt" (Source: 1520e1599ccc2f116ca0f89e5a935fe0.exe, API is part of module: GDI32FULL.DLL) Found string "BitBlt" (Source: 1520e1599ccc2f116ca0f89e5a935fe0.exe, API is part of module: GDI32FULL.DLL) Found string "StretchBlt" (Source: 1520e1599ccc2f116ca0f89e5a935fe0.exe, API is part of module: GDI32FULL.DLL) Found string "GetDesktopWindow" (Source: 1520e1599ccc2f116ca0f89e5a935fe0.exe, API is part of module: USER32.DLL) Found string "GetWindowDC" (Source: 1520e1599ccc2f116ca0f89e5a935fe0.exe, API is part of module: USER32.DLL) Found string "SelectObject" (Source: 1520e1599ccc2f116ca0f89e5a935fe0.exe, API is part of module: GDI32FULL.DLL) Found string "DeleteObject" (Source: 1520e1599ccc2f116ca0f89e5a935fe0.exe, API is part of module: GDI32.DLL) Found string "NtSetInformationProcess" (Source: 1520e1599ccc2f116ca0f89e5a935fe0.exe, API is part of module: NTDLL.DLL) Found string "WriteFile" (Source: 1520e1599ccc2f116ca0f89e5a935fe0.exe, API is part of module: KERNELBASE.DLL)59:T554,Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateCall(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[],System.Boolean) at 1520e1599ccc2f116ca0f89e5a935fe0-600001d-OK~HorrorText System.Net.Sockets.TcpClient::Close() at 1520e1599ccc2f116ca0f89e5a935fe0-6000024-OK~connect Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[]) at 1520e1599ccc2f116ca0f89e5a935fe0-600002c-OK~GetAntiVirus Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateCall(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[],System.Boolean) at 1520e1599ccc2f116ca0f89e5a935fe0-6000040-OK~Ind Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateCall(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[],System.Boolean) at 1520e1599ccc2f116ca0f89e5a935fe0-6000048-OK~RC System.Net.Sockets.TcpClient::get_Client() at 1520e1599ccc2f116ca0f89e5a935fe0-600004b-OK~Sendb Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[]) at 1520e1599ccc2f116ca0f89e5a935fe0-6000064-AntiTaskManager~protect5a:T40d,Found string "winmgmts:\\.\root\SecurityCenter2" (Indicator: "winmgmts:"; in File: "1520e1599ccc2f116ca0f89e5a935fe0.exe") Found string "winmgmts:\\\\.\\root\\SecurityCenter2" (Indicator: "winmgmts:"; in File: "1520e1599ccc2f116ca0f89e5a935fe0.exe") Found string "\\DESKTOP-FVVF82A\root\cimv2:Win32_OperatingSystem=@" (Indicator: "root\cimv2"; in Source: "00000000-00007332.00000000.165054.03440000.00000004.mdmp, 00000000-00007332.00000000.165054.05B70000.00000004.mdmp") Found string "\DESKTOP-FVVF82A\root\cimv2:Win32_OperatingSystem=@" (Indicator: "root\cimv2"; in Source: "00000000-00007332.00000000.165054.03440000.00000004.mdmp") Found string "root\cimv2" (Indicator: "root\cimv2"; in Source: "00000000-00007332.00000000.165054.03440000.00000004.mdmp") Found string "\\.\root\cimv2" (Indicator: "root\cimv2"; in Source: "00000000-00007332.00000000.165054.05B70000.00000004.mdmp") Found string "winmgmts:\\.\root\SecurityCenter2" (Indicator: "winmgmts:"; in Source: "00000000-00007332.00000000.165054.05B70000.00000004.mdmp")30:["$","$Lc",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$33"}}],["$","$L35",null,{"initialData":{"schema_version":"1.0.17","sha256":"d05a2053a4e0f1e22debe07c069c8a51e42fd481b1fe39e118feb3346bcf485d","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1793881766494,"unified_at":"2026-11-05T12:29:26.494Z","metadata":{"hashes":{"sha256":"d05a2053a4e0f1e22debe07c069c8a51e42fd481b1fe39e118feb3346bcf485d","sha1":"3b55eb144d58f9c755474a6f6b8d184990a79741","md5":"1520e1599ccc2f116ca0f89e5a935fe0","sha512":"7086ba1ce997f62a357b41880550cf72536dde59f44ffa2136cc0d4060b4285f4d33008ebbacfa79f0b386d7a8a81a705434472bca6e4cf77d869cb1995aa83d","ssdeep":"1536:LMDM8Dn+QNoB4vZ9Vk7dwmuXKDxwsNMDuMXExI3pmpm:QI8Dn+nWTVk7umuXKDxwsNMDfXExI3pm","ssdeep_chunks":["1536:LMDM8Dn","1536:MDM8Dn+","1536:DM8Dn+Q","1536:M8Dn+QN","1536:8Dn+QNo","1536:Dn+QNoB","1536:n+QNoB4","1536:+QNoB4v","1536:QNoB4vZ","1536:NoB4vZ9","1536:oB4vZ9V","1536:B4vZ9Vk","1536:4vZ9Vk7","1536:vZ9Vk7d","1536:Z9Vk7dw","1536:9Vk7dwm","1536:Vk7dwmu","1536:k7dwmuX","1536:7dwmuXK","1536:dwmuXKD","1536:wmuXKDx","1536:muXKDxw","1536:uXKDxws","1536:XKDxwsN","1536:KDxwsNM","1536:DxwsNMD","1536:xwsNMDu","1536:wsNMDuM","1536:sNMDuMX","1536:NMDuMXE","1536:MDuMXEx","1536:DuMXExI","1536:uMXExI3","1536:MXExI3p","1536:XExI3pm","1536:ExI3pmp","1536:xI3pmpm","3072:LMDM8Dn","3072:MDM8Dn+","3072:DM8Dn+Q","3072:M8Dn+QN","3072:8Dn+QNo","3072:Dn+QNoB","3072:n+QNoB4","3072:+QNoB4v","3072:QNoB4vZ","3072:NoB4vZ9","3072:oB4vZ9V","3072:B4vZ9Vk","3072:4vZ9Vk7","3072:vZ9Vk7d","3072:Z9Vk7dw","3072:9Vk7dwm","3072:Vk7dwmu","3072:k7dwmuX","3072:7dwmuXK","3072:dwmuXKD","3072:wmuXKDx","3072:muXKDxw","3072:uXKDxws","3072:XKDxwsN","3072:KDxwsNM","3072:DxwsNMD","3072:xwsNMDu","3072:wsNMDuM","3072:sNMDuMX","3072:NMDuMXE","3072:MDuMXEx","3072:DuMXExI","3072:uMXExI3","3072:MXExI3p","3072:XExI3pm","3072:ExI3pmp","3072:xI3pmpm","1536:QI8Dn+n","1536:I8Dn+nW","1536:8Dn+nWT","1536:Dn+nWTV","1536:n+nWTVk","1536:+nWTVk7","1536:nWTVk7u","1536:WTVk7um","1536:TVk7umu","1536:Vk7umuX","1536:k7umuXK","1536:7umuXKD","1536:umuXKDx","1536:xwsNMDf","1536:wsNMDfX","1536:sNMDfXE","1536:NMDfXEx","1536:MDfXExI","1536:DfXExI3","1536:fXExI3p"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744","pehash":"e10f15303b312cfc649bc87b1f25ce0c41fb7f72"},"file_info":{"file_name":"1520e1599ccc2f116ca0f89e5a935fe0.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":56320,"entropy":5.6,"compile_timestamp":"2026-10-12T12:30:52","is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1791843478000,"last_seen":1792047573000,"last_multi_scan":1792047573000},"pe_metadata":{"is_dll":false,"is_packed":false,"section_count":3,"import_count":0,"export_count":0,"embedded_file_count":1,"sections":[{"name":".text","virtual_address":"0x2000","virtual_size":53812,"raw_size":54272},{"name":".rsrc","virtual_address":"0x10000","virtual_size":576,"raw_size":1024},{"name":".reloc","virtual_address":"0x12000","virtual_size":12,"raw_size":512}],"section_names":[".text",".rsrc",".reloc"],"imported_dlls":null,"imported_functions":null}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["commodity","targetedcrimeware","rat","njrat","ddos","cobaltstrike","informationstealer","keylogger","quasar","njratlime","opensource","targeted","xworm","criminal","ransomware","umbrella","winnti","evasive"]},"stats":{"av":{"malicious_count":20,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":2,"threat_actors_count":1,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":63},"sandbox_signatures":{"informative_count":154,"suspicious_count":19,"malicious_count":4,"total":177},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Zapchast","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/MSIL.Bladabindi","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_100.0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Dropper.Gen7","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Generic.Dacic.D6DFC400.A.F44A4A02","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Dropper.njRAT-10015886-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"malicious","threat_name":"Backdoor_MSIL_Bladabindi_atmn","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Generic.Dacic.D6DFC400.A.F44A4A02 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/Bladabindi.BB trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Ransom.Win32.Bladabindi.sa","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"TrojanDownloader/MSIL.Pstinb.a","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 700000201 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Generic.lBQJ","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"capa_reference_analysis_tools_strings","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Bladab-AFV","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"malicious","threat_name":"Trojan-FUTJ!1520E1599CCC","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/MSIL_Bladabindi.A.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.MSIL_Heur.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Bladabindi.Win32.142984","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Dacic.D6DFC400.A.Generic","sources":[{"report_type":"quickscan","report_id":""}]},{"value":"njRATLime","sources":[{"report_type":"qsp","report_id":""}]}],"threat_actors":[{"value":"BLIND SPIDER","sources":[{"report_type":"qsp","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Found Native API in Dotnet file"},{"type":"informative","value":".NET source code contains suspicious native API"},{"type":"informative","value":"Able to execute application (.NET)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Able to execute applications using .NET process API"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to start a process (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"informative","value":"Contains ability to execute a WMI query"},{"type":"informative","value":"Found WMI keywords in script (string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"References powershell process"}],"sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"tactic":"Execution","technique":"Services File Permissions Weakness","attack_id":"T1574.010","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/010","identifiers":[{"type":"suspicious","value":"References security-related Windows services"}],"sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"tactic":"Execution","technique":"Scheduled Task","attack_id":"T1053.