24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 47:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4a4,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Worm.Bladabindi Sample d31eb15e0889… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample d31eb15e0889…. Malware family: Worm.Bladabindi. Threat score 100/100. 19/24 AV engines flagged this file. 11 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5","keywords":["Malicious","Worm.Bladabindi","malware analysis","sandbox report","threat intelligence","d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5"],"about":{"@type":"SoftwareApplication","name":"bounty-76959143565297645","applicationCategory":["peexe","assembly","executable"],"identifier":"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Worm.Bladabindi","antivirusDetections":{"malicious":19,"total":24},"behavioralIndicators":{"malicious":11,"suspicious":21},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T72e,Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" Observed namespace "System.IO.MemoryStream" and TypeReference "Write" in "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" Observed namespace "System.IO.MemoryStream" and TypeReference "get_Length" in "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" Observed namespace "System.IO.MemoryStream" and TypeReference "WriteByte" in "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" Observed namespace "System.IO.MemoryStream" and TypeReference "set_Position" in "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" Observed namespace "System.IO.MemoryStream" and TypeReference "Read" in "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "a60b4c9bb474e5da8291e6d7cc11751e.exe" Observed namespace "System.IO.MemoryStream" and TypeReference "Write" in "a60b4c9bb474e5da8291e6d7cc11751e.exe" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "a60b4c9bb474e5da8291e6d7cc11751e.exe" Observed namespace "System.IO.MemoryStream" and TypeReference "get_Length" in "a60b4c9bb474e5da8291e6d7cc11751e.exe" Observed namespace "System.IO.MemoryStream" and TypeReference "WriteByte" in "a60b4c9bb474e5da8291e6d7cc11751e.exe" Observed namespace "System.IO.MemoryStream" and TypeReference "set_Position" in "a60b4c9bb474e5da8291e6d7cc11751e.exe" Observed namespace "System.IO.MemoryStream" and TypeReference "Read" in "a60b4c9bb474e5da8291e6d7cc11751e.exe"26:T5cf,Found reference to API "SendMessage" (Indicator: "sendmessage"; File: "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe") Found reference to API "SendMessageA" (Indicator: "sendmessage"; File: "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; File: "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe") file/memory contains long string with (Indicator: "sendmessage"; File: "a60b4c9bb474e5da8291e6d7cc11751e.exe") Found reference to API "PostMessage" (Indicator: "postmessage"; Source: "00000000-00006896-00000C29-1636812458") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00006896-00000C29-1636812509") Found reference to API "SendMessage" (Indicator: "sendmessage"; Source: "00000000-00006896.00000000.168403.00132000.00000002.mdmp") Found reference to API "SendMessageA" (Indicator: "sendmessage"; Source: "00000000-00006896.00000000.168403.00132000.00000002.mdmp") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; Source: "00000000-00006896.00000000.168403.00132000.00000002.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00006896.00000000.168403.02810000.00000004.mdmp, 00000000-00006896.00000001.170322.02810000.00000004.mdmp, 00000000-00006896.00000002.172242.02810000.00000004.mdmp")27:T2afe,"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000018000000cd93eeb6638b0472a002ef00687ded7448f2ef0000b90472e9ec07c4feffffff64f1ef000272037208f1ef0000007f7700f2ef001b720372e0df887508000000000000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff340000000000000090f1ef000000000008000000000000000000000000000000000000000000000000000000d593eeb600000000d0f1ef0069929b77ffffffff3400000090f1ef00080000000000000000007f7700f2ef0027949b7798f1ef000b00000000000000e8f1ef00 (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000003dc010003dc0a000300000000d80a00030000000010f9ef005916ad7740000000000000000000000000002303000000004800000000000000000000000900000002000000000023034000000000000000059aeeb630f9ef00ee13ad7700000000ee13ad7700000000000000002c8d3f73a0f9ef006cf9ef00cc47e9720000230300000000eb47e972a8602f29010000002c8d3f730000000000000000205ca57700002303a8f9ef000c1a3873ffffffffeb47e9724a48e972000023030000000040000000b4f9ef008543e97298a824038848e97270602f29010000002c8d3f7300000000cb00000002000000dcf9ef00b0fc3973ffffffff8848e972 (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000000200000000000003dc010003dc0a000300000000d80a00030000000010f9ef005916ad7740000000000000000000000000002303000000004800000000000000000000000900000002000000000023034000000000000000059aeeb630f9ef00ee13ad7700000000ee13ad7700000000000000002c8d3f73a0f9ef006cf9ef00cc47e9720000230300000000eb47e972a8602f29af67f872a8602f29010000002c8d3f7300000000d4f9ef0088f9ef0058753573ffffffffaf67f872cd67f87250602f29010000002c8d3f7300000000d4f9ef00b0f9ef0058763573ffffffffcd67f872eb67f87278602f29010000002c8d3f7300000000d4f9ef00 (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000000000000000000000000007085250398842503000000000000000001000000a084250318252303000000000000000004f8ef003fc5ad770000000004f8ef005dc5ad7794852503400b2503ccb6077308d53f730000000000000000000000007c8525032a003f73400b250354f8ef00f301af773cf8ef000200000000960773400b250330f8ef0014d53f73e072e1741e02af7700000000708525032a00000000960773bacb2bccb616f34c8990d74c2e8af5002571e9500000000090f8ef0084b607730096077398a82403bcb607730100000090f8ef0099b607731cd53f730100000098a82403b050e174000000000000000000000000bcf9ef00 (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000090eaef0034eaef00226eca7400007f03000000002d6eca742894b5a12d000000ecb7a775b8eaef000000000350282603284f25030500000080000000f8e9ef00000000037ceaef0070c8cb74e40f8ad5feffffff2d000000d0ccb675270000004ceaef00856acc741c23d1748ceaef00f85fcc7408000000bb69cb74b269cb749094b5a12d000000ecb7a77527000000d0ccb67560eaef002d000000d0ccb6752700000090eaef00856acc741c23d174d8eaef007e8ab575ee8cb575738ab575d960894d2d000000ecb7a77527000000d0ccb6753c267f03d0257f03d960894da0eaef00fc52f3758cebef00e084b575397b9738feffffff738ab575 (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000ffffd39cee72199eee72e8682f2988c02703b0982403010000000000000000000000000000000000000000000000000000000000000000000000d2000000d20000000c00000008c1270301000000020000000200000010000000d4263f7301000000383d3f7348f1ef0001000000d8f0ef007e44e972d06d260308f1ef003f44e9725844e972cc682f2988c0270348f1ef0001000000000000000000000024f1ef00e88b3773ffffffff5844e9721d44e972f4682f2988c0270330d82603010000001241ef72b4682f2988c02703b098240300000000fb9eee72ac682f2988c02703b098240300000000383d3f730000000069a7ee720000000088c02703 (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000ef0018f0ef00010000000000000002000000005be174000000000000000000a0030000007b0344f0ef00de819b77100300000400000000000000000000000000000000000000ffffffffacf0ef004336ef7210030000040000000000000000000000000000007136ef7268692f290200000014f1ef00000000000300000080f0ef00a0f0ef008ecd997714030000000000000200000000000000000000000200000014f1ef0000000000b8f0ef0030edef7280007b030000000000940300d0f0ef0095f0ef7280007b0300007b030000000000940300f0f0ef0087f1ef7280007b0300007b03000000000094030060d326030000000054f1ef0063efef72 (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000ffffd39cee72199eee7260502f2918752803f09d240301000000000000000000000000000000000000000000000000000000000000000000000004010000040100000c0000004855280301000000020000000200000010000000d4263f7301000000383d3f73c0c9ef000100000050c9ef007e44e972d06d260380c9ef003f44e9725844e97244502f2918752803c0c9ef000100000000000000000000009cc9ef00e88b3773ffffffff5844e9721d44e9726c502f2918752803b0bc2603010000001241ef722c502f2918752803f09d240300000000fb9eee7224502f2918752803f09d240300000000383d3f730000000069a7ee720000000018752803 (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000ffffd39cee72199eee72f45e2f2988602803909a2403010000000000000000000000000000000000000000000000000000000000000000000000ca000000ca0000000c00000070de280301000000020000000200000010000000d4263f7301000000383d3f734cc7ef0001000000dcc6ef007e44e972d06d26030cc7ef003f44e9725844e972c85e2f29886028034cc7ef0001000000000000000000000028c7ef00e88b3773ffffffff5844e9721d44e972f05e2f2988602803e0d82603010000001241ef72b05e2f2988602803909a240300000000fb9eee72a85e2f2988602803909a240300000000383d3f730000000069a7ee720000000088602803 (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000ffffd39cee72199eee723c5a2f29405d2903109c240301000000000000000000000000000000000000000000000000000000000000000000000002010000020100000c0000005863290301000000020000000200000010000000d4263f7301000000383d3f7314c4ef0001000000a4c3ef007e44e972d06d2603d4c3ef003f44e9725844e972105a2f29405d290314c4ef00010000000000000000000000f0c3ef00e88b3773ffffffff5844e9721d44e972385a2f29405d290370ca2603010000001241ef72f85d2f29405d2903109c240300000000fb9eee72f05d2f29405d2903109c240300000000383d3f730000000069a7ee7200000000405d2903 (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000ffffd39cee72199eee7240582f29385e2903d09c2403010000000000000000000000000000000000000000000000000000000000000000000000ea000000ea0000000c000000a867290301000000020000000200000010000000d4263f7301000000383d3f73a0c1ef000100000030c1ef007e44e972d06d260360c1ef003f44e9725844e972a4582f29385e2903a0c1ef000100000000000000000000007cc1ef00e88b3773ffffffff5844e9721d44e9724c582f29385e2903a0c52603010000001241ef720c582f29385e2903d09c240300000000fb9eee7204582f29385e2903d09c240300000000383d3f730000000069a7ee7200000000385e2903 (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff0000000008c9ef0038cfad777427230374c9ef0001000000282723037427230328272303040000000400000000e0a5770010000074c9ef000100000028272303cd97ad779c97ad779d42e950b50f9c77282723030000ad77000000008419b6760000000080eea2770100000000000000f8e2a577000000000400000080a942744840a477f8e2a57778c9ef0080e8387590c5240380e8387574c9ef000000000080e8387500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000de062a03f4062a03 (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000be922803d6922803 (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000086392a039a392a03 (UID: 00000000-00001804)28:T11b6,"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000004b0054004f0050002d004600560056004600380032004100000055005300450052004e0041004d0045003d00480041005000550042005700530000005500530045005200500052004f00460049004c0045003d0043003a005c00550073006500720073005c0048004100500055004200570053000000770069006e006400 (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000067e1741b7203720800000004000000000000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff240000000000000024f3ef00000000000400000000000000000000000000000000000000000000003117df728d91eeb628f3ef00270eaf77ffffffff2400000024f3ef00 (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000004d006900630072006f0073006f00660074002e004e00450054005c004600720061006d00650077006f0072006b005c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetVersionExA" with parameter 9c0000000600000002000000f02300000200000000000000ffffffffffffffffd0c9ef00000000000000000000000000d8c9ef00000000000010000000000000040000000000000058ea6c70edaaeeb60020000060caef00012f9b77ffffffff5ccaef000000000058caef0000100000040000007068e174002000000000a70798caef000000f0006ee96c700000a707ff000000 (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetVersionExA" with parameter 940000000600000002000000f023000002000000002300000200000000000000ffffffffffffffffd0c9ef00000000000000000000000000d8c9ef00000000000010000000000000040000000000000058ea6c70edaaeeb60020000060caef00012f9b77ffffffff5ccaef000000000058caef0000100000040000007068e174002000000000a70798caef000000f0006ee96c70 (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetVersionExA" with parameter 9c0000000600000002000000f0230000020000000023000002000000002300000200000000000000ffffffffffffffffd0c9ef00000000000000000000000000d8c9ef00000000000010000000000000040000000000000058ea6c70edaaeeb60020000060caef00012f9b77ffffffff5ccaef000000000058caef0000100000040000007068e174002000000000a70798caef00 (UID: 00000000-00001804) "Cat probiv.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000770069006e007300780073005c007800380036005f006d006900630072006f0073006f00660074002e0076006300380030002e006300720074005f0031006600630038006200330062003900610031006500310038006500330062005f0038002e0030002e00350030003700320037002e0039003300340038005f006e00 (UID: 00000000-00006896) "Cat probiv.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000067e1741b7203720800000004000000000000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff24000000000000003cf24f00000000000400000000000000000000000000000000000000000000003117df7267c625e340f24f00270eaf77ffffffff240000003cf24f00 (UID: 00000000-00006896) "Cat probiv.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006896) "Cat probiv.