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1053/005","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to executes commands or batch file"}],"sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"tactic":"Execution","technique":"Path Interception by PATH Environment Variable","attack_id":"T1574.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/007","identifiers":[{"type":"informative","value":"References PATH environment registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"}],"sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","identifiers":[{"type":"suspicious","value":"Tries to save executable or command in registry"}],"sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to set/modify configuration (Powershell command string)"},{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Dotnet code contains ability to modify/delete registry"}],"sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"suspicious","value":"Calls an API typically used for keylogging"},{"type":"suspicious","value":"Contains ability to retrieve keyboard strokes"},{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"suspicious","value":"Contains ability to enumerate processes/modules/threads"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Contains ability to gather process details (Dotnet)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Able to retrieve running process details (.NET)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"}],"sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Contains ability to enumerates all mounted drives"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"}],"sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Able to gather system file/directory information (.NET)"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"suspicious","value":"Calls an API typically used to find and list the Windows drive types"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to gather system information (Dotnet)"},{"type":"informative","value":"Contains ability to gather system environment details"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"},{"type":"informative","value":"Calls an API typically used to enumerate Windows drive types"}],"sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Contains ability to get active window titles (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"May check for the presence of a forensics/monitoring tool"},{"type":"informative","value":"Possibly checks for the presence of an Antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Contains ability to retrieve system language"}],"sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":".NET code is able to query registry"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Opens registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Queries the user identity associated with the current process token"},{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"tactic":"Discovery","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"tactic":"Discovery","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"tactic":"Discovery","technique":"Device Driver Discovery","attack_id":"T1652","attack_id_wiki":"https://attack.mitre.org/techniques/T1652","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"suspicious","value":"Able to capture screenshot"},{"type":"suspicious","value":"Able to perform a screen capture"},{"type":"informative","value":"Able to capture screen (API string)"},{"type":"informative","value":"Contains ability to capture screen information (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"},{"type":"informative","value":"Able to perform SQL operations"}],"sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"},{"type":"informative","value":"Contains ability to decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to download files with network (Dotnet)"},{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contains ability to communicates via socket (possible C&C communication)"},{"type":"suspicious","value":"Spawned process connects to a network"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contains ability to communicate with network (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"suspicious","value":"Uses network protocols on unusual ports"},{"type":"suspicious","value":"Contains ability to open a port and listen for incoming connection"}],"sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains ability to provide interface for network protocols (Dotnet)"},{"type":"informative","value":"Contains ability to communicate with network (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate via sockets (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"tactic":"Impact","technique":"Endpoint Denial of Service","attack_id":"T1499","attack_id_wiki":"https://attack.mitre.org/techniques/T1499","identifiers":[{"type":"informative","value":"Contains ability to lock the workstation's display (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains ability to perform encryption (API string)"},{"type":"informative","value":"Able to access crypto-related API (String)"},{"type":"informative","value":"Contains reference to crypto DLLs"}],"sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Contains ability to perform crypto operations"}],"sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"tactic":"Stealth","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to decode base64 data"},{"type":"informative","value":"Able to load content into memory (.NET)"},{"type":"informative","value":"Able to decode string content at runtime (.NET)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"tactic":"Stealth","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Can load assembly that contains the code that is currently executing (Dotnet)"},{"type":"informative","value":"Dotnet code contains potential unpacker"}],"sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"tactic":"Stealth","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"},{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"tactic":"Stealth","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"tactic":"Stealth","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"tactic":"Stealth","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Dotnet file contains function to dynamically call methods at runtime"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"tactic":"Stealth","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"tactic":"Stealth","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"tactic":"Defense Impairment","technique":"Disable or Modify Tools","attack_id":"T1685","attack_id_wiki":"https://attack.mitre.org/techniques/T1685","identifiers":[{"type":"suspicious","value":"Contains ability to block user input"},{"type":"informative","value":"Contains ability to block user input (API string)"},{"type":"informative","value":"Contains ability to disable Windows Defender using PowerShell"},{"type":"informative","value":"Contains ability to modify Windows Defender preferences (Powershell command string)"},{"type":"informative","value":"Modifies process error mode to suppress error dialogs"},{"type":"suspicious","value":"Able to delete scheduled task(s)"},{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"}],"sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"Found string \"GZipStream\" (Source: \"00000000-00007332.00000000.165054.00EE2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to load content into memory (.NET)","description":"Observed namespace \"System.IO.MemoryStream\" and TypeReference \".ctor\" in \"1520e1599ccc2f116ca0f89e5a935fe0.exe\"\n Observed namespace \"System.IO.MemoryStream\" and TypeReference \"Write\" in \"1520e1599ccc2f116ca0f89e5a935fe0.exe\"\n Observed namespace \"System.IO.MemoryStream\" and TypeReference \"ToArray\" in \"1520e1599ccc2f116ca0f89e5a935fe0.exe\"\n Observed namespace \"System.IO.MemoryStream\" and TypeReference \"get_Length\" in \"1520e1599ccc2f116ca0f89e5a935fe0.exe\"\n Observed namespace \"System.IO.MemoryStream\" and TypeReference \"WriteByte\" in \"1520e1599ccc2f116ca0f89e5a935fe0.exe\"\n Observed namespace \"System.IO.MemoryStream\" and TypeReference \"set_Position\" in \"1520e1599ccc2f116ca0f89e5a935fe0.exe\"\n Observed namespace \"System.IO.MemoryStream\" and TypeReference \"Read\" in \"1520e1599ccc2f116ca0f89e5a935fe0.exe\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":5,"id":"static-107","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to decompress content at runtime","description":"Observed function \"System.IO.Compression.GZipStream\" in \"1520e1599ccc2f116ca0f89e5a935fe0.exe\"","origin":"Static Parser","mitre_attack_id":"T1560.002","relevance":1,"id":"static-116","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00007332.00000000.165054.03440000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00007332.00000000.165054.05B70000.00000004.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00007332.00000000.165054.05B70000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"MD5CryptoServiceProvider\" (Indicator: \"MD5CryptoServiceProvider\"; File: \"1520e1599ccc2f116ca0f89e5a935fe0.exe\")\n Found reference to \"HashAlgorithm\" (Indicator: \"HashAlgorithm\"; File: \"1520e1599ccc2f116ca0f89e5a935fe0.exe\")\n Found reference to \"MD5CryptoServiceProvider\" (Indicator: \"MD5CryptoServiceProvider\"; Source: \"00000000-00007332.00000000.165054.00EE2000.00000002.mdmp\")\n Found reference to \"HashAlgorithm\" (Indicator: \"HashAlgorithm\"; Source: \"00000000-00007332.00000000.165054.00EE2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet code contains potential unpacker","description":"Observed function \"System.Reflection.Load\" in \"1520e1599ccc2f116ca0f89e5a935fe0.exe\"","origin":"Static Parser","mitre_attack_id":"T1620","relevance":1,"id":"static-115","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file contains function to dynamically call methods at runtime","description":"Observed namespace \"Microsoft.VisualBasic.CompilerServices\" and MemberReference \"LateCall\" in \"1520e1599ccc2f116ca0f89e5a935fe0.exe\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":1,"id":"static-135","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\PhysicalDrive0; Source: \"1520e1599ccc2f116ca0f89e5a935fe0.exe\")\n Found string - winmgmts:\\\\.\\root\\SecurityCenter2; Source: \"1520e1599ccc2f116ca0f89e5a935fe0.exe\")\n Found string - \\.\\PhysicalDrive0; Source: \"00000000-00007332.00000000.165054.00EE2000.00000002.mdmp\")\n Found string - inmgmts:\\\\.\\root\\SecurityCenter2; Source: \"00000000-00007332.00000000.165054.00EE2000.00000002.mdmp\")\n Found string - \\\\.\\root\\SecurityCenter2; Source: \"00000000-00007332.00000000.165054.03440000.00000004.mdmp\")\n Found string - \\.\\root\\SecurityCenter2; Source: \"00000000-00007332.00000000.165054.03440000.00000004.mdmp\")\n Found string - \\\\.\\root\\cimv2; Source: \"00000000-00007332.00000000.165054.05B70000.00000004.mdmp\")\n Found string - winmgmts:\\\\.\\root\\SecurityCenter2; Source: \"00000000-00007332.00000000.165054.05B70000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"1520e1599ccc2f116ca0f89e5a935fe0.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"1520e1599ccc2f116ca0f89e5a935fe0.exe\" set its error mode to SEM_FAILCRITICALERRORS","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$36","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$37","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to block user input (API string)","description":"Found reference to API \"BlockInput\" (Indicator: \"BlockInput\"; File: \"1520e1599ccc2f116ca0f89e5a935fe0.exe\")\n Found reference to API \"BlockInput\" (Indicator: \"BlockInput\"; Source: \"00000000-00007332.00000000.165054.00EE2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1685","relevance":1,"id":"string-547","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"file/memory contains long string with (Indicator: \"CryptProtectData\"; Source: \"00000000-00007332.00000000.165054.05B70000.00000004.mdmp\")\n Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00007332.00000000.165054.05B70000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decode string content at runtime (.NET)","description":"Observed function \"FromBase64String\" in \"1520e1599ccc2f116ca0f89e5a935fe0.exe\"\n Observed function \"ToBase64String\" in \"1520e1599ccc2f116ca0f89e5a935fe0.exe\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":5,"id":"static-106","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; File: \"1520e1599ccc2f116ca0f89e5a935fe0.exe\")\n Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"00000000-00007332.00000000.165054.00EE2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform crypto operations","description":"Observed namespace \"System.Security.Cryptography\" in [Source: \"1520e1599ccc2f116ca0f89e5a935fe0.exe\"]","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-118","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"file/memory contains long string with (Indicator: \"CryptProtectData\"; Source: \"00000000-00007332.00000000.165054.05B70000.00000004.mdmp\")\n Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00007332.00000000.165054.05B70000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00007332.00000000.165054.03440000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data\n Matched sigs: Contains ability to perform Base64 encoding/decoding","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to decode base64 data\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains reference to crypto DLLs\n Matched sigs: Contains ability to perform encryption (API string)\n Matched sigs: Able to access crypto-related API (String)\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Able to decode string content at runtime (.NET)\n Matched sigs: Contains ability to perform crypto operations","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"Found XOR loop in file \"sample.bin\" at offset 2548; code bytes = 8030","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; File: \"1520e1599ccc2f116ca0f89e5a935fe0.exe\")\n Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00007332.00000000.165054.00EE2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system file/directory information (.NET)","description":"Observed dotnet function \"GetLogicalDrives\" in \"1520e1599ccc2f116ca0f89e5a935fe0.exe\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":3,"id":"static-200","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"get_MachineName\" (Source: \"00000000-00007332.00000000.165054.00EE2000.00000002.mdmp\")\n Found string \"get_UserName\" (Source: \"00000000-00007332.00000000.165054.00EE2000.00000002.mdmp\")\n Found string \"get_OSVersion\" (Source: \"00000000-00007332.00000000.165054.00EE2000.00000002.mdmp\")\n Found string \"UserName\" (Source: \"00000000-00007332.00000000.165054.05B70000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00007332-00000C2C-693688847\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00007332-00000C2C-690642653\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00007332-00000C2C-690643318\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"Win32API|National Language Support Functions|GetLocaleInfo|LOCALE_IDEFAULTANSICODEPAGE\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00007332.00000000.165054.03440000.00000004.mdmp\")\n Found reference to API \"Win32API|National Language Support Functions|GetLocaleInfo|LOCALE_ICOUNTRY\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00007332.00000000.165054.03440000.00000004.mdmp\")\n Found reference to API \"Win32API|National Language Support Functions|GetLocaleInfo|LOCALE_ILANGUAGE\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00007332.00000000.165054.03440000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00007332-00000C2C-692609558\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; File: \"1520e1599ccc2f116ca0f89e5a935fe0.exe\")\n Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; Source: \"00000000-00007332.00000000.165054.00EE2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"1520e1599ccc2f116ca0f89e5a935fe0.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00007332)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"1520e1599ccc2f116ca0f89e5a935fe0.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00007332)\n \"1520e1599ccc2f116ca0f89e5a935fe0.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00007332)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"1520e1599ccc2f116ca0f89e5a935fe0.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00007332)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"1520e1599ccc2f116ca0f89e5a935fe0.exe\" called \"GetForegroundWindow\" (UID: 00000000-00007332)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"1520e1599ccc2f116ca0f89e5a935fe0.exe\" called \"IsWow64Process\" with parameter \"7332\" - (UID: 00000000-00007332)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"1520e1599ccc2f116ca0f89e5a935fe0.exe\" called \"GetWindowTextA\" with parameter \"Program Manager\" - (UID: 00000000-00007332)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"1520e1599ccc2f116ca0f89e5a935fe0.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007332)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$39","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"1520e1599ccc2f116ca0f89e5a935fe0.exe\" called \"OpenMutexW\" with parameter \"Global\\CLR_CASOFF_MUTEX\" - (UID: 00000000-00007332)\n \"1520e1599ccc2f116ca0f89e5a935fe0.exe\" called \"OpenMutexW\" with parameter \"Global\\.net clr networking\" - (UID: 00000000-00007332)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$3a","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"1520e1599ccc2f116ca0f89e5a935fe0.exe\" called \"GetLocaleInfoW\" with parameter \"1024\" - (UID: 00000000-00007332)\n \"1520e1599ccc2f116ca0f89e5a935fe0.