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000000000005c0000000000630000000000000001000000740014000000d05e8202000000000100000001000000000000002c000000a0d0830200000000140000000a000000000000000000000000006f00f88083021400000000000000000000000095820200000000000000000000000000006900000000000b00000b (UID: 00000000-00006896)29:T1038,Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; File: "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe") Found reference to API "GetWindowText" (Indicator: "GetWindowText"; File: "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe") Found reference to API "GetWindowTextA" (Indicator: "GetWindowText"; File: "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe") Found reference to API "GetWindowTextLength" (Indicator: "GetWindowText"; File: "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe") Found reference to API "GetWindowTextLengthA" (Indicator: "GetWindowText"; File: "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00006896.00000000.168403.00132000.00000002.mdmp") Found reference to API "GetWindowText" (Indicator: "GetWindowText"; Source: "00000000-00006896.00000000.168403.00132000.00000002.mdmp") Found reference to API "GetWindowTextA" (Indicator: "GetWindowText"; Source: "00000000-00006896.00000000.168403.00132000.00000002.mdmp") Found reference to API "GetWindowTextLength" (Indicator: "GetWindowText"; Source: "00000000-00006896.00000000.168403.00132000.00000002.mdmp") Found reference to API "GetWindowTextLengthA" (Indicator: "GetWindowText"; Source: "00000000-00006896.00000000.168403.00132000.00000002.mdmp") Found reference to API "147736075831,4208,105,,GetForegroundWindow,user32.dll,"00:44:47.875",RX=0,PX=0" (Indicator: "GetForegroundWindow"; Source: "00000000-00006896.00000002.172242.02810000.00000004.mdmp") Found reference to API "154036389642,4208,105,,GetForegroundWindow,user32.dll,"00:44:50.500",RX=0,PX=0" (Indicator: "GetForegroundWindow"; Source: "00000000-00006896.00000002.172242.02810000.00000004.mdmp") Found reference to API "155687267272,4208,105,,GetForegroundWindow,user32.dll,"00:44:51.187",RX=0,PX=0" (Indicator: "GetForegroundWindow"; Source: "00000000-00006896.00000002.172242.02810000.00000004.mdmp") Found reference to API "154749313030,3744,108,,GetWindowTextA,user32.dll,"00:44:50.796",RX=0,PX=0" (Indicator: "GetWindowText"; Source: "00000000-00006896.00000002.172242.02810000.00000004.mdmp") Found reference to API "151711248247,4208,105,,GetForegroundWindow,user32.dll,"00:44:49.531",RX=0,PX=0" (Indicator: "GetForegroundWindow"; Source: "00000000-00006896.00000002.172242.02810000.00000004.mdmp") Found reference to API "154749179410,3744,105,,GetForegroundWindow,user32.dll,"00:44:50.796",RX=0,PX=0" (Indicator: "GetForegroundWindow"; Source: "00000000-00006896.00000002.172242.02810000.00000004.mdmp") Found reference to API "154598905245,4208,105,,GetForegroundWindow,user32.dll,"00:44:50.734",RX=0,PX=0" (Indicator: "GetForegroundWindow"; Source: "00000000-00006896.00000002.172242.02810000.00000004.mdmp") Found reference to API "146657311175,4208,105,,GetForegroundWindow,user32.dll,"00:44:47.421",RX=0,PX=0" (Indicator: "GetForegroundWindow"; Source: "00000000-00006896.00000002.172242.02810000.00000004.mdmp") Found reference to API "155123711693,4208,105,,GetForegroundWindow,user32.dll,"00:44:50.953",RX=0,PX=0" (Indicator: "GetForegroundWindow"; Source: "00000000-00006896.00000002.172242.02810000.00000004.mdmp") Found reference to API "147211131038,4208,105,,GetForegroundWindow,user32.dll,"00:44:47.656",RX=0,PX=0" (Indicator: "GetForegroundWindow"; Source: "00000000-00006896.00000002.172242.02810000.00000004.mdmp") Found reference to API "152889244361,4208,105,,GetForegroundWindow,user32.dll,"00:44:50.015",RX=0,PX=0" (Indicator: "GetForegroundWindow"; Source: "00000000-00006896.00000002.172242.02810000.00000004.mdmp") Found reference to API "156211316112,4208,105,,GetForegroundWindow,user32.dll,"00:44:51.406",RX=0,PX=0" (Indicator: "GetForegroundWindow"; Source: "00000000-00006896.00000002.172242.02810000.00000004.mdmp") Found reference to API "146218438459,3744,108,,GetWindowTextA,user32.dll,"00:44:47.234",RX=0,PX=0" (Indicator: "GetWindowText"; Source: "00000000-00006896.00000002.172242.02810000.00000004.mdmp")2a:T253f,"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\mscorlib\7aa13700a6fcdcb57e6cb353e54d0ab9\mscorlib.ni.dll (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ole32.dll (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "LoadLibrary" with a parameter AdvApi32.dll (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System\61e9a201160f8baed9f7e00a4969992e\System.ni.dll (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\5f0a85c2a45c0fb0d1d12e010857a907\Microsoft.VisualBasic.ni.dll (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Drawing\d6163e1c32eba738e42523885580dc48\System.Drawing.ni.dll (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\860a4e79adbd2eb86ade9317e1cd9d2a\System.Windows.Forms.ni.dll (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "LoadLibrary" with a parameter %PROGRAMFILES(X86)%\COMMON~1\MICROS~1\OFFICE14\Cultures\office.odf (UID: 00000000-00001804) "Cat probiv.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006896) "Cat probiv.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006896) "Cat probiv.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006896) "Cat probiv.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006896) "Cat probiv.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00006896) "Cat probiv.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00006896) "Cat probiv.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00006896) "Cat probiv.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00006896) "Cat probiv.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00006896) "Cat probiv.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll (UID: 00000000-00006896) "Cat probiv.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00006896) "Cat probiv.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00006896) "Cat probiv.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00006896) "Cat probiv.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00006896) "Cat probiv.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00006896) "Cat probiv.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\mscorlib\7aa13700a6fcdcb57e6cb353e54d0ab9\mscorlib.ni.dll (UID: 00000000-00006896) "Cat probiv.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ole32.dll (UID: 00000000-00006896) "Cat probiv.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00006896) "Cat probiv.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006896) "Cat probiv.exe" called "LoadLibrary" with a parameter AdvApi32.dll (UID: 00000000-00006896) "Cat probiv.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll (UID: 00000000-00006896) "Cat probiv.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System\61e9a201160f8baed9f7e00a4969992e\System.ni.dll (UID: 00000000-00006896) "Cat probiv.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\5f0a85c2a45c0fb0d1d12e010857a907\Microsoft.VisualBasic.ni.dll (UID: 00000000-00006896) "Cat probiv.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Drawing\d6163e1c32eba738e42523885580dc48\System.Drawing.ni.dll (UID: 00000000-00006896) "Cat probiv.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\860a4e79adbd2eb86ade9317e1cd9d2a\System.Windows.Forms.ni.dll (UID: 00000000-00006896) "Cat probiv.exe" called "LoadLibrary" with a parameter user32 (UID: 00000000-00006896) "Cat probiv.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Xml\c7a2f551c65c81870e822e9e134513f9\System.Xml.ni.dll (UID: 00000000-00006896) "Cat probiv.exe" called "LoadLibrary" with a parameter shfolder.dll (UID: 00000000-00006896) "Cat probiv.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00006896) "Cat probiv.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\ntdll (UID: 00000000-00006896) "Cat probiv.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Configuration\cd4b9b7e793d3fe3ad5c9542420992be\System.Configuration.ni.dll (UID: 00000000-00006896) "Cat probiv.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00006896) "Cat probiv.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00006896) "Cat probiv.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00006896) "Cat probiv.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00006896) "Cat probiv.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00006896) "Cat probiv.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00006896) "Cat probiv.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00006896)2b:Tdd9e,"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionAndSpinCount (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter IsProcessorFeaturePresent (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter _set_error_mode (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter ?set_terminate@@YAP6AXXZP6AXXZ@Z (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter _get_terminate (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter FindActCtxSectionStringW (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter SetLoadedByMscoree (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter GetCLRFunction (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter GetTraceLoggerHandle (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter GetTraceEnableLevel (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter GetTraceEnableFlags (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter TraceEvent (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter IEE (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter IEE_RetAddr (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter GetStartupFlags (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter GetStartupFlags_RetAddr (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter GetHostConfigurationFile (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter GetHostConfigurationFile_RetAddr (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter GetCORVersion_RetAddr (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter GetCORVersion (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter GetCORSystemDirectory (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter GetCORSystemDirectory_RetAddr (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter RtlUnwind (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter SetThreadStackGuarantee (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter AddVectoredContinueHandler (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter RemoveVectoredContinueHandler (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter GetWriteWatch (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter ResetWriteWatch (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter CreateMemoryResourceNotification (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter QueryMemoryResourceNotification (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter GetVersionEx (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter GetVersionExW (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter CryptAcquireContextA (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter CryptGetHashParam (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter CryptExportKey (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter CryptGenKey (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter CryptGetKeyParam (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter CryptVerifySignatureA (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter CryptSignHashA (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter CryptGetProvParam (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter CryptGetUserKey (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter CryptEnumProvidersA (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter GetMetaDataInternalInterface (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter GetMetaDataInternalInterface_RetAddr (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter lstrlen (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter lstrlenW (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter RegSetValueEx (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter CreateMutex (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter CreateMutexW (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter SetFileAttributes (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter SetFileAttributesW (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter SetErrorMode (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter CopyFile (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter CopyFileW (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter RtlMoveMemory (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter RtlMoveMemoryW (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter ShellExecuteEx (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter ShellExecuteExW (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter GrooveChainGetGlobalInterfacePtrAddress (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter GrooveChainCoCreateInstance (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00001804) "Cat probiv.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionAndSpinCount (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter IsProcessorFeaturePresent (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter _set_error_mode (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter ?set_terminate@@YAP6AXXZP6AXXZ@Z (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter _get_terminate (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter FindActCtxSectionStringW (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter SetLoadedByMscoree (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter GetCLRFunction (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter GetTraceLoggerHandle (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter GetTraceEnableLevel (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter GetTraceEnableFlags (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter TraceEvent (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter IEE (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter IEE_RetAddr (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter GetStartupFlags (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter GetStartupFlags_RetAddr (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter GetHostConfigurationFile (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter GetHostConfigurationFile_RetAddr (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter GetCORVersion_RetAddr (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter GetCORVersion (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter GetCORSystemDirectory (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter GetCORSystemDirectory_RetAddr (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter RtlUnwind (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter SetThreadStackGuarantee (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter AddVectoredContinueHandler (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter RemoveVectoredContinueHandler (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter GetWriteWatch (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter ResetWriteWatch (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter CreateMemoryResourceNotification (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter QueryMemoryResourceNotification (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter GetVersionEx (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter GetVersionExW (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter CryptAcquireContextA (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter CryptGetHashParam (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter CryptExportKey (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter CryptGenKey (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter CryptGetKeyParam (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter CryptVerifySignatureA (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter CryptSignHashA (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter CryptGetProvParam (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter CryptGetUserKey (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter CryptEnumProvidersA (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter GetMetaDataInternalInterface (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter GetMetaDataInternalInterface_RetAddr (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter lstrlen (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter lstrlenW (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter RegSetValueEx (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter CreateMutex (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter CreateMutexW (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter GetStartupInfo (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter GetStartupInfoW (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter CreateProcess (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter CreateProcessW (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter WaitForInputIdle (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter WaitForInputIdleW (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter SetErrorMode (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter SetFileAttributes (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter SetFileAttributesW (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter CopyFile (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter CopyFileW (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter FindFirstFile (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter FindNextFile (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter GetLogicalDrives (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter SwitchToThread (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter GetAsyncKeyState (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter RegisterWindowMessage (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter RegisterWindowMessageW (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter GetKeyState (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter GetUserObjectInformation (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter GetUserObjectInformationA (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter GetClassInfo (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter GetClassInfoW (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter RegisterClass (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter RegisterClassW (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter CreateWindowEx (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter DefWindowProc (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter NtSetInformationProcess (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter GetForegroundWindow (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter GetWindowTextLength (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter GetWindowTextLengthW (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter EnumProcesses (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter EnumProcessesW (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter SetWindowLong (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter SetWindowLongW (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter GetWindowLong (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter GetWindowLongW (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter CallWindowProc (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter CallWindowProcW (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter GetParent (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter OleInitialize (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter CoRegisterMessageFilter (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter PeekMessage (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter PeekMessageW (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter IsWindowUnicode (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter GetMessageW (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter TranslateMessage (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter DispatchMessageW (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter PostMessage (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter PostMessageW (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter ND_RI2 (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter ND_RI2_RetAddr (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter WSASocket (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter setsockopt (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter WSAEventSelect (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter ioctlsocket (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter closesocket (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter GetComputerName (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter GetComputerNameW (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter ConvertStringSecurityDescriptorToSecurityDescriptor (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter ConvertStringSecurityDescriptorToSecurityDescriptorW (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter CreateFileMapping (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter CreateFileMappingW (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter MapViewOfFile (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter VirtualQuery (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter CreateWellKnownSidW (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter OpenMutex (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter OpenMutexW (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter GetProcessTimes (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter GetProcessTimesW (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter getaddrinfo (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter freeaddrinfo (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter WSAConnect (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter GetProcessWorkingSetSize (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter GetProcessWorkingSetSizeW (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter SetProcessWorkingSetSize (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter SetProcessWorkingSetSizeW (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter GetWindowTextLengthA (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter GetWindowTextA (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter GlobalMemoryStatusEx (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter FormatMessage (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00006896) "Cat probiv.exe" called "GetProcAddress" with a parameter shutdown (UID: 00000000-00006896)2c:T1dd4,Found reference to API (Indicator: "CompareString"; File: "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe") Found reference to API (Indicator: "Sleep"; File: "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe") Found reference to API (Indicator: "MessageBox"; File: "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe") Found reference to API (Indicator: "GetTempPath"; File: "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe") Found reference to API (Indicator: "GetTempFileName"; File: "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe") Found reference to API (Indicator: "GetLogicalDrives"; File: "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe") Found reference to API (Indicator: "GetProcessById"; File: "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe") Found reference to API (Indicator: "GetForegroundWindow"; File: "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe") Found reference to API (Indicator: "GetVolumeInformation"; File: "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe") Found reference to API (Indicator: "GetVolumeInformationA"; File: "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe") Found reference to API (Indicator: "GetWindowText"; File: "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe") Found reference to API (Indicator: "GetWindowTextA"; File: "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe") Found reference to API (Indicator: "GetWindowTextLength"; File: "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe") Found reference to API (Indicator: "SendMessage"; File: "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe") Found reference to API (Indicator: "SetWindowPos"; File: "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe") Found reference to API (Indicator: "NtSetInformationProcess"; File: "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe") Found reference to API (Indicator: "GetAsyncKeyState"; File: "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe") Found reference to API (Indicator: "GetKeyboardLayout"; File: "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe") Found reference to API (Indicator: "GetKeyboardState"; File: "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe") Found reference to API (Indicator: "GetWindowThreadProcessId"; File: "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe") Found reference to API (Indicator: "MapVirtualKey"; File: "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe") Found reference to API (Indicator: "ToUnicodeEx"; File: "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe") Found reference to API (Indicator: "EnableWindow"; File: "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe") Found reference to API (Indicator: "GetClassName"; File: "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe") Found reference to API (Indicator: "GetClassNameA"; File: "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe") Found reference to API (Indicator: "SendMessageA"; File: "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe") Found reference to API (Indicator: "EnumChildWindows"; File: "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe") Found reference to API (Indicator: "CompareString"; Source: "00000000-00006896.00000000.168403.00132000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00006896.00000000.168403.00132000.00000002.mdmp") Found reference to API (Indicator: "MessageBox"; Source: "00000000-00006896.00000000.168403.00132000.00000002.mdmp") Found reference to API (Indicator: "GetTempPath"; Source: "00000000-00006896.00000000.168403.00132000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileName"; Source: "00000000-00006896.00000000.168403.00132000.00000002.mdmp") Found reference to API (Indicator: "GetLogicalDrives"; Source: "00000000-00006896.00000000.168403.00132000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00006896.00000000.168403.00132000.00000002.mdmp") Found reference to API (Indicator: "GetProcessById"; Source: "00000000-00006896.00000000.168403.00132000.00000002.mdmp") Found reference to API (Indicator: "GetForegroundWindow"; Source: "00000000-00006896.00000000.168403.00132000.00000002.mdmp") Found reference to API (Indicator: "GetVolumeInformation"; Source: "00000000-00006896.00000000.168403.00132000.00000002.mdmp") Found reference to API (Indicator: "GetVolumeInformationA"; Source: "00000000-00006896.00000000.168403.00132000.00000002.mdmp") Found reference to API (Indicator: "GetWindowText"; Source: "00000000-00006896.00000000.168403.00132000.00000002.mdmp") Found reference to API (Indicator: "GetWindowTextA"; Source: "00000000-00006896.00000000.168403.00132000.00000002.mdmp") Found reference to API (Indicator: "GetWindowTextLength"; Source: "00000000-00006896.00000000.168403.00132000.00000002.mdmp") Found reference to API (Indicator: "SendMessage"; Source: "00000000-00006896.00000000.168403.00132000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00006896.00000000.168403.00132000.00000002.mdmp") Found reference to API (Indicator: "Beep"; Source: "00000000-00006896.00000000.168403.00132000.00000002.mdmp") Found reference to API (Indicator: "NtSetInformationProcess"; Source: "00000000-00006896.00000000.168403.00132000.00000002.mdmp") Found reference to API (Indicator: "GetAsyncKeyState"; Source: "00000000-00006896.00000000.168403.00132000.00000002.mdmp") Found reference to API (Indicator: "GetKeyboardLayout"; Source: "00000000-00006896.00000000.168403.00132000.00000002.mdmp") Found reference to API (Indicator: "GetKeyboardState"; Source: "00000000-00006896.00000000.168403.00132000.00000002.mdmp") Found reference to API (Indicator: "GetWindowThreadProcessId"; Source: "00000000-00006896.00000000.168403.00132000.00000002.mdmp") Found reference to API (Indicator: "MapVirtualKey"; Source: "00000000-00006896.00000000.168403.00132000.00000002.mdmp") Found reference to API (Indicator: "ToUnicodeEx"; Source: "00000000-00006896.00000000.168403.00132000.00000002.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00006896.00000000.168403.00132000.00000002.mdmp") Found reference to API (Indicator: "GetClassName"; Source: "00000000-00006896.00000000.168403.00132000.00000002.mdmp") Found reference to API (Indicator: "GetClassNameA"; Source: "00000000-00006896.00000000.168403.00132000.00000002.