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00007332)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerates all mounted drives","description":"System.IO.Directory::GetLogicalDrives() at 1520e1599ccc2f116ca0f89e5a935fe0-6000043-OK~ko\n System.IO.Directory::GetLogicalDrives() at 1520e1599ccc2f116ca0f89e5a935fe0-600004d-OK~UNS","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-66","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"Found string \"Select * From AntiVirusProduct\" (Indicator: \"select * from \"; File: \"1520e1599ccc2f116ca0f89e5a935fe0.exe\")\n Found string \"select * from Win32_OperatingSystem\" (Indicator: \"select * from \"; Source: \"00000000-00007332.00000000.165054.03440000.00000004.mdmp, 00000000-00007332.00000000.165054.05B70000.00000004.mdmp\")\n Found string \"select * from meta_class\" (Indicator: \"select * from \"; Source: \"00000000-00007332.00000000.165054.05B70000.00000004.mdmp\")\n Found string \"Select * From AntiVirusProduct\" (Indicator: \"select * from \"; Source: \"00000000-00007332.00000000.165054.05B70000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to gather system environment details","description":"Observed function \"SetEnvironmentVariable\" in \"1520e1599ccc2f116ca0f89e5a935fe0.exe\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":1,"id":"static-119","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to gather system information (Dotnet)","description":"Observed function \"get_MachineName\" in \"1520e1599ccc2f116ca0f89e5a935fe0.exe\"\n Observed function \"get_UserName\" in \"1520e1599ccc2f116ca0f89e5a935fe0.exe\"\n Observed function \"get_OSVersion\" in \"1520e1599ccc2f116ca0f89e5a935fe0.exe\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":1,"id":"static-120","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to get active window titles (Dotnet)","description":"Observed Namespace \"System.Diagnostics.Process\" and MemberReference \"get_MainWindowTitle\" in \"1520e1599ccc2f116ca0f89e5a935fe0.exe\"","origin":"Static Parser","mitre_attack_id":"T1010","relevance":1,"id":"static-148","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"1520e1599ccc2f116ca0f89e5a935fe0.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"Found string \"set CDAudio door open\" (Indicator: \"set \"; File: \"1520e1599ccc2f116ca0f89e5a935fe0.exe\")\n Found string \"set CDAudio door closed\" (Indicator: \"set \"; File: \"1520e1599ccc2f116ca0f89e5a935fe0.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"Win32API|System Information Functions|GetWindowsDirectory\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00007332.00000000.165054.03440000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language","description":"j.kl::GetKeyboardLayout(System.Int32) at 1520e1599ccc2f116ca0f89e5a935fe0-6000077-kl~VKCodeToUnicode","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614.001","relevance":3,"id":"stream-79","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"558680616,4476,3024,,RtlGetVersion,NTDLL.dll,\"00:42:58.421\",RX=0,PX=0\" (Indicator: \"GetVersion\"; Source: \"00000000-00007332.00000000.165054.03440000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"GetVolumeInformation\" (Indicator: \"GetVolumeInformation\"; File: \"1520e1599ccc2f116ca0f89e5a935fe0.exe\")\n Found reference to API \"GetVolumeInformationA\" (Indicator: \"GetVolumeInformation\"; File: \"1520e1599ccc2f116ca0f89e5a935fe0.exe\")\n Found reference to API \"GetVolumeInformation\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00007332.00000000.165054.00EE2000.00000002.mdmp\")\n Found reference to API \"GetVolumeInformationA\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00007332.00000000.165054.00EE2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Environment Awareness","name":"Queries the user identity associated with the current process token","description":"\"1520e1599ccc2f116ca0f89e5a935fe0.exe\" queried token user identity (UID: 00000000-00007332)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-328","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$3c","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"1520e1599ccc2f116ca0f89e5a935fe0.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"General","name":".NET code is able to query registry","description":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"OpenSubKey\" in \"1520e1599ccc2f116ca0f89e5a935fe0.exe\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"GetValue\" in \"1520e1599ccc2f116ca0f89e5a935fe0.exe\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"GetValueNames\" in \"1520e1599ccc2f116ca0f89e5a935fe0.exe\"","origin":"Static Parser","mitre_attack_id":"T1012","relevance":5,"id":"static-138","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"General","name":".NET source code contains suspicious native API","description":"Observed API \"GetAsyncKeyState\" in \"1520e1599ccc2f116ca0f89e5a935fe0.exe\"\n Observed API \"MapVirtualKey\" in \"1520e1599ccc2f116ca0f89e5a935fe0.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":5,"id":"static-126","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"General","name":"Able to execute application (.NET)","description":"Observed function \"System.Diagnostics.ProcessStartInfo.UseShellExecute\" in \"1520e1599ccc2f116ca0f89e5a935fe0.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":3,"id":"static-108","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"General","name":"Able to execute applications using .NET process API","description":"Found string \"ProcessStartInfo\" (Source: \"00000000-00007332.00000000.165054.00EE2000.00000002.mdmp\")\n Found string \"set_UseShellExecute\" (Source: \"00000000-00007332.00000000.165054.00EE2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-934","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$3d","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$3e","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"General","name":"Can load assembly that contains the code that is currently executing (Dotnet)","description":"Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; File: \"1520e1599ccc2f116ca0f89e5a935fe0.exe\")\n Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; Source: \"00000000-00007332.00000000.165054.00EE2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1620","relevance":1,"id":"string-615","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"124.222.18.236:14426\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"Select * From AntiVirusProduct\" (Source: 1520e1599ccc2f116ca0f89e5a935fe0.exe, Indicator: \"select * from antivirusproduct\")\n \"select * from Win32_OperatingSystem\" (Source: 00000000-00007332.00000000.165054.03440000.00000004.mdmp, 00000000-00007332.00000000.165054.05B70000.00000004.mdmp, Indicator: \"select * from win32_operatingsystem\")\n \"select * from meta_class\" (Source: 00000000-00007332.00000000.165054.05B70000.00000004.mdmp, Indicator: \"select * from meta_class\")\n \"Select * From AntiVirusProduct\" (Source: 00000000-00007332.00000000.165054.05B70000.00000004.mdmp, Indicator: \"select * from antivirusproduct\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFile\" (Indicator: \"CreateFile\"; File: \"1520e1599ccc2f116ca0f89e5a935fe0.exe\")\n Found reference to API \"CreateFile\" (Indicator: \"CreateFile\"; Source: \"00000000-00007332.00000000.165054.00EE2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"General","name":"Contains ability to download files with network (Dotnet)","description":"Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadString\" in \"1520e1599ccc2f116ca0f89e5a935fe0.exe\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadData\" in \"1520e1599ccc2f116ca0f89e5a935fe0.exe\"","origin":"Static Parser","mitre_attack_id":"T1105","relevance":1,"id":"static-99","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"set_UseShellExecute\" (Indicator: \"ShellExecute\"; File: \"1520e1599ccc2f116ca0f89e5a935fe0.exe\")\n Found reference to API \"set_UseShellExecute\" (Indicator: \"ShellExecute\"; Source: \"00000000-00007332.00000000.165054.00EE2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"General","name":"Contains ability to executes commands or batch file","description":"Found string \"cmd.exe /c ping 0 -n 2 & del \\\"\" (Indicator: \"cmd.exe /c\"; File: \"1520e1599ccc2f116ca0f89e5a935fe0.exe\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-174","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"1520e1599ccc2f116ca0f89e5a935fe0.exe\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; File: \"1520e1599ccc2f116ca0f89e5a935fe0.exe\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00007332.00000000.165054.00EE2000.00000002.mdmp\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00007332.00000000.165054.00EE2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"General","name":"Contains ability to start a process (Dotnet)","description":"Observed function \"Process.Start\" in \"1520e1599ccc2f116ca0f89e5a935fe0.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-111","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$40","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$41","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"General","name":"Dotnet code contains ability to modify/delete registry","description":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"DeleteValue\" in \"1520e1599ccc2f116ca0f89e5a935fe0.exe\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"CreateSubKey\" in \"1520e1599ccc2f116ca0f89e5a935fe0.exe\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"SetValue\" in \"1520e1599ccc2f116ca0f89e5a935fe0.exe\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"DeleteSubKey\" in \"1520e1599ccc2f116ca0f89e5a935fe0.exe\"","origin":"Static Parser","mitre_attack_id":"T1112","relevance":1,"id":"static-139","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\"1520e1599ccc2f116ca0f89e5a935fe0.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\ole32.dll\" - [base:0; Status:c0000135]\n \"1520e1599ccc2f116ca0f89e5a935fe0.exe\" failed to load missing module \"%WINDIR%\\assembly\\GAC_MSIL\\System\\2.0.0.0__b77a5c561934e089\\ws2_32.dll\" - [base:0; Status:c0000135]\n \"1520e1599ccc2f116ca0f89e5a935fe0.exe\" failed to load missing module \"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\oleaut32.dll\" - [base:0; Status:c0000135]\n \"1520e1599ccc2f116ca0f89e5a935fe0.