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00006896.00000000.168403.00132000.00000002.mdmp") Found reference to API (Indicator: "EnumChildWindows"; Source: "00000000-00006896.00000000.168403.00132000.00000002.mdmp") Found reference to API (Indicator: "SeDebugPrivilege"; Source: "00000000-00006896.00000000.168403.04D60000.00000004.mdmp") Found reference to API (Indicator: "DefWindowProcW"; Source: "00000000-00006896.00000000.168403.04D60000.00000004.mdmp") Found reference to API (Indicator: "DefWindowProcA"; Source: "00000000-00006896.00000000.168403.04D60000.00000004.mdmp")2d:T493,"%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\a60b4c9bb474e5da8291e6d7cc11751e.exe" (Indicator: "%appdata%\microsoft\windows\start menu\programs\startup\a60b4c9bb474e5da8291e6d7cc11751e.exe") in Source: 00000000-00006896-00000C3A-5716372765 ":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00006896.00000000.168403.02810000.00000004.mdmp 00000000-00006896.00000001.170322.02810000.00000004.mdmp 00000000-00006896.00000002.172242.02810000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00006896.00000000.168403.04D60000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a60b4c9bb474e5da8291e6d7cc11751e.exe" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\a60b4c9bb474e5da8291e6d7cc11751e.exe") in Source: 00000000-00006896.00000000.168403.04D60000.00000004.mdmp2e:T1907,"Software\Microsoft\Windows\CurrentVersion\Run" in Source: d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe "Software\" in Source: d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe "Software\Microsoft\Internet Explorer\Main" in Source: d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System" in Source: d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" in Source: d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe "Software\\Microsoft\\Windows\\CurrentVersion\\Run" in Source: 6000013-cctor "Software\\" in Source: 6000022-OK~DLV "Software\\Microsoft\\Internet Explorer\\Main" in Source: 600002e-OK~AddHome "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\System" in Source: 600002f-OK~Ind "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System" in Source: 600002f-OK~Ind "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore" in Source: 600002f-OK~Ind "Software\Microsoft\Windows\CurrentVersion\Run\a60b4c9bb474e5da8291e6d7cc11751e" in Source: 00000000-00006896-00000BC0-1636812678 "KEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System" in Source: 00000000-00006896.00000000.168403.00132000.00000002.mdmp "KEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00006896.00000000.168403.00132000.00000002.mdmp "KEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" in Source: 00000000-00006896.00000000.168403.00132000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00006896.00000000.168403.04D60000.00000004.mdmp "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\." in Source: 00000000-00006896.00000000.168403.04D60000.00000004.mdmp "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00006896.00000000.168403.04D60000.00000004.mdmp "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\a60b4c9bb474e5da8291e6d7cc11751e" in Source: 00000000-00006896.00000000.168403.04D60000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\." in Source: 00000000-00006896.00000000.168403.04D60000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00006896.00000000.168403.04D60000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\a60b4c9bb474e5da8291e6d7cc11751e" in Source: 00000000-00006896.00000000.168403.04D60000.00000004.mdmp "Software\" in Source: 00000000-00006896.00000000.168403.04D60000.00000004.mdmp "Software\a60b4c9bb474e5da8291e6d7cc11751e" in Source: 00000000-00006896.00000000.168403.04D60000.00000004.mdmp "HKEY_CURRENT_USER\Software\a60b4c9bb474e5da8291e6d7cc11751e\." in Source: 00000000-00006896.00000000.168403.04D60000.00000004.mdmp "Software\Microsoft\.NETFramework" in Source: 00000000-00006896.00000000.168403.04D60000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\." in Source: 00000000-00006896.00000000.168403.04D60000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework" in Source: 00000000-00006896.00000000.168403.04D60000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\DbgJITDebugLaunchSetting" in Source: 00000000-00006896.00000000.168403.04D60000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\DbgManagedDebugger" in Source: 00000000-00006896.00000000.168403.04D60000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Run\a60b4c9bb474e5da8291e6d7cc11751e" in Source: 00000000-00006896.00000000.168403.04D60000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006896.00000000.168403.04D60000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\." in Source: 00000000-00006896.00000000.168403.04D60000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006896.00000000.168403.04D60000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\InstallationType" in Source: 00000000-00006896.00000000.168403.04D60000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\" in Source: 00000000-00006896.00000000.168403.04D60000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance" in Source: 00000000-00006896.00000000.168403.04D60000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance\." in Source: 00000000-00006896.00000000.168403.04D60000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance" in Source: 00000000-00006896.00000000.168403.04D60000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance\Library" in Source: 00000000-00006896.00000000.168403.04D60000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance\IsMultiInstance" in Source: 00000000-00006896.00000000.168403.04D60000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance\First Counter" in Source: 00000000-00006896.00000000.168403.04D60000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\.net clr networking\Performance" in Source: 00000000-00006896.00000000.168403.04D60000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance\." in Source: 00000000-00006896.00000000.168403.04D60000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance" in Source: 00000000-00006896.00000000.168403.04D60000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance\CategoryOptions" in Source: 00000000-00006896.00000000.168403.04D60000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance\FileMappingSize" in Source: 00000000-00006896.00000000.168403.04D60000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance\Counter Names" in Source: 00000000-00006896.00000000.168403.04D60000.00000004.mdmp2f:T45c,Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "DeleteValue" in "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "SetValue" in "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "CreateSubKey" in "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "DeleteSubKey" in "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "DeleteValue" in "a60b4c9bb474e5da8291e6d7cc11751e.exe" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "SetValue" in "a60b4c9bb474e5da8291e6d7cc11751e.exe" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "CreateSubKey" in "a60b4c9bb474e5da8291e6d7cc11751e.exe" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "DeleteSubKey" in "a60b4c9bb474e5da8291e6d7cc11751e.exe"30:T463,"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ole32.dll" - [base:0; Status:ffffffffc0000135] "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" failed to load missing module "%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:ffffffffc0000135] "Cat probiv.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ole32.dll" - [base:0; Status:ffffffffc0000135] "Cat probiv.exe" failed to load missing module "%ALLUSERSPROFILE%\ntdll" - [base:0; Status:ffffffffc0000135] "Cat probiv.exe" failed to load missing module "%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:ffffffffc0000135] "Cat probiv.exe" failed to load missing module "%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:ffffffffc0000135] "Cat probiv.exe" failed to load missing module "%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:ffffffffc0000135]31:Tae5,Observed unmanaged function "GetForegroundWindow" in "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" Observed unmanaged function "GetVolumeInformationA" in "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" Observed unmanaged function "GetWindowTextA" in "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" Observed unmanaged function "GetWindowTextLengthA" in "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" Observed unmanaged function "capGetDriverDescriptionA" in "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" Observed unmanaged function "BlockInput" in "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" Observed unmanaged function "SwapMouseButton" in "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" Observed unmanaged function "SendMessage" in "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" Observed unmanaged function "SetWindowPos" in "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" Observed unmanaged function "mciSendStringA" in "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" Observed unmanaged function "Beep" in "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" Observed unmanaged function "NtSetInformationProcess" in "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" Observed unmanaged function "GetAsyncKeyState" in "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" Observed unmanaged function "GetKeyboardLayout" in "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" Observed unmanaged function "GetKeyboardState" in "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" Observed unmanaged function "GetWindowThreadProcessId" in "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" Observed unmanaged function "MapVirtualKey" in "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" Observed unmanaged function "ToUnicodeEx" in "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" Observed unmanaged function "EnableWindow" in "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" Observed unmanaged function "GetClassNameA" in "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" Observed unmanaged function "SendMessageA" in "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" Observed unmanaged function "GetWindowText" in "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" Observed unmanaged function "GetWindowTextLength" in "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe"32:T296e,"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" loaded module "KERNEL32" at base 74e00000 "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 778b0000 "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 778b0000 "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 778b0000 "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 751a0000 "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 778b0000 "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 778b0000 "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 778b0000 "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73570000 "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" loaded module "ADVAPI32.DLL" at base 77830000 "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 73440000 "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" loaded module "SHLWAPI.DLL" at base 74570000 "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 74500000 "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" loaded module "VERSION.DLL" at base 741d0000 "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORWKS.DLL" at base 72e90000 "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" loaded module "USER32.DLL" at base 76f70000 "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" loaded module "MSCOREE.DLL" at base 72080000 "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" loaded module "NTDLL" at base 77a90000 "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" loaded module "SHELL32.DLL" at base 75a50000 "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" loaded module "KERNEL32.DLL" at base 74e00000 "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MSCORLIB\7AA13700A6FCDCB57E6CB353E54D0AB9\MSCORLIB.NI.DLL" at base 722f0000 "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\OLE32.DLL" at base 0 "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" loaded module "OLE32.DLL" at base 74ab0000 "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73f60000 "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORJIT.DLL" at base 72290000 "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM\61E9A201160F8BAED9F7E00A4969992E\SYSTEM.NI.DLL" at base 71870000 "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.VISUALBAS#\5F0A85C2A45C0FB0D1D12E010857A907\MICROSOFT.VISUALBASIC.NI.DLL" at base 720e0000 "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.DRAWING\D6163E1C32EBA738E42523885580DC48\SYSTEM.DRAWING.NI.DLL" at base 716e0000 "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.WINDOWS.FORMS\860A4E79ADBD2EB86ADE9317E1CD9D2A\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 70b00000 "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_MSIL\SYSTEM\2.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" loaded module "NTDLL.DLL" at base 77a90000 "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73a00000 "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" loaded module "RPCRT4.DLL" at base 75990000 "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" loaded module "%PROGRAMFILES(X86)%\MICROS~1\OFFICE14\GROOVEEX.DLL" at base 70690000 "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 704f0000 "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" loaded module "%PROGRAMFILES(X86)%\COMMON~1\MICROS~1\OFFICE14\CULTURES\OFFICE.ODF" at base 8310000 "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 70460000 "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 75270000 "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 75a50000 "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 74e00000 "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 73da0000 "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" loaded module "MSISO.DLL" at base 703c0000 "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" loaded module "SSPICLI.DLL" at base 744b0000 "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 778b0000 "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74400000 "Cat probiv.exe" loaded module "KERNEL32" at base 74e00000 "Cat probiv.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 778b0000 "Cat probiv.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 778b0000 "Cat probiv.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 778b0000 "Cat probiv.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 751a0000 "Cat probiv.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 778b0000 "Cat probiv.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 778b0000 "Cat probiv.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 778b0000 "Cat probiv.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73570000 "Cat probiv.exe" loaded module "ADVAPI32.DLL" at base 77830000 "Cat probiv.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 73440000 "Cat probiv.exe" loaded module "SHLWAPI.DLL" at base 74570000 "Cat probiv.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 74500000 "Cat probiv.exe" loaded module "VERSION.DLL" at base 741d0000 "Cat probiv.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORWKS.DLL" at base 72e90000 "Cat probiv.exe" loaded module "USER32.DLL" at base 76f70000 "Cat probiv.exe" loaded module "MSCOREE.DLL" at base 72080000 "Cat probiv.exe" loaded module "NTDLL" at base 77a90000 "Cat probiv.exe" loaded module "SHELL32.DLL" at base 75a50000 "Cat probiv.exe" loaded module "KERNEL32.DLL" at base 74e00000 "Cat probiv.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MSCORLIB\7AA13700A6FCDCB57E6CB353E54D0AB9\MSCORLIB.NI.DLL" at base 722f0000 "Cat probiv.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\OLE32.DLL" at base 0 "Cat probiv.exe" loaded module "OLE32.DLL" at base 74ab0000 "Cat probiv.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73f60000 "Cat probiv.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORJIT.DLL" at base 72290000 "Cat probiv.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM\61E9A201160F8BAED9F7E00A4969992E\SYSTEM.NI.DLL" at base 71870000 "Cat probiv.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.VISUALBAS#\5F0A85C2A45C0FB0D1D12E010857A907\MICROSOFT.VISUALBASIC.NI.DLL" at base 720e0000 "Cat probiv.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.DRAWING\D6163E1C32EBA738E42523885580DC48\SYSTEM.DRAWING.NI.DLL" at base 716e0000 "Cat probiv.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.WINDOWS.FORMS\860A4E79ADBD2EB86ADE9317E1CD9D2A\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 70b00000 "Cat probiv.exe" loaded module "NTDLL.DLL" at base 77a90000 "Cat probiv.exe" loaded module "USER32" at base 76f70000 "Cat probiv.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.XML\C7A2F551C65C81870E822E9E134513F9\SYSTEM.XML.NI.DLL" at base 705c0000 "Cat probiv.exe" loaded module "SHFOLDER.DLL" at base 700c0000 "Cat probiv.exe" loaded module "RPCRT4.DLL" at base 75990000 "Cat probiv.exe" loaded module "%ALLUSERSPROFILE%\NTDLL" at base 0 "Cat probiv.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CONFIGURATION\CD4B9B7E793D3FE3AD5C9542420992BE\SYSTEM.CONFIGURATION.NI.DLL" at base 6f4c0000 "Cat probiv.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_MSIL\SYSTEM\2.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "Cat probiv.exe" loaded module "PSAPI.DLL" at base 744f0000 "Cat probiv.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_MSIL\SYSTEM\2.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "Cat probiv.exe" loaded module "GDI32.DLL" at base 777f0000 "Cat probiv.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_MSIL\SYSTEM\2.0.0.0__B77A5C561934E089\WS2_32.DLL" at base 0 "Cat probiv.exe" loaded module "WS2_32.DLL" at base 74bf0000 "Cat probiv.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 73760000 "Cat probiv.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 6f490000 "Cat probiv.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7057000033:T1086,"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" touched "Private Profile Object" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{75847177-F077-4171-BD2C-A6BB2164FBD0}\INPROCSERVER32") "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" touched "Sync root manager" (Path: "HKCU\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" touched "Previous Versions Property Page" (Path: "HKCU\WOW6432NODE\CLSID\{596AB062-B4D2-4215-9F74-E9109B0A8153}\SHELLEX\MAYCHANGEDEFAULTMENU") "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" touched "Microsoft SendTo Service" (Path: "HKCU\WOW6432NODE\CLSID\{7BA4C740-9E81-11CF-99D3-00AA004AE837}\SHELLEX\MAYCHANGEDEFAULTMENU") "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" touched "Copy as Path Menu" (Path: "HKCU\WOW6432NODE\CLSID\{F3D06E7C-1E45-4A26-847E-F9FCDEE59BE0}\SHELLEX\MAYCHANGEDEFAULTMENU") "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" touched "Start Menu Pin" (Path: "HKCU\WOW6432NODE\CLSID\{A2A9545D-A0C2-42B4-9708-A0B2BADD77C8}\SHELLEX\MAYCHANGEDEFAULTMENU") "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" touched "Taskband Pin" (Path: "HKCU\WOW6432NODE\CLSID\{90AA3A4E-1CBA-4233-B8BB-535773D48449}\SHELLEX\MAYCHANGEDEFAULTMENU") "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" touched "Groove GFS Context Menu Handler" (Path: "HKCU\WOW6432NODE\CLSID\{6C467336-8281-4E60-8204-430CED96822D}\SHELLEX\MAYCHANGEDEFAULTMENU") "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" touched "Shell extensions for sharing" (Path: "HKCU\WOW6432NODE\CLSID\{F81E9010-6EA4-11CE-A7FF-00AA003CA9F6}\SHELLEX\MAYCHANGEDEFAULTMENU") "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" touched "Open With Context Menu Handler" (Path: "HKCU\WOW6432NODE\CLSID\{09799AFB-AD67-11D1-ABCD-00C04FC30936}\SHELLEX\MAYCHANGEDEFAULTMENU") "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" touched "Ribbon Modern Share Verb" (Path: "HKCU\WOW6432NODE\CLSID\{E2BF9676-5F8F-435C-97EB-11607A5BEDF7}\SHELLEX\MAYCHANGEDEFAULTMENU") "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" touched "Pin To Start Screen verb handler" (Path: "HKCU\WOW6432NODE\CLSID\{470C0EBD-5D73-4D58-9CED-E91E22E23282}\SHELLEX\MAYCHANGEDEFAULTMENU") "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" touched "CompatContextMenu Class" (Path: "HKCU\WOW6432NODE\CLSID\{1D27F844-3A1F-4410-85AC-14651078412D}\SHELLEX\MAYCHANGEDEFAULTMENU") "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" touched "File Property Page Extension" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{21B22460-3AEA-1069-A2DC-08002B30309D}\INPROCSERVER32") "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" touched "ExecuteAssociation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{1649D1CF-DEAF-4A68-ABE8-5C9F68572FD1}\INPROCSERVER32") "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" touched "Security Manager" (Path: "HKCU\WOW6432NODE\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS")34:T964,"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "a60b4c9bb474e5da8291e6d7cc11751e.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"35:Tc97,Observed system executable string:"1,"fusion","GAC",03,"C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\61e9a201160f8baed9f7e00a4969992e\System.ni.dll",03,"C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\5f0a85c2a45c0fb0d1d12e010857a907\Microsoft.VisualBasic.ni.dll",03,"C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\d6163e1c32eba738e42523885580dc48\System.Drawing.ni.dll",03,"C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\860a4e79adbd2eb86ade9317e1cd9d2a\System.Windows.Forms.ni.dll",0" [Source: d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe.log] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00001804-00000C2B-1549501651] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll" [Source: 00000000-00001804-00000C28-1631267143] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_32\mscorlib\7aa13700a6fcdcb57e6cb353e54d0ab9\mscorlib.ni.dll" [Source: 00000000-00001804-00000C28-1631651408] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ole32.dll" [Source: 00000000-00001804-00000C28-1631697594] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll" [Source: 00000000-00001804-00000C28-1631918919] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_32\System\61e9a201160f8baed9f7e00a4969992e\System.ni.dll" [Source: 00000000-00001804-00000C28-1631975723] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\5f0a85c2a45c0fb0d1d12e010857a907\Microsoft.VisualBasic.ni.dll" [Source: 00000000-00001804-00000C28-1632017151] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Drawing\d6163e1c32eba738e42523885580dc48\System.Drawing.ni.dll" [Source: 00000000-00001804-00000C28-1632089511] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\860a4e79adbd2eb86ade9317e1cd9d2a\System.Windows.Forms.ni.dll" [Source: 00000000-00001804-00000C28-1632137273] Observed system executable string:"%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00001804-00000C28-1632727839] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Xml\c7a2f551c65c81870e822e9e134513f9\System.Xml.ni.dll" [Source: 00000000-00006896-00000C28-1636043327] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Configuration\cd4b9b7e793d3fe3ad5c9542420992be\System.Configuration.ni.dll" [Source: 00000000-00006896-00000C28-1636474306] Observed system executable string:"%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00006896-00000C28-1636474566] Observed system executable string:"%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00006896-00000C28-1636642470] Observed system executable string:"%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ws2_32.dll" [Source: 00000000-00006896-00000C28-1636824929]36:T53c,"a60b4c9bb474e5da8291e6d7cc11751e.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\a60b4c9bb474e5da8291e6d7cc11751e.exe]- [targetUID: 00000000-00006896] "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe.log" has type "ASCII text with CRLF line terminators"- Location: [%LOCALAPPDATA%\Microsoft\CLR_v2.0_32\UsageLogs\d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe.log]- [targetUID: 00000000-00001804] "autorun.inf" has type "Microsoft Windows Autorun file"- Location: [C:\autorun.inf]- [targetUID: 00000000-00006896] "Cat probiv.exe.exe%3AZone.Identifier" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "Cat probiv.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%ALLUSERSPROFILE%\Cat probiv.exe]- [targetUID: 00000000-00006896] "Cat probiv.exe.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [C:\Cat probiv.exe.exe]- [targetUID: 00000000-00006896] "Cat probiv.exe%3AZone.Identifier" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "a60b4c9bb474e5da8291e6d7cc11751e.exe%3AZone.Identifier" has type "ASCII text with CRLF line terminators"- [targetUID: N/A]37:Te14,"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME"; Key: ""; Value: "") "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID"; Key: ""; Value: "") "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: ""; Value: "") "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION\CUSTOMATTRIBUTES"; Key: ""; Value: "") "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE\DIAGNOSIS"; Key: ""; Value: "") "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER"; Key: ""; Value: "") "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: ""; Value: "") "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\DEBUGINFORMATION"; Key: ""; Value: "") "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY\CUSTOMATTRIBUTES"; Key: ""; Value: "") "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\TREATASCLASSINDEX"; Key: ""; Value: "") "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\CLASSINDEX\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "") "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "") "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "") "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "")38:T1339,"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATIONTYPE"; Value: "") "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "SERVER"; Value: "") "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "DLLPATH"; Value: "") "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "THREADING"; Value: "") "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "TRUSTLEVEL"; Value: "") "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "REMOTESERVER"; Value: "") "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATEASUSER"; Value: "") "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATEINSHAREDBROKER"; Value: "") "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "PERMISSIONS"; Value: "") "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "EXEPATH"; Value: "") "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "COMMANDLINE"; Value: "") "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "IDENTITYTYPE"; Value: "") "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "PERMISSIONS"; Value: "") "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "ACTIVATABLECLASSES"; Value: "") "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "SERVERTYPE"; Value: "") "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "APPID"; Value: "") "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "IDENTITY"; Value: "") "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "SERVICENAME"; Value: "") "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "EXPLICITPSMACTIVATIONTYPE"; Value: "") "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{8645456F-D9A2-4B82-AFEC-58F0E8DF0ACF}\PROXYSTUBCLSID32"; Key: ""; Value: "") "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}"; Key: ""; Value: "") "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "")39:T627,"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" reads file "c:\windows\microsoft.net\framework\v2.0.50727\config\machine.config" "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" reads file "c:\d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" reads file "c:\d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe:zone.identifier" "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" reads file "c:\users\%osuser%\desktop\desktop.ini" "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" reads file "c:\users\%osuser%\documents\desktop.ini" "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" reads file "c:\users\%osuser%\music\desktop.ini" "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" reads file "c:\users\%osuser%\pictures\desktop.ini" "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" reads file "c:\users\%osuser%\videos\desktop.ini" "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" reads file "c:\users\%osuser%\downloads\desktop.ini" "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" reads file "c:\users\%osuser%\onedrive\desktop.ini" "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" reads file "c:\programdata\cat probiv.exe:zone.identifier" "Cat probiv.exe" reads file "c:\windows\microsoft.net\framework\v2.0.50727\config\machine.config"3a:T49c,"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" trying to touch file "C:\Windows\System32\WOW64LOG.DLL" "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" trying to touch file "C:\Windows\SysWOW64\mscoree.dll" "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" trying to touch file "C:\Windows\SysWOW64\apphelp.dll" "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" trying to touch file "C:\d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" trying to touch file "C:\Windows\SysWOW64\ntdll.dll" "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" trying to touch file "C:\Windows\SysWOW64\kernel32.dll" "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" trying to touch file "C:\Windows\SysWOW64\KernelBase.dll" "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll"3b:Tce9,"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" trying to access non-existent file "C:\FLTLIB.DLL" "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\CLR.DLL" "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\MSCORWKS.DLL" "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\CLR.DLL" "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\MSCORWKS.DLL" "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CLR.DLL" "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\OLE32.DLL" "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\ole32.dll" "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" trying to access non-existent file "C:\ProgramData\CAT PROBIV.EXE" "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" trying to access non-existent file "C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\SHELL32.DLL" "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" trying to access non-existent file "C:\WINDOWS\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\shell32.dll" "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" trying to access non-existent file "C:\CLDAPI.DLL" "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" trying to access non-existent file "C:\CLDAPI.dll" "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" trying to access non-existent file "C:\AEPIC.DLL" "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" trying to access non-existent file "C:\AEPIC.dll" "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" trying to access non-existent file "C:\BCRYPT.DLL" "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" trying to access non-existent file "C:\bcrypt.dll" "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" trying to access non-existent file "C:\PROPSYS.DLL" "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" trying to access non-existent file "C:\PROPSYS.dll"3c:Tab0,"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" trying to access non-existent file "C:\Windows\SysWOW64\MSCOREE.DLL.LOCAL" "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\MSCOREE.DLL.local" "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" trying to access non-existent file "C:\D31EB15E08897BF1D309D5940B50EB811AB4C2B9E7AB8BAA41038167A73A0CA5.EXE.CONFIG" "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" trying to access non-existent file "C:\D31EB15E08897BF1D309D5940B50EB811AB4C2B9E7AB8BAA41038167A73A0CA5.EXE.LOCAL" "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" trying to access non-existent file "C:\d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe.Local\" "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\FUSION.LOCALGAC" "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\fusion.localgac" "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\SECURITY.CONFIG" "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\SECURITY.CONFIG.CCH" "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\ENTERPRISESEC.CONFIG" "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\ENTERPRISESEC.CONFIG.CCH" "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" trying to access non-existent file "C:\D31EB15E08897BF1D309D5940B50EB811AB4C2B9E7AB8BAA41038167A73A0CA5.CONFIG" "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" trying to access non-existent file "C:\d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.config" "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" trying to access non-existent file "C:\Windows\Globalization\EN-US.NLP" "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" trying to access non-existent file "C:\WINDOWS\Globalization\en-us.nlp"3d:T6d1,"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" writes file "c:\programdata\cat probiv.exe" "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" writes file "c:\programdata\cat probiv.exe:zone.identifier" "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" writes file "c:\users\%osuser%\appdata\local\microsoft\clr_v2.0_32\usagelogs\d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe.log" "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" writes file "%allusersprofile%\cat probiv.exe:zone.identifier" "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" writes file "%allusersprofile%\cat probiv.exe" "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" writes file "%localappdata%\microsoft\clr_v2.0_32\usagelogs\d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe.log" "Cat probiv.exe" writes file "c:\users\%osuser%\appdata\roaming\microsoft\windows\start menu\programs\startup\a60b4c9bb474e5da8291e6d7cc11751e.exe" "Cat probiv.exe" writes file "c:\users\%osuser%\appdata\roaming\microsoft\windows\start menu\programs\startup\a60b4c9bb474e5da8291e6d7cc11751e.exe:zone.identifier" "Cat probiv.exe" writes file "c:\cat probiv.exe.exe" "Cat probiv.exe" writes file "c:\cat probiv.exe.exe:zone.identifier" "Cat probiv.exe" writes file "c:\autorun.inf" "Cat probiv.exe" writes file "%appdata%\microsoft\windows\start menu\programs\startup\a60b4c9bb474e5da8291e6d7cc11751e.exe:zone.identifier" "Cat probiv.exe" writes file "%appdata%\microsoft\windows\start menu\programs\startup\a60b4c9bb474e5da8291e6d7cc11751e.exe" "Cat probiv.exe" writes file "%allusersprofile%\cat probiv.exe"3e:Tdf2,Observed Namespace "System.Net.Sockets.TcpClient" and MemberReference "Close" in "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" Observed Namespace "System.Net.Sockets.TcpClient" and MemberReference ".ctor" in "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" Observed Namespace "System.Net.Sockets.TcpClient" and MemberReference "set_ReceiveBufferSize" in "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" Observed Namespace "System.Net.Sockets.TcpClient" and MemberReference "set_SendBufferSize" in "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" Observed Namespace "System.Net.Sockets.TcpClient" and MemberReference "get_Client" in "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "set_SendTimeout" in "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "set_ReceiveTimeout" in "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference ".ctor" in "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "SendTo" in "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" Observed Namespace "System.Net.Sockets.TcpClient" and MemberReference "get_Available" in "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Poll" in "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" Observed Namespace "System.Net.Sockets.TcpClient" and MemberReference "GetStream" in "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Receive" in "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Send" in "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" Observed Namespace "System.Net.Sockets.TcpClient" and MemberReference "Close" in "a60b4c9bb474e5da8291e6d7cc11751e.exe" Observed Namespace "System.Net.Sockets.TcpClient" and MemberReference ".ctor" in "a60b4c9bb474e5da8291e6d7cc11751e.exe" Observed Namespace "System.Net.Sockets.TcpClient" and MemberReference "set_ReceiveBufferSize" in "a60b4c9bb474e5da8291e6d7cc11751e.exe" Observed Namespace "System.Net.Sockets.TcpClient" and MemberReference "set_SendBufferSize" in "a60b4c9bb474e5da8291e6d7cc11751e.exe" Observed Namespace "System.Net.Sockets.TcpClient" and MemberReference "get_Client" in "a60b4c9bb474e5da8291e6d7cc11751e.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "set_SendTimeout" in "a60b4c9bb474e5da8291e6d7cc11751e.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "set_ReceiveTimeout" in "a60b4c9bb474e5da8291e6d7cc11751e.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference ".ctor" in "a60b4c9bb474e5da8291e6d7cc11751e.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "SendTo" in "a60b4c9bb474e5da8291e6d7cc11751e.exe" Observed Namespace "System.Net.Sockets.TcpClient" and MemberReference "get_Available" in "a60b4c9bb474e5da8291e6d7cc11751e.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Poll" in "a60b4c9bb474e5da8291e6d7cc11751e.exe"3f:T5c0,"8.0.0.0" Potential IP "2.0.0.0" found in string "mscorlib,2.0.0.0,,b77a5c561934e089,x86" Potential IP "8.0.0.0" found in string "Microsoft.VisualBasic,8.0.0.0,,b03f5f7f11d50a3a,MSIL" Potential IP "2.0.0.0" found in string "System,2.0.0.0,,b77a5c561934e089,MSIL" Potential IP "2.0.0.0" found in string "System.Xml,2.0.0.0,,b77a5c561934e089,MSIL" Potential IP "2.0.0.0" found in string "System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL" Potential IP "2.0.0.0" found in string "System.Web,2.0.0.0,,b03f5f7f11d50a3a,x86" Potential IP "2.0.0.0" found in string "System.Management,2.0.0.0,,b03f5f7f11d50a3a,MSIL" Potential IP "2.0.0.0" found in string "System.Runtime.Remoting,2.0.0.0,,b77a5c561934e089,MSIL" Potential IP "2.0.0.0" found in string "System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL" Potential IP "2.0.0.0" found in string "System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL" Potential IP "2.0.0.0" found in string "System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL" Potential IP "2.0.0.0" found in string "System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL" Potential IP "2.0.0.0" found in string "Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL" Potential IP "2.0.0.0" found in string "System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL" Potential IP "2.0.0.0" found in string "System.Data.SqlXml,2.0.0.0,,b77a5c561934e089,MSIL" "2.0.0.0" Potential IP "2.0.0.0" found in string "2.0.0.0," "255.255.255.255" "147.185.221.18"40:T936,Heuristic match: "photography-ringtones.gl.at.ply.gg" Pattern match: "https://dl.dropbox.com/s/p84aaz28t0hepul/pass.exe?dl=0" Heuristic match: "hotography-ringtones.gl.at.ply.gg" Pattern match: "dl.dropbox.com/s/p84aaz28t0hepul/pass.exe?dl=0" Pattern match: "microsoft.net/framework/v2.0.50727/" Heuristic match: "dows.fo" Pattern match: "http://www.w3.org/2001/xmlschema-instance" Pattern match: "http://go.microsoft.com/fwlink/?linkid=42127" Pattern match: "http://www.w3.org/2000/xmlns/" Pattern match: "http://www.w3.org/xml/1998/namespace" Pattern match: "http://schemas.microsoft.com/.netconfiguration/v2.0" Pattern match: "system.web/anonymousidentification" Pattern match: "system.web/authentication" Pattern match: "system.web/authorization" Pattern match: "system.web/browsercaps" Pattern match: "system.web/clienttarget" Pattern match: "system.web/compilation" Pattern match: "system.web/customerrors" Pattern match: "system.web/deployment" Pattern match: "system.web/devicefilters" Pattern match: "system.web/globalization" Pattern match: "system.web/healthmonitoring" Pattern match: "system.web/hostingenvironment" Pattern match: "system.web/httpcookies" Pattern match: "system.web/httphandlers" Pattern match: "system.web/httpmodules" Pattern match: "system.web/httpruntime" Pattern match: "system.web/identity" Pattern match: "system.web/machinekey" Pattern match: "system.web/membership" Pattern match: "system.web/mobilecontrols" Pattern match: "system.web/pages" Pattern match: "system.web/processmodel" Pattern match: "system.web/profile" Pattern match: "system.web/protocols" Pattern match: "system.web/rolemanager" Pattern match: "system.web/securitypolicy" Pattern match: "system.web/sessionpagestate" Pattern match: "system.web/sessionstate" Pattern match: "system.web/sitemap" Pattern match: "system.web/trace" Pattern match: "system.web/trust" Pattern match: "system.web/urlmappings" Pattern match: "system.web/webcontrols" Pattern match: "system.web/webparts" Pattern match: "system.web/webservices" Pattern match: "system.web/xhtmlconformance" Pattern match: "system.web/caching" Pattern match: "system.web/caching/cache" Pattern match: "system.web/caching/outputcache" Pattern match: "system.web/caching/outputcachesettings" Pattern match: "system.web/caching/sqlcachedependency"41:Teac,"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00001804) "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00001804)42:Te4f,Found string "FromBase64String" (Indicator: "base64"; File: "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe") Found string "FromBase64String" (Indicator: "FromBase64String"; File: "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe") Found string "ToBase64String" (Indicator: "base64"; File: "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe") Found string "ToBase64String" (Indicator: "ToBase64String"; File: "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe") Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; File: "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe") Found string "MD5CryptoServiceProvider" (Indicator: "md5cryptoserviceprovider"; File: "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe") Found string "GZipStream" (Indicator: "GzipStream"; File: "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe") file/memory contains long string with (Indicator: "base64"; File: "a60b4c9bb474e5da8291e6d7cc11751e.exe") file/memory contains long string with (Indicator: "FromBase64String"; File: "a60b4c9bb474e5da8291e6d7cc11751e.exe") file/memory contains long string with (Indicator: "GzipStream"; File: "a60b4c9bb474e5da8291e6d7cc11751e.exe") file/memory contains long string with (Indicator: "ToBase64String"; File: "a60b4c9bb474e5da8291e6d7cc11751e.exe") file/memory contains long string with (Indicator: "md5cryptoserviceprovider"; File: "a60b4c9bb474e5da8291e6d7cc11751e.exe") file/memory contains long string with (Indicator: "System.Security.Cryptography"; File: "a60b4c9bb474e5da8291e6d7cc11751e.exe") Found string "FromBase64String" (Indicator: "base64"; Source: "00000000-00006896.00000000.168403.00132000.00000002.mdmp") Found string "FromBase64String" (Indicator: "FromBase64String"; Source: "00000000-00006896.00000000.168403.00132000.00000002.mdmp") Found string "ToBase64String" (Indicator: "base64"; Source: "00000000-00006896.00000000.168403.00132000.00000002.mdmp, 00000000-00006896.00000000.168403.02810000.00000004.mdmp, 00000000-00006896.00000001.170322.02810000.00000004.mdmp, 00000000-00006896.00000002.172242.02810000.00000004.mdmp") Found string "ToBase64String" (Indicator: "ToBase64String"; Source: "00000000-00006896.00000000.168403.00132000.00000002.mdmp, 00000000-00006896.00000000.168403.02810000.00000004.mdmp, 00000000-00006896.00000001.170322.02810000.00000004.mdmp, 00000000-00006896.00000002.172242.02810000.00000004.mdmp") Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006896.00000000.168403.00132000.00000002.mdmp") Found string "MD5CryptoServiceProvider" (Indicator: "md5cryptoserviceprovider"; Source: "00000000-00006896.00000000.168403.00132000.00000002.mdmp") Found string "GZipStream" (Indicator: "GzipStream"; Source: "00000000-00006896.00000000.168403.00132000.00000002.mdmp") file/memory contains long string with (Indicator: "RsaCryptoServiceProvider"; Source: "00000000-00006896.00000000.168403.04D60000.00000004.mdmp") Found string "Uses RsaCryptoServiceProvider to encrypt and decrypt" (Indicator: "RsaCryptoServiceProvider"; Source: "00000000-00006896.00000000.168403.04D60000.00000004.mdmp") Found string "Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" description="Uses RsaCryptoServiceProvider to encrypt and decrypt" keyContainerName="NetFrameworkConfigurationKey" cspProviderName="" useMachineContainer="true" useOAEP="false"/>" (Indicator: "RsaCryptoServiceProvider"; Source: "00000000-00006896.00000000.168403.04D60000.00000004.mdmp")43:Ta13,Found reference to API "CopyFromScreen" (Indicator: "CopyFromScreen"; File: "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe") Found reference to API "CopyFromScreen" (Indicator: "CopyFromScreen"; Source: "00000000-00006896.00000000.168403.00132000.00000002.