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\OLEAUT32.dll\" - [base:0; Status:c0000135]\n \"1520e1599ccc2f116ca0f89e5a935fe0.exe\" failed to load missing module \"C:\\avicap32.dll\" - [base:0; Status:c0000135]\n \"1520e1599ccc2f116ca0f89e5a935fe0.exe\" failed to load missing module \"%WINDIR%\\assembly\\GAC_32\\CustomMarshalers\\2.0.0.0__b03f5f7f11d50a3a\\oleaut32\" - [base:0; Status:c0000135]","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"1520e1599ccc2f116ca0f89e5a935fe0.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"General","name":"Found Native API in Dotnet file","description":"$42","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-101","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"General","name":"Found WMI keywords in script (string)","description":"Observed WMI keyword:\"//./root/cimv2\" [Source: 00000000-00007332.00000000.165054.05B70000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-155","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$43","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$44","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"1520e1599ccc2f116ca0f89e5a935fe0.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\7aa13700a6fcdcb57e6cb353e54d0ab9\\mscorlib.ni.dll\" at 73040000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"1520e1599ccc2f116ca0f89e5a935fe0.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 77A60000\n \"1520e1599ccc2f116ca0f89e5a935fe0.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 71070000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"1520e1599ccc2f116ca0f89e5a935fe0.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75B70000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"1520e1599ccc2f116ca0f89e5a935fe0.exe\" was detected as \".NET\" and name: \"Library\"\n \"1520e1599ccc2f116ca0f89e5a935fe0.exe\" was detected as \"VB.NET\" and name: \"Compiler\"\n \"1520e1599ccc2f116ca0f89e5a935fe0.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$45","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"1520e1599ccc2f116ca0f89e5a935fe0.exe\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","id":"static-144","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"1520e1599ccc2f116ca0f89e5a935fe0.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$46","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"General","name":"Possibly checks for the presence of an Antivirus engine","description":"\"GetAntiVirus\" (Indicator: \"antivirus\") in Source: 1520e1599ccc2f116ca0f89e5a935fe0.exe","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":2,"id":"string-8","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"6.tcp.vip.cpolar.cn\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"1520e1599ccc2f116ca0f89e5a935fe0.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"1520e1599ccc2f116ca0f89e5a935fe0.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"1520e1599ccc2f116ca0f89e5a935fe0.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"1520e1599ccc2f116ca0f89e5a935fe0.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\"; Key: \"SYEARMONTH\")\n \"1520e1599ccc2f116ca0f89e5a935fe0.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")\n \"1520e1599ccc2f116ca0f89e5a935fe0.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$47","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"1520e1599ccc2f116ca0f89e5a935fe0.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"1520e1599ccc2f116ca0f89e5a935fe0.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$48","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"1520e1599ccc2f116ca0f89e5a935fe0.exe\" queries basic process information of the \"C:\\1520e1599ccc2f116ca0f89e5a935fe0.exe\" (UID: 7332)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$49","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"1520e1599ccc2f116ca0f89e5a935fe0.exe\" reads file \"c:\\windows\\microsoft.net\\framework\\v2.0.50727\\config\\machine.config\"\n \"1520e1599ccc2f116ca0f89e5a935fe0.exe\" reads file \"c:\\windows\\syswow64\\wbem\\wbemdisp.tlb\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Installation/Persistence","name":"References PATH environment registry keys","description":"Found string \"System\\CurrentControlSet\\Control\\Session Manager\\Environment\"; Source: \"00000000-00007332.00000000.165054.05B70000.00000004.mdmp\")\n Found string \"HKEY_CURRENT_USER\\Environment\\.\"; Source: \"00000000-00007332.00000000.165054.05B70000.00000004.mdmp\")\n Found string \"HKEY_CURRENT_USER\\Environment\"; Source: \"00000000-00007332.00000000.165054.05B70000.00000004.mdmp\")\n Found string \"HKEY_CURRENT_USER\\Environment\\SEE_MASK_NOZONECHECKS\"; Source: \"00000000-00007332.00000000.165054.05B70000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1574.007","relevance":1,"id":"string-530","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Installation/Persistence","name":"References powershell process","description":"Found string \"cmd /c powershell Set-MpPreference -DisableRealtimeMonitoring $true\" (Indicator: \"cmd /c powershell\"; File: \"1520e1599ccc2f116ca0f89e5a935fe0.exe\")\n Found string \"cmd /c powershell Set-MpPreference -DisableRealtimeMonitoring $true\" (Indicator: \"cmd /c powershell\"; Source: \"00000000-00007332.00000000.165054.05B70000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-185","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$4a","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$4b","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$4c","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"Found string \"cmd.exe /c ping 0 -n 2 & del \\\"\" (Indicator: \"cmd.exe /c ping\"; File: \"1520e1599ccc2f116ca0f89e5a935fe0.exe\"), Found string \"cmd.exe /c ping 0 -n 2 & del \\\"\" (Indicator: \"/c ping\"; File: \"1520e1599ccc2f116ca0f89e5a935fe0.exe\")\n Found string \"md.exe /c ping 0 -n 2 & del \"\" (Indicator: \"/c ping\"; Source: \"00000000-00007332.00000000.165054.00EE2000.00000002.mdmp\"), Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00007332.00000000.165054.03440000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":7,"id":"string-417","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00007332-00000C2C-692538259\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate via sockets (Dotnet)","description":"$4d","origin":"Static Parser","mitre_attack_id":"T1095","relevance":1,"id":"static-159","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00007332-00000C2C-692520127\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (Dotnet)","description":"Observed Namespace \"System.Net.WebClient\" and MemberReference \".ctor\" in \"1520e1599ccc2f116ca0f89e5a935fe0.exe\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadString\" in \"1520e1599ccc2f116ca0f89e5a935fe0.exe\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadData\" in \"1520e1599ccc2f116ca0f89e5a935fe0.exe\"","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-158","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicates via socket (possible C&C communication)","description":"Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"set_ReceiveTimeout\" in \"1520e1599ccc2f116ca0f89e5a935fe0.exe\"\n Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"Receive\" in \"1520e1599ccc2f116ca0f89e5a935fe0.exe\"","origin":"Static Parser","mitre_attack_id":"T1071","relevance":1,"id":"static-151","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Network Related","name":"Contains ability to provide interface for network protocols (Dotnet)","description":"Observed namespace \"System.Net\" in \"1520e1599ccc2f116ca0f89e5a935fe0.exe\"\n Observed namespace \"System.Net.Sockets\" in \"1520e1599ccc2f116ca0f89e5a935fe0.exe\"","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-110","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$50","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://pastebin.com\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLE4A3DE7888DEF66E4CEFE6BFBF001]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00007332.00000000.165054.03440000.00000004.mdmp\")\n Found string \"9ncalrpc:[epmapper,Security=Impersonation Dynamic False]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00007332.00000000.165054.03440000.00000004.mdmp\")\n Found string \"B+ncalrpc:[OLE4A3DE7888DEF66E4CEFE6BFBF001]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00007332.00000000.165054.03440000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE303EB121409B57C9399C4E5C4DEB]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00007332.00000000.165054.03440000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"$51","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"329830259,596,3025,,RtlGetNtProductType,NTDLL.dll,\"00:42:58.328\",RX=0,PX=0\" (Indicator: \"RtlGetNtProductType\"; Source: \"00000000-00007332.00000000.165054.03440000.00000004.mdmp\")\n Found reference to API \"558680616,4476,3024,,RtlGetVersion,NTDLL.dll,\"00:42:58.421\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00007332.00000000.165054.03440000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to perform SQL operations","description":"Found string \"\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00007332.00000000.165054.05B70000.00000004.mdmp\")\n Found string \"System.Data.SqlClient\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00007332.00000000.165054.05B70000.00000004.mdmp\")\n Found string \"System.Data.Odbc\" (Indicator: \"System.Data.Odbc\"; Source: \"00000000-00007332.00000000.165054.05B70000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"$52","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; File: \"1520e1599ccc2f116ca0f89e5a935fe0.exe\")\n Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00007332.00000000.165054.00EE2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve running process details (.NET)","description":"Found string \"GetProcessById\" (Source: \"00000000-00007332.00000000.165054.00EE2000.00000002.mdmp\")\n Found string \"get_ProcessName\" (Source: \"00000000-00007332.00000000.165054.00EE2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-931","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$53","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"1520e1599ccc2f116ca0f89e5a935fe0.