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00006896.00000000.168403.02810000.00000004.mdmp, 00000000-00006896.00000001.170322.02810000.00000004.mdmp, 00000000-00006896.00000002.172242.02810000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00006896.00000000.168403.02810000.00000004.mdmp, 00000000-00006896.00000001.170322.02810000.00000004.mdmp, 00000000-00006896.00000002.172242.02810000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00006896.00000000.168403.02810000.00000004.mdmp, 00000000-00006896.00000001.170322.02810000.00000004.mdmp, 00000000-00006896.00000002.172242.02810000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00006896.00000000.168403.02810000.00000004.mdmp, 00000000-00006896.00000001.170322.02810000.00000004.mdmp, 00000000-00006896.00000002.172242.02810000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00006896.00000000.168403.02810000.00000004.mdmp, 00000000-00006896.00000001.170322.02810000.00000004.mdmp, 00000000-00006896.00000002.172242.02810000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00006896.00000000.168403.02810000.00000004.mdmp, 00000000-00006896.00000001.170322.02810000.00000004.mdmp, 00000000-00006896.00000002.172242.02810000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00006896.00000000.168403.02810000.00000004.mdmp, 00000000-00006896.00000001.170322.02810000.00000004.mdmp, 00000000-00006896.00000002.172242.02810000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00006896.00000000.168403.02810000.00000004.mdmp, 00000000-00006896.00000001.170322.02810000.00000004.mdmp, 00000000-00006896.00000002.172242.02810000.00000004.mdmp")44:T11dd,Found reference to API "GetAsyncKeyState" (Indicator: "GetAsyncKeyState"; File: "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe") Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; File: "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe") Found reference to API "MapVirtualKey" (Indicator: "MapVirtualKey"; File: "d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe") Found reference to API "GetAsyncKeyState" (Indicator: "GetAsyncKeyState"; Source: "00000000-00006896.00000000.168403.00132000.00000002.mdmp") Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; Source: "00000000-00006896.00000000.168403.00132000.00000002.mdmp") Found reference to API "MapVirtualKey" (Indicator: "MapVirtualKey"; Source: "00000000-00006896.00000000.168403.00132000.00000002.mdmp") Found reference to API "11952139609,3020,104,,GetKeyState,user32.dll,"00:43:51.296",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00006896.00000000.168403.02810000.00000004.mdmp") Found reference to API "11952003719,3020,103,,GetAsyncKeyState,user32.dll,"00:43:51.296",RX=0,PX=0" (Indicator: "GetAsyncKeyState"; Source: "00000000-00006896.00000000.168403.02810000.00000004.mdmp") Found reference to API "11925782495,3020,103,,GetAsyncKeyState,user32.dll,"00:43:51.281",RX=0,PX=0" (Indicator: "GetAsyncKeyState"; Source: "00000000-00006896.00000000.168403.02810000.00000004.mdmp") Found reference to API "11928821235,3020,104,,GetKeyState,user32.dll,"00:43:51.281",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00006896.00000000.168403.02810000.00000004.mdmp") Found reference to API "11957061978,3020,103,,GetAsyncKeyState,user32.dll,"00:43:51.296",RX=0,PX=0" (Indicator: "GetAsyncKeyState"; Source: "00000000-00006896.00000000.168403.02810000.00000004.mdmp") Found reference to API "11952074393,3020,104,,GetKeyState,user32.dll,"00:43:51.296",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00006896.00000000.168403.02810000.00000004.mdmp") Found reference to API "11926391011,3020,104,,GetKeyState,user32.dll,"00:43:51.281",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00006896.00000000.168403.02810000.00000004.mdmp") Found reference to API "11928480965,3020,103,,GetAsyncKeyState,user32.dll,"00:43:51.281",RX=0,PX=0" (Indicator: "GetAsyncKeyState"; Source: "00000000-00006896.00000000.168403.02810000.00000004.mdmp") Found reference to API "11926342259,3020,103,,GetAsyncKeyState,user32.dll,"00:43:51.281",RX=0,PX=0" (Indicator: "GetAsyncKeyState"; Source: "00000000-00006896.00000000.168403.02810000.00000004.mdmp") Found reference to API "11928181523,3020,104,,GetKeyState,user32.dll,"00:43:51.281",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00006896.00000000.168403.02810000.00000004.mdmp") Found reference to API "11928927655,3020,104,,GetKeyState,user32.dll,"00:43:51.281",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00006896.00000000.168403.02810000.00000004.mdmp") Found reference to API "11928883105,3020,104,,GetKeyState,user32.dll,"00:43:51.281",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00006896.00000000.168403.02810000.00000004.mdmp") Found reference to API "11926701521,3020,104,,GetKeyState,user32.dll,"00:43:51.281",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00006896.00000000.168403.02810000.00000004.mdmp") Found reference to API "11928233763,3020,103,,GetAsyncKeyState,user32.dll,"00:43:51.281",RX=0,PX=0" (Indicator: "GetAsyncKeyState"; Source: "00000000-00006896.00000000.168403.02810000.00000004.mdmp") Found reference to API "83910158865,3020,104,,GetKeyState,user32.dll,"00:44:21.265",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00006896.00000001.170322.02810000.00000004.mdmp") Found reference to API "83911981951,3020,103,,GetAsyncKeyState,user32.dll,"00:44:21.281",RX=0,PX=0" (Indicator: "GetAsyncKeyState"; Source: "00000000-00006896.00000001.170322.02810000.00000004.mdmp") Found reference to API "83910567399,3020,104,,GetKeyState,user32.dll,"00:44:21.265",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00006896.00000001.170322.02810000.00000004.mdmp") Found reference to API "83911880735,3020,104,,GetKeyState,user32.dll,"00:44:21.281",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00006896.00000001.170322.02810000.00000004.mdmp") Found reference to API "83911931123,3020,104,,GetKeyState,user32.dll,"00:44:21.281",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00006896.00000001.170322.02810000.00000004.mdmp")45:Tb06,"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\PROGRAMDATA\CAT PROBIV.EXE"; Value: "") "Cat probiv.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\NETSH.EXE"; Value: "") "Cat probiv.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "Cat probiv.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "Cat probiv.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "Cat probiv.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "Cat probiv.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "Cat probiv.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "Cat probiv.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "Cat probiv.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "Cat probiv.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "Cat probiv.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "Cat probiv.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "Cat probiv.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") "Cat probiv.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "")46:T85a,YARA signature "njrat1" classified file "sample.bin" as "rat,njrat" (Author: Brian Wallace @botnet_hunter) YARA signature "win_exe_njRAT" classified file "sample.bin" as "rat,njrat" (Author: info@fidelissecurity.com) YARA signature "win_njrat_g0" classified file "sample.bin" as "njrat,rat" (Author: Various authors / Slavo Greminger, SWITCH-CERT) YARA signature "njrat1" classified file "Cat probiv.exe.exe.4081066502" as "rat,njrat" (Author: Brian Wallace @botnet_hunter) YARA signature "win_exe_njRAT" classified file "Cat probiv.exe.exe.4081066502" as "rat,njrat" (Author: info@fidelissecurity.com) YARA signature "win_njrat_g0" classified file "Cat probiv.exe.exe.4081066502" as "njrat,rat" (Author: Various authors / Slavo Greminger, SWITCH-CERT) YARA signature "njrat1" classified file "a60b4c9bb474e5da8291e6d7cc11751e.exe.888499045" as "rat,njrat" (Author: Brian Wallace @botnet_hunter) YARA signature "win_exe_njRAT" classified file "a60b4c9bb474e5da8291e6d7cc11751e.exe.888499045" as "rat,njrat" (Author: info@fidelissecurity.com) YARA signature "win_njrat_g0" classified file "a60b4c9bb474e5da8291e6d7cc11751e.exe.888499045" as "njrat,rat" (Author: Various authors / Slavo Greminger, SWITCH-CERT) YARA signature "njrat1" classified file "Cat probiv.exe.3017982952" as "rat,njrat" (Author: Brian Wallace @botnet_hunter) YARA signature "win_exe_njRAT" classified file "Cat probiv.exe.3017982952" as "rat,njrat" (Author: info@fidelissecurity.com) YARA signature "win_njrat_g0" classified file "Cat probiv.exe.3017982952" as "njrat,rat" (Author: Various authors / Slavo Greminger, SWITCH-CERT) YARA signature "MALWARE_Win_NjRAT" matched file "sample.bin" as "Detects NjRAT / Bladabindi" (Author: ditekSHen) YARA signature "MALWARE_Win_NjRAT" matched file "Cat probiv.exe.exe.4081066502" as "Detects NjRAT / Bladabindi" (Author: ditekSHen) YARA signature "MALWARE_Win_NjRAT" matched file "a60b4c9bb474e5da8291e6d7cc11751e.exe.888499045" as "Detects NjRAT / Bladabindi" (Author: ditekSHen) YARA signature "MALWARE_Win_NjRAT" matched file "Cat probiv.exe.3017982952" as "Detects NjRAT / Bladabindi" (Author: ditekSHen)1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790749986205,"unified_at":"2026-09-30T06:33:06.205Z","metadata":{"hashes":{"sha256":"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5","sha1":"edc3fd6d6a133f44692487c188e5b653fddc6c90","md5":"304a913cde19525a4718187163380640","sha512":"80d7cc263639f084c0aefdc5a97096e6aeae3b7b04776f8e6eacd59f9605ebd216d0058d93834e41edb8885804aa1ebf647bdf5ec8d5a57c3898a8018059759b","ssdeep":"6144:5gnSWRo0Oeq06VgLLKWK+L4FFI/+Ebx445yuWpsLZ8:yS0oixRvXnLrN6K1","ssdeep_chunks":["6144:5gnSWRo","6144:gnSWRo0","6144:nSWRo0O","6144:SWRo0Oe","6144:WRo0Oeq","6144:Ro0Oeq0","6144:o0Oeq06","6144:0Oeq06V","6144:Oeq06Vg","6144:eq06VgL","6144:q06VgLL","6144:06VgLLK","6144:6VgLLKW","6144:VgLLKWK","6144:gLLKWK+","6144:LLKWK+L","6144:LKWK+L4","6144:KWK+L4F","6144:WK+L4FF","6144:K+L4FFI","6144:+L4FFI/","6144:L4FFI/+","6144:4FFI/+E","6144:FFI/+Eb","6144:FI/+Ebx","6144:I/+Ebx4","6144:/+Ebx44","6144:+Ebx445","6144:Ebx445y","6144:bx445yu","6144:x445yuW","6144:445yuWp","6144:45yuWps","6144:5yuWpsL","6144:yuWpsLZ","6144:uWpsLZ8","12288:5gnSWRo","12288:gnSWRo0","12288:nSWRo0O","12288:SWRo0Oe","12288:WRo0Oeq","12288:Ro0Oeq0","12288:o0Oeq06","12288:0Oeq06V","12288:Oeq06Vg","12288:eq06VgL","12288:q06VgLL","12288:06VgLLK","12288:6VgLLKW","12288:VgLLKWK","12288:gLLKWK+","12288:LLKWK+L","12288:LKWK+L4","12288:KWK+L4F","12288:WK+L4FF","12288:K+L4FFI","12288:+L4FFI/","12288:L4FFI/+","12288:4FFI/+E","12288:FFI/+Eb","12288:FI/+Ebx","12288:I/+Ebx4","12288:/+Ebx44","12288:+Ebx445","12288:Ebx445y","12288:bx445yu","12288:x445yuW","12288:445yuWp","12288:45yuWps","12288:5yuWpsL","12288:yuWpsLZ","12288:uWpsLZ8","6144:yS0oixR","6144:S0oixRv","6144:0oixRvX","6144:oixRvXn","6144:ixRvXnL","6144:xRvXnLr","6144:RvXnLrN","6144:vXnLrN6","6144:XnLrN6K","6144:nLrN6K1"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"bounty-76959143565297645","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":234496,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1708883112000,"last_seen":1741579301000,"last_multi_scan":1741579301000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["commodity","targetedcrimeware","spynote","ddos","targeted","redlinestealer","xworm","criminal","mobilemalware","asyncrat","warzone","modular","rat","backdoor","remcos","njrat","meterpreter","darkcomet","informationstealer","xenorat","deploymentframework","proxy","loda","ahmyth","keylogger","metasploit","quasar","credentialharvesting","njratlime","opensource","exploit","ransomware","downloader","windows-server-utility"]},"stats":{"av":{"malicious_count":19,"suspicious_count":0,"total_engines":24},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":60},"sandbox_signatures":{"informative_count":128,"suspicious_count":21,"malicious_count":11,"total":160},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.RL_Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Backdoor]/MSIL.Bladabindi.as","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/ATRAPS.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Heur.MSIL.Krypt.44","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Packed.Bladabindi-7994427-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"TrojWare.MSIL.Spy.Agent.CP","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Worm.Bladabindi (A)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/Bladabindi.AR worm","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 700000121 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Trojan-FIGN","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Autoruner2.ebrjyu","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_95","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Bbindi-W","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/MSIL_Troj.AP.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.DownLoader21.BPQW","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Trojan.MSIL.Bladabindi.Heur","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Worm.Bladabindi.Win32.24845","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Worm.Bladabindi","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Initial Access","technique":"Replication Through Removable Media","attack_id":"T1091","attack_id_wiki":"https://attack.mitre.org/techniques/T1091","identifiers":[{"type":"malicious","value":"Drops a Windows autorun file"}],"sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","identifiers":[{"type":"suspicious","value":"Possible high-risk domain detected"}],"sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Dotnet source code contains suspicious native API"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Found Native API in Dotnet file"},{"type":"informative","value":"Contains ability to start a process (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains reference to multiple windows system processes"}],"sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"The analysis spawned a process that was identified as malicious"},{"type":"malicious","value":"The analysis extracted a file that was identified as malicious"}],"sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"type":"informative","value":"Contains reference to Windows Startup folder"}],"sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"suspicious","value":"Spawned processes likely due to injection"}],"sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"Calls an API typically used to acquire handle to a key container within a CSP"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Contains ability to perform crypto operations"},{"type":"suspicious","value":"Dropped file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to decode base64 data"},{"type":"informative","value":"Contains ability to load content into memory (Dotnet)"},{"type":"informative","value":"Contains ability to decode string content at runtime (Dotnet)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains ability to block user input (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"},{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify System Firewall","attack_id":"T1562.