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate Windows drive types","description":"\"1520e1599ccc2f116ca0f89e5a935fe0.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00007332)","origin":"API Call","mitre_attack_id":"T1680","relevance":7,"id":"api-327","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"1520e1599ccc2f116ca0f89e5a935fe0.exe\" called \"GetComputerNameW\" (UID: 00000000-00007332)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"1520e1599ccc2f116ca0f89e5a935fe0.exe\" called \"GetUserNameW\" (UID: 00000000-00007332)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$54","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen information (Dotnet)","description":"Observed Namespace \"System.Windows.Forms::Screen\" and MemberReference \"get_PrimaryScreen\" in \"1520e1599ccc2f116ca0f89e5a935fe0.exe\"\n Observed Namespace \"Microsoft.VisualBasic.Devices::Computer\" and MemberReference \"get_Keyboard\" in \"1520e1599ccc2f116ca0f89e5a935fe0.exe\"","origin":"Static Parser","mitre_attack_id":"T1113","relevance":1,"id":"static-164","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetProcessesByName\" (Indicator: \"GetProcessesByName\"; File: \"1520e1599ccc2f116ca0f89e5a935fe0.exe\")\n Found reference to API \"GetProcessById\" (Indicator: \"GetProcessById\"; File: \"1520e1599ccc2f116ca0f89e5a935fe0.exe\")\n Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; File: \"1520e1599ccc2f116ca0f89e5a935fe0.exe\")\n Found reference to API \"GetProcessesByName\" (Indicator: \"GetProcessesByName\"; Source: \"00000000-00007332.00000000.165054.00EE2000.00000002.mdmp\")\n Found reference to API \"GetProcessById\" (Indicator: \"GetProcessById\"; Source: \"00000000-00007332.00000000.165054.00EE2000.00000002.mdmp\")\n Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00007332.00000000.165054.00EE2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to gather process details (Dotnet)","description":"Observed function \"GetProcessesByName\" in \"1520e1599ccc2f116ca0f89e5a935fe0.exe\"\n Observed function \"GetProcessById\" in \"1520e1599ccc2f116ca0f89e5a935fe0.exe\"\n Observed function \"get_ProcessName\" in \"1520e1599ccc2f116ca0f89e5a935fe0.exe\"","origin":"Static Parser","mitre_attack_id":"T1057","relevance":1,"id":"static-100","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetTempPath\" (Indicator: \"GetTempPath\"; File: \"1520e1599ccc2f116ca0f89e5a935fe0.exe\")\n Found reference to API \"GetTempPath\" (Indicator: \"GetTempPath\"; Source: \"00000000-00007332.00000000.165054.00EE2000.00000002.mdmp\")\n Found reference to API \"Win32API|System Information Functions|GetSystemDirectory\" (Indicator: \"GetSystemDirectory\"; Source: \"00000000-00007332.00000000.165054.03440000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"$55","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"applicationName=\"/\" requiresUniqueEmail=\"false\" passwordFormat=\"Hashed\" maxInvalidPasswordAttempts=\"5\" minRequiredPasswordLength=\"7\" minRequiredNonalphanumericCharacters=\"1\" passwordAttemptWindow=\"10\" passwordStrengthRegularExpression=\"\"/>\" (Indicator: \"password\"; Source: \"00000000-00007332.00000000.165054.05B70000.00000004.mdmp\")\n Found string \"passwordFormat\" (Indicator: \"password\"; Source: \"00000000-00007332.00000000.165054.05B70000.00000004.mdmp\")\n Found string \"passwordAttemptWindow\" (Indicator: \"password\"; Source: \"00000000-00007332.00000000.165054.05B70000.00000004.mdmp\")\n Found string \"passwordStrengthRegularExpression\" (Indicator: \"password\"; Source: \"00000000-00007332.00000000.165054.05B70000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"password\"; Source: \"00000000-00007332.00000000.165054.05B70000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"$56","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"Found string \"Select * From AntiVirusProduct\" (Indicator: \"antivirusproduct\"; File: \"1520e1599ccc2f116ca0f89e5a935fe0.exe\")\n Found string \"elect * From AntiVirusProduct\" (Indicator: \"antivirusproduct\"; Source: \"00000000-00007332.00000000.165054.00EE2000.00000002.mdmp\")\n Found string \"select * from Win32_OperatingSystem\" (Indicator: \" Win32_OperatingSystem\"; Source: \"00000000-00007332.00000000.165054.03440000.00000004.mdmp, 00000000-00007332.00000000.165054.05B70000.00000004.mdmp\")\n Found string \"Select * From AntiVirusProduct\" (Indicator: \"antivirusproduct\"; Source: \"00000000-00007332.00000000.165054.05B70000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"System Destruction","name":"Contains ability to lock the workstation's display (API string)","description":"Found reference to API \"cmd /c rundll32.exe user32.dll,LockWorkStation\" (Indicator: \"LockWorkStation\"; File: \"1520e1599ccc2f116ca0f89e5a935fe0.exe\")\n Found reference to API \"md /c rundll32.exe user32.dll,LockWorkStation\" (Indicator: \"LockWorkStation\"; Source: \"00000000-00007332.00000000.165054.00EE2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1499","relevance":1,"id":"string-221","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"1520e1599ccc2f116ca0f89e5a935fe0.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00007332)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00007332.00000000.165054.03440000.00000004.mdmp\")\n Found string \"Microsoft Windows 10 Pro|C:\\WINDOWS|\\Device\\Harddisk0\\Partition2\" (Indicator: \"\\Device\\\"; Source: \"00000000-00007332.00000000.165054.03440000.00000004.mdmp, 00000000-00007332.00000000.165054.05B70000.00000004.mdmp\")\n Found string \"\\Device\\HarddiskVolume1\" (Indicator: \"\\Device\\\"; Source: \"00000000-00007332.00000000.165054.03440000.00000004.mdmp\")\n Found string \"\\Device\\HarddiskVolume2\" (Indicator: \"\\Device\\\"; Source: \"00000000-00007332.00000000.165054.03440000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"System Security","name":"Contains ability to disable Windows Defender using PowerShell","description":"Found string \"cmd /c powershell Set-MpPreference -DisableRealtimeMonitoring $true\" (Indicator: \"disablerealtimemonitoring\"; File: \"1520e1599ccc2f116ca0f89e5a935fe0.exe\")\n Found string \"md /c powershell Set-MpPreference -DisableRealtimeMonitoring $true\" (Indicator: \"disablerealtimemonitoring\"; Source: \"00000000-00007332.00000000.165054.00EE2000.00000002.mdmp\")\n Found string \"cmd /c powershell Set-MpPreference -DisableRealtimeMonitoring $true\" (Indicator: \"disablerealtimemonitoring\"; Source: \"00000000-00007332.00000000.165054.05B70000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1685","relevance":1,"id":"string-748","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify Windows Defender preferences (Powershell command string)","description":"Found string \"cmd /c powershell Set-MpPreference -DisableRealtimeMonitoring $true\" (Indicator: \"Set-MpPreference\"; File: \"1520e1599ccc2f116ca0f89e5a935fe0.exe\")\n Found string \"md /c powershell Set-MpPreference -DisableRealtimeMonitoring $true\" (Indicator: \"Set-MpPreference\"; Source: \"00000000-00007332.00000000.165054.00EE2000.00000002.mdmp\")\n Found string \"cmd /c powershell Set-MpPreference -DisableRealtimeMonitoring $true\" (Indicator: \"Set-MpPreference\"; Source: \"00000000-00007332.00000000.165054.05B70000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1685","relevance":1,"id":"string-275","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00007332.00000000.165054.05B70000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"cmd /c shutdown /s /f /t 60\" (Indicator: \"cmd /c shutdown\") in Source: 1520e1599ccc2f116ca0f89e5a935fe0.exe\n Observed string: \"cmd /c shutdown -a\" (Indicator: \"cmd /c shutdown\") in Source: 6000040-OK~Ind\n Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00007332-00000C2C-699709974","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"1520e1599ccc2f116ca0f89e5a935fe0.exe\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00007332.00000000.165054.00EE2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"1520e1599ccc2f116ca0f89e5a935fe0.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"1520e1599ccc2f116ca0f89e5a935fe0.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$57","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"\"1520e1599ccc2f116ca0f89e5a935fe0.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\ENVIRONMENT\"; Key: \"SEE_MASK_NOZONECHECKS\"; Value: \"3100000000\")\n \"1520e1599ccc2f116ca0f89e5a935fe0.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"394F23FB4C8C32D52DF2198922E095FD\"; Value: \"\"C:\\1520e1599ccc2f116ca0f89e5a935fe0.exe\" ..\")\n \"1520e1599ccc2f116ca0f89e5a935fe0.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"394F23FB4C8C32D52DF2198922E095FD\"; Value: \"\"C:\\1520e1599ccc2f116ca0f89e5a935fe0.exe\" ..\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to set/modify configuration (Powershell command string)","description":"Found string \"cmd /c powershell Set-MpPreference -DisableRealtimeMonitoring $true\" (Indicator: \"Set-MpPreference\"; File: \"1520e1599ccc2f116ca0f89e5a935fe0.exe\")\n Found string \"md /c powershell Set-MpPreference -DisableRealtimeMonitoring $true\" (Indicator: \"Set-MpPreference\"; Source: \"00000000-00007332.00000000.165054.00EE2000.00000002.mdmp\")\n Found string \"cmd /c powershell Set-MpPreference -DisableRealtimeMonitoring $true\" (Indicator: \"Set-MpPreference\"; Source: \"00000000-00007332.00000000.165054.05B70000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-395","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$58","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"1520e1599ccc2f116ca0f89e5a935fe0.exe\" was detected as \"Microsoft Visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"1520e1599ccc2f116ca0f89e5a935fe0.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Tries to save executable or command in registry","description":"\"1520e1599ccc2f116ca0f89e5a935fe0.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"394F23FB4C8C32D52DF2198922E095FD\"; Value: \"\"C:\\1520e1599ccc2f116ca0f89e5a935fe0.exe\" ..\")\n \"1520e1599ccc2f116ca0f89e5a935fe0.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"394F23FB4C8C32D52DF2198922E095FD\"; Value: \"\"C:\\1520e1599ccc2f116ca0f89e5a935fe0.exe\" ..\")","origin":"Registry Access","mitre_attack_id":"T1547","relevance":7,"id":"registry-113","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Contains ability to block user input","description":"j.OK::BlockInput(System.Boolean) at 1520e1599ccc2f116ca0f89e5a935fe0-6000040-OK~Ind","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1685","relevance":7,"id":"stream-26","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"1520e1599ccc2f116ca0f89e5a935fe0.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 7332)","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"May check for the presence of a forensics/monitoring tool","description":"Found string \"Wireshark.exe\" (Indicator: \"wireshark.exe\"; File: \"1520e1599ccc2f116ca0f89e5a935fe0.exe\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":3,"id":"string-45","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"19/26 Antivirus vendors marked sample as malicious (73% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"1520e1599ccc2f116ca0f89e5a935fe0.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"394F23FB4C8C32D52DF2198922E095FD\"; Value: \"\"C:\\1520e1599ccc2f116ca0f89e5a935fe0.exe\" ..\")\n \"1520e1599ccc2f116ca0f89e5a935fe0.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"394F23FB4C8C32D52DF2198922E095FD\"; Value: \"\"C:\\1520e1599ccc2f116ca0f89e5a935fe0.exe\" ..\")","origin":"Registry Access","mitre_attack_id":"T1547.001","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection","description":"$59","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1571","relevance":5,"id":"stream-85","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"suspicious","category":"Network Related","name":"Spawned process connects to a network","description":"Process \"C:\\1520e1599ccc2f116ca0f89e5a935fe0.exe\" connects to 124.222.18.236 on port 14426 (TCP); Domain: \"6.tcp.vip.cpolar.cn\"","origin":"Monitored Target","mitre_attack_id":"T1071","relevance":5,"id":"target-412","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"suspicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 124.222.18.236 on port 14426","origin":"Network Traffic","mitre_attack_id":"T1571","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"suspicious","category":"Pattern Matching","name":"Yara Signature Match - Indicators","description":"YARA signature \"INDICATOR_SUSPICIOUS_EXE_RawPaste_URL\" matched file \"sample.bin\" as \"Detects executables (downlaoders) containing URLs to raw contents of a paste\"","origin":"YARA Signature","relevance":9,"id":"yara-553","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Able to delete scheduled task(s)","description":"Found string \"schtasks /delete /tn CleanSweepCheck /f\" (Indicator: \"schtasks /delete\"; File: \"1520e1599ccc2f116ca0f89e5a935fe0.exe\")\n Found string \"schtasks /delete /tn CleanSweepCheck /f\" (Indicator: \"schtasks /delete\"; Source: \"00000000-00007332.00000000.165054.05B70000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1685","relevance":1,"id":"string-629","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"$5a","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Able to capture screenshot","description":"Observed function \"System.Drawing.CopyFromScreen\" in \"1520e1599ccc2f116ca0f89e5a935fe0.exe\"","origin":"Static Parser","mitre_attack_id":"T1113","relevance":1,"id":"static-113","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Able to perform a screen capture","description":"System.Drawing.Graphics::CopyFromScreen(System.Int32,System.Int32,System.Int32,System.Int32,System.Drawing.Size,System.Drawing.CopyPixelOperation) at 1520e1599ccc2f116ca0f89e5a935fe0-6000040-OK~Ind","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1113","relevance":5,"id":"stream-72","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used for keylogging","description":"\"1520e1599ccc2f116ca0f89e5a935fe0.exe\" called \"GetAsyncKeyState\" with parameters {\"vKey\": \"0\"}\n \"1520e1599ccc2f116ca0f89e5a935fe0.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"16\"}\n \"1520e1599ccc2f116ca0f89e5a935fe0.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"17\"}\n \"1520e1599ccc2f116ca0f89e5a935fe0.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"18\"}\n \"1520e1599ccc2f116ca0f89e5a935fe0.exe\" called \"GetAsyncKeyState\" with parameters {\"vKey\": \"1\"}\n \"1520e1599ccc2f116ca0f89e5a935fe0.exe\" called \"GetAsyncKeyState\" with parameters {\"vKey\": \"2\"}\n \"1520e1599ccc2f116ca0f89e5a935fe0.exe\" called \"GetAsyncKeyState\" with parameters {\"vKey\": \"3\"}\n \"1520e1599ccc2f116ca0f89e5a935fe0.exe\" called \"GetAsyncKeyState\" with parameters {\"vKey\": \"4\"}\n \"1520e1599ccc2f116ca0f89e5a935fe0.exe\" called \"GetAsyncKeyState\" with parameters {\"vKey\": \"5\"}\n \"1520e1599ccc2f116ca0f89e5a935fe0.exe\" called \"GetAsyncKeyState\" with parameters {\"vKey\": \"6\"}","origin":"API Call","mitre_attack_id":"T1056.001","relevance":5,"id":"api-40","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to find and list the Windows drive types","description":"\"1520e1599ccc2f116ca0f89e5a935fe0.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00007332)","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-110","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"System.Diagnostics.Process::GetProcessesByName(System.String) at 1520e1599ccc2f116ca0f89e5a935fe0-6000013-MyAntiProcess~Handler\n System.Diagnostics.Process::GetProcessesByName(System.String) at 1520e1599ccc2f116ca0f89e5a935fe0-600001c-OK~bac\n System.Diagnostics.Process::GetProcessesByName(System.String) at 1520e1599ccc2f116ca0f89e5a935fe0-6000055-xma~Handler\n System.Diagnostics.Process::GetProcessesByName(System.String) at 1520e1599ccc2f116ca0f89e5a935fe0-6000058-xxma~Handler\n System.Diagnostics.Process::GetProcessById(System.Int32) at 1520e1599ccc2f116ca0f89e5a935fe0-6000064-AntiTaskManager~protect\n System.Diagnostics.Process::GetProcessById(System.Int32) at 1520e1599ccc2f116ca0f89e5a935fe0-600006f-kl~AV","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve keyboard strokes","description":"j.kl::GetKeyboardState(System.Byte[]) at 1520e1599ccc2f116ca0f89e5a935fe0-6000077-kl~VKCodeToUnicode\n j.kl::GetAsyncKeyState(System.Int32) at 1520e1599ccc2f116ca0f89e5a935fe0-6000078-kl~WRK","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1056.001","relevance":8,"id":"stream-12","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"suspicious","category":"System Security","name":"References security-related Windows services","description":"\"cmd /c sc query windefend\" (Indicator: \"windefend\") in Source: 1520e1599ccc2f116ca0f89e5a935fe0.exe\n \"cmd /c sc stop windefend\" (Indicator: \"windefend\") in Source: 1520e1599ccc2f116ca0f89e5a935fe0.exe\n \"cmd /c sc delete windefend\" (Indicator: \"windefend\") in Source: 1520e1599ccc2f116ca0f89e5a935fe0.exe","origin":"File/Memory","mitre_attack_id":"T1574.010","relevance":3,"id":"string-43","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"19/26 Antivirus vendors marked sample as malicious (73% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"YARA signature \"njrat1\" classified file \"sample.bin\" as \"rat,njrat\"\n YARA signature \"win_exe_njRAT\" classified file \"sample.bin\" as \"rat,njrat\"\n YARA signature \"MAL_Winnti_Sample_May18_1\" classified file \"sample.bin\" as \"winnti,umbrella\" (Reference: https://401trg.pw/burning-umbrella/)\n YARA signature \"MALWARE_Win_NjRAT\" matched file \"sample.bin\" as \"Detects NjRAT / Bladabindi / NjRAT Golden\"","origin":"YARA Signature","relevance":9,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"name":"Evasive","details_count":3,"details":[{"detail":"References security-related Windows services"},{"detail":"May check for the presence of a forensics/monitoring tool"},{"detail":"Found a reference to a WMI query string known to be used for VM detection"}],"sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]}],"intel_graph":{"map":{"Adversary:bbed552e992e2f7ab900f2a8c5f22571d38fe81d84374db1500f7609f59b7300":{"type":"Adversary","value":"BLIND SPIDER","verdict":{"verdict":"malicious","verdict_source":"indicator database"}},"Domain:6.tcp.vip.cpolar.cn":{"type":"Domain","value":"6.tcp.vip.cpolar.cn"},"File:d05a2053a4e0f1e22debe07c069c8a51e42fd481b1fe39e118feb3346bcf485d":{"type":"File","value":"d05a2053a4e0f1e22debe07c069c8a51e42fd481b1fe39e118feb3346bcf485d","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Detected malware C2 configuration","Detected relationship with a Threat njRATLime","File reported as dropper by ClamAV antivirus","confirmed malicious file","confirmed relationship with a Threat njRATLime","confirmed relationship with an Adversary BLIND SPIDER"]},"filetype":"PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"Ip:124.222.18.236":{"type":"Ip","value":"124.222.18.236"},"Threat:fb2c65d9166b785ec5dbac0b906f92b33db7ca364e328f1af5a4d834909f0570":{"type":"Threat","value":"njRATLime","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Detected relationship with a Threat njRATLime","confirmed relationship with an Adversary BLIND SPIDER"]}},"Url:af75169f899a6a99be19c774c545c139a36f51db89c5f8dd4643457b38023cec":{"type":"Url","value":"unspec://6.tcp.vip.cpolar.cn:14426","verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Detected malware C2 configuration"]}}},"chains":[{"id":"1560185368209757532","root":"File:d05a2053a4e0f1e22debe07c069c8a51e42fd481b1fe39e118feb3346bcf485d","edges":[],"verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Detected malware C2 configuration","Detected relationship with a Threat njRATLime","File reported as dropper by ClamAV antivirus","confirmed malicious file","confirmed relationship with a Threat njRATLime","confirmed relationship with an Adversary BLIND SPIDER"]}},{"id":"1560185368209757533","root":"File:d05a2053a4e0f1e22debe07c069c8a51e42fd481b1fe39e118feb3346bcf485d","edges":[{"edge_kind":"is_threat","from_key":"File:d05a2053a4e0f1e22debe07c069c8a51e42fd481b1fe39e118feb3346bcf485d","to_key":"Threat:fb2c65d9166b785ec5dbac0b906f92b33db7ca364e328f1af5a4d834909f0570"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected","confirmed relationship with an Adversary BLIND SPIDER"]}},{"id":"1560185362172851345","root":"File:d05a2053a4e0f1e22debe07c069c8a51e42fd481b1fe39e118feb3346bcf485d","edges":[{"edge_kind":"contains_c2_config","from_key":"File:d05a2053a4e0f1e22debe07c069c8a51e42fd481b1fe39e118feb3346bcf485d","to_key":"Url:af75169f899a6a99be19c774c545c139a36f51db89c5f8dd4643457b38023cec"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1560185362967902583","root":"Threat:fb2c65d9166b785ec5dbac0b906f92b33db7ca364e328f1af5a4d834909f0570","edges":[{"edge_kind":"used_by","from_key":"Threat:fb2c65d9166b785ec5dbac0b906f92b33db7ca364e328f1af5a4d834909f0570","to_key":"Adversary:bbed552e992e2f7ab900f2a8c5f22571d38fe81d84374db1500f7609f59b7300"}],"verdict":{"verdict":"malicious","verdict_source":"indicator database"}},{"id":"1560185362967902584","root":"Threat:fb2c65d9166b785ec5dbac0b906f92b33db7ca364e328f1af5a4d834909f0570","edges":[],"verdict":{"verdict":"malicious","verdict_source":"indicator database"}},{"id":"sandbox_network","root":"File:d05a2053a4e0f1e22debe07c069c8a51e42fd481b1fe39e118feb3346bcf485d","edges":[{"edge_kind":"contacted_ip","from_key":"File:d05a2053a4e0f1e22debe07c069c8a51e42fd481b1fe39e118feb3346bcf485d","to_key":"Ip:124.222.18.236"},{"edge_kind":"contacted_domain","from_key":"File:d05a2053a4e0f1e22debe07c069c8a51e42fd481b1fe39e118feb3346bcf485d","to_key":"Domain:6.tcp.vip.cpolar.cn"},{"edge_kind":"resolves_to","from_key":"Domain:6.tcp.vip.cpolar.cn","to_key":"Ip:124.222.18.236"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":11,"imported_dlls_count":79,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":3,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":1,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["commodity","targetedcrimeware","rat","njrat","ddos","cobaltstrike","informationstealer","keylogger","quasar","njratlime","opensource","targeted","xworm","criminal","ransomware","umbrella","winnti","evasive"],"sample_flags":["Network Traffic"],"sandbox_reports":[{"id":"6ad079d4d3d5ea749d0dc74a","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Bladabindi.BB trojan","contacted_countries":["CHN"],"submit_name":"1520e1599ccc2f116ca0f89e5a935fe0.exe","analysis_start_time":"2026-10-15T06:59:34+00:00","indicators_count":{"informative":154,"suspicious":32,"malicious":4},"tags":["Network Traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"124.222.18.236","port":14426,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]}],"dns_resolutions":[{"domain":"6.tcp.vip.cpolar.cn","address":"124.222.18.236","ttl":600,"country":"China","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]}],"http_requests":null,"embedded_urls":[{"value":"unspec://6.tcp.vip.cpolar.cn:14426","sources":[{"report_type":"qsp","report_id":""}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}],"processes":[{"pid":7332,"ppid":0,"name":"1520e1599ccc2f116ca0f89e5a935fe0.exe","command_line":"","sha256":"d05a2053a4e0f1e22debe07c069c8a51e42fd481b1fe39e118feb3346bcf485d","normalized_path":"C:\\1520e1599ccc2f116ca0f89e5a935fe0.exe","uid":"00000000-00007332","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAA6UgIhRBPKvFtlTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50refsbU/OstCIAAAAASUVORK5CYII="}],"all_imported_dlls":["cryptbase.dll","msvcp140.dll","wbemsvc.dll","CustomMarshalers.ni.dll","wow64cpu.dll","bcryptprimitives.dll","shlwapi.dll","System.Management.ni.dll","CustomMarshalers.dll","wow64win.dll","ole32.dll","kernel.appcore.dll","mscorjit.dll","IPHLPAPI.DLL","WMINet_Utils.dll","avicap32.dll","mscoree.dll","fltLib.dll","gdi32full.dll","msvcrt.dll","mscorwks.dll","mswsock.dll","winmmbase.dll","msvcp_win.dll","version.dll","windows.storage.dll","rasadhlp.dll","FWPUCLNT.DLL","wmiutils.dll","combase.dll","uxtheme.dll","dnsapi.dll","bcrypt.dll","win32u.dll","sechost.dll","msvcr80.dll","wow64.dll","VxSSL32.dll","System.ni.dll","dwmapi.dll","fastprox.dll","shfolder.dll","sxs.dll","ucrtbase.dll","gdi32.dll","cfgmgr32.dll","System.Drawing.ni.dll","comctl32.dll","apphelp.dll","shell32.dll","mscorlib.ni.dll","System.Windows.Forms.ni.dll","cryptsp.dll","mscoreei.dll","powrprof.dll","profapi.dll","System.Configuration.ni.dll","winmm.dll","rpcrt4.dll","ntdll.dll","ws2_32.dll","SHCore.dll","wbemprox.dll","kernel32.dll","Microsoft.VisualBasic.ni.dll","System.Xml.ni.dll","nsi.dll","wbemcomn.dll","wbemdisp.dll","user32.dll","vcruntime140.dll","advapi32.dll","sspicli.dll","imm32.dll","oleaut32.dll","clbcatq.dll","msvfw32.dll","coml2.dll","KernelBase.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7332:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7332:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7332:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\394f23fb4c8c32d52df2198922e095fd","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"name":"Local\\SM0:7332:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"name":"SM0:7332:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"name":"394f23fb4c8c32d52df2198922e095fd","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"name":"SM0:7332:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"name":"Global\\.net clr networking","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"name":"\\BaseNamedObjects\\.net clr networking","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\.net clr networking","sources":[{"report_type":"sandbox","report_id":"6ad079d4d3d5ea749d0dc74a"}]}]}},"report_ids":{"sandbox_job_ids":["6ad079d4d3d5ea749d0dc74a"]}}}]]}] 2c:[["$","title","0",{"children":"Malicious Dacic.D6DFC400.A.Generic Sample d05a2053a4e0… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample d05a2053a4e0…. Malware family: Dacic.D6DFC400.A.Generic. Threat score 100/100. 20/27 AV engines flagged this file. 4 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/d05a2053a4e0f1e22debe07c069c8a51e42fd481b1fe39e118feb3346bcf485d"}],["$","meta","4",{"property":"og:title","content":"Malicious Dacic.D6DFC400.A.Generic Sample d05a2053a4e0… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample d05a2053a4e0…. Malware family: Dacic.D6DFC400.A.Generic. Threat score 100/100. 20/27 AV engines flagged this file. 4 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/d05a2053a4e0f1e22debe07c069c8a51e42fd481b1fe39e118feb3346bcf485d"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Dacic.D6DFC400.A.Generic Sample d05a2053a4e0… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample d05a2053a4e0…. Malware family: Dacic.D6DFC400.A.Generic. Threat score 100/100. 20/27 AV engines flagged this file. 4 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L5b","11",{}]] 32:null