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/004","identifiers":[{"type":"malicious","value":"Modifies firewall settings"},{"type":"informative","value":"Detects NETSH process execution"}],"sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Able to identify sandbox environment running process"}],"sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Marks file for deletion"},{"type":"suspicious","value":"Opens file with deletion access rights"}],"sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"suspicious","value":"Possibly tries to evade analysis by sleeping many times"}],"sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"malicious","value":"Drops executable files to the application program directory (%ProgramData%)"},{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"},{"type":"informative","value":"Dotnet file contains function to dynamically call methods at runtime"},{"type":"suspicious","value":"PE file has unusual entropy resources"}],"sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"},{"type":"informative","value":"Dotnet code contains ability to modify/delete registry"}],"sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to set file attributes (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Dotnet code contains potential unpacker"}],"sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"suspicious","value":"Calls an API typically used for keylogging"},{"type":"suspicious","value":"Contains ability to retrieve keyboard strokes"},{"type":"informative","value":"Contains ability to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Contains ability to enumerates all mounted drives"},{"type":"suspicious","value":"Reads configuration files (.ini files)"}],"sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"suspicious","value":"Found system commands related strings"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Reads information about supported languages"},{"type":"suspicious","value":"Calls an API typically used to find and list the Windows drive types"},{"type":"informative","value":"Contains ability to find logical drives of the machine (API string)"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Contains ability to gather system information (Dotnet)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads the cryptographic machine GUID"}],"sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to get active window titles (Dotnet)"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to get active windows title"}],"sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Dotnet code contains ability to query registry"}],"sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Contains ability to gather process details (Dotnet)"},{"type":"suspicious","value":"Contains ability to enumerate processes/modules/threads"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"}],"sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Contains ability to retrieve system language"}],"sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen information (Dotnet)"},{"type":"informative","value":"Contains ability to capture screenshot"},{"type":"malicious","value":"Contains ability to capture the screen"},{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Writes log files"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Calls an API typically used to copy file from one location to another"}],"sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Contains ability to decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"suspicious","value":"Spawned process connects to a network"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contains ability to communicates via socket (possible C&C communication)"}],"sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"},{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"malicious","value":"Uses network protocols on unusual ports"},{"type":"suspicious","value":"Contains ability to open a port and listen for incoming connection"}],"sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops a Windows setup information (INF) file"},{"type":"informative","value":"Contains ability to download files with network (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains ability to communicate with network (Dotnet)"},{"type":"informative","value":"Contains ability to provide interface for network protocols (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate via sockets (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Able to retrieve/open a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains ability to perform encryption (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to find a resource in a module","description":"\"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\" called \"FindResourceW\" with parameter \"789\" - (UID: 00000000-00001804)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to load a resource in memory","description":"\"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\" called \"LoadResource with parameter {'hModule': '137428992', 'hResInfo': '137437312'}\" (UID: 00000000-00001804)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to decompress content at runtime","description":"Observed function \"System.IO.Compression.GZipStream\" in \"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\"\n Observed function \"System.IO.Compression.GZipStream\" in \"a60b4c9bb474e5da8291e6d7cc11751e.exe\"","origin":"Static Parser","mitre_attack_id":"T1560.002","relevance":1,"id":"static-116","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load content into memory (Dotnet)","description":"$25","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-107","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00006896.00000000.168403.02810000.00000004.mdmp, 00000000-00006896.00000001.170322.02810000.00000004.mdmp, 00000000-00006896.00000002.172242.02810000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00006896.00000000.168403.04D60000.00000004.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00006896.00000000.168403.04D60000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"MD5CryptoServiceProvider\" (Indicator: \"MD5CryptoServiceProvider\"; File: \"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\")\n Found reference to \"HashAlgorithm\" (Indicator: \"HashAlgorithm\"; File: \"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\")\n file/memory contains long string with (Indicator: \"HashAlgorithm\"; File: \"a60b4c9bb474e5da8291e6d7cc11751e.exe\")\n file/memory contains long string with (Indicator: \"MD5CryptoServiceProvider\"; File: \"a60b4c9bb474e5da8291e6d7cc11751e.exe\")\n Found reference to \"MD5CryptoServiceProvider\" (Indicator: \"MD5CryptoServiceProvider\"; Source: \"00000000-00006896.00000000.168403.00132000.00000002.mdmp\")\n Found reference to \"HashAlgorithm\" (Indicator: \"HashAlgorithm\"; Source: \"00000000-00006896.00000000.168403.00132000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Dotnet code contains potential unpacker","description":"Observed function \"System.Reflection.Load\" in \"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\"\n Observed function \"System.Reflection.Load\" in \"a60b4c9bb474e5da8291e6d7cc11751e.exe\"","origin":"Static Parser","mitre_attack_id":"T1620","relevance":1,"id":"static-115","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Dotnet file contains function to dynamically call methods at runtime","description":"Observed namespace \"Microsoft.VisualBasic.CompilerServices\" and MemberReference \"LateCall\" in \"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\"\n Observed namespace \"Microsoft.VisualBasic.CompilerServices\" and MemberReference \"LateCall\" in \"a60b4c9bb474e5da8291e6d7cc11751e.exe\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":1,"id":"static-135","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to block user input (API string)","description":"Found reference to API \"apiBlockInput\" (Indicator: \"BlockInput\"; File: \"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\")\n Found reference to API \"BlockInput\" (Indicator: \"BlockInput\"; File: \"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\")\n Found reference to API \"apiBlockInput\" (Indicator: \"BlockInput\"; Source: \"00000000-00006896.00000000.168403.00132000.00000002.mdmp\")\n Found reference to API \"BlockInput\" (Indicator: \"BlockInput\"; Source: \"00000000-00006896.00000000.168403.00132000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-547","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; File: \"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\")\n file/memory contains long string with (Indicator: \"FromBase64String\"; File: \"a60b4c9bb474e5da8291e6d7cc11751e.exe\")\n Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"00000000-00006896.00000000.168403.00132000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode string content at runtime (Dotnet)","description":"Observed function \"FromBase64String\" in \"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\"\n Observed function \"ToBase64String\" in \"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\"\n Observed function \"FromBase64String\" in \"a60b4c9bb474e5da8291e6d7cc11751e.exe\"\n Observed function \"ToBase64String\" in \"a60b4c9bb474e5da8291e6d7cc11751e.exe\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-106","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform crypto operations","description":"Observed namespace \"System.Security.Cryptography\" in [Source: \"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\"]\n Observed namespace \"System.Security.Cryptography\" in [Source: \"a60b4c9bb474e5da8291e6d7cc11751e.exe\"]","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-118","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"file/memory contains long string with (Indicator: \"CryptProtectData\"; Source: \"00000000-00006896.00000000.168403.04D60000.00000004.mdmp\")\n Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00006896.00000000.168403.04D60000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.376604247896153","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data\n Matched sigs: Contains ability to perform Base64 encoding/decoding","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains ability to decode base64 data\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains ability to perform encryption (API string)\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)\n Matched sigs: Contains ability to decode string content at runtime (Dotnet)\n Matched sigs: Contains ability to perform crypto operations","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify sandbox environment running process","description":"Found string \"VGAuthService.exe\" (Indicator: \"VGAuthService.exe\"; Source: \"00000000-00006896.00000001.170322.02B10000.00000004.mdmp\")\n Found string \"vmtoolsd.exe\" (Indicator: \"vmtoolsd.exe\"; Source: \"00000000-00006896.00000001.170322.02B10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-666","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006896-00000C29-1636899764\")\n Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006896-00000C29-1636899812\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$26","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\" called \"GetForegroundWindow\" (UID: 00000000-00001804)\n \"Cat probiv.exe\" called \"GetForegroundWindow\" (UID: 00000000-00006896)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\" called \"IsWow64Process\" with parameter \"1804\" - (UID: 00000000-00001804)\n \"Cat probiv.exe\" called \"IsWow64Process\" with parameter \"6896\" - (UID: 00000000-00006896)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"Cat probiv.exe\" called \"GetWindowTextA\" (UID: 00000000-00006896)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00001804)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$27","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\" called \"OpenMutexW\" with parameter \"Global\\CLR_CASOFF_MUTEX\" - (UID: 00000000-00001804)\n \"Cat probiv.exe\" called \"OpenMutexW\" with parameter \"Global\\CLR_CASOFF_MUTEX\" - (UID: 00000000-00006896)\n \"Cat probiv.exe\" called \"OpenMutexW\" with parameter \"Global\\.net clr networking\" - (UID: 00000000-00006896)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$28","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\" called \"GetLocaleInfoW\" with parameter \"1024\" - (UID: 00000000-00001804)\n \"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00001804)\n \"Cat probiv.exe\" called \"GetLocaleInfoW\" with parameter \"1024\" - (UID: 00000000-00006896)\n \"Cat probiv.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00006896)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerates all mounted drives","description":"System.IO.Directory::GetLogicalDrives() at 304a913cde19525a4718187163380640-6000031-OK~INS","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-66","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to gather system information (Dotnet)","description":"Observed function \"get_MachineName\" in \"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\"\n Observed function \"get_UserName\" in \"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\"\n Observed function \"get_OSVersion\" in \"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\"\n Observed function \"get_MachineName\" in \"a60b4c9bb474e5da8291e6d7cc11751e.exe\"\n Observed function \"get_UserName\" in \"a60b4c9bb474e5da8291e6d7cc11751e.exe\"\n Observed function \"get_OSVersion\" in \"a60b4c9bb474e5da8291e6d7cc11751e.exe\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":1,"id":"static-120","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to get active window titles (Dotnet)","description":"Observed Namespace \"System.Diagnostics.Process\" and MemberReference \"get_MainWindowTitle\" in \"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\"\n Observed Namespace \"System.Diagnostics.Process\" and MemberReference \"get_MainWindowTitle\" in \"a60b4c9bb474e5da8291e6d7cc11751e.exe\"","origin":"Static Parser","mitre_attack_id":"T1010","relevance":1,"id":"static-148","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"Cat probiv.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"Cat probiv.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"Found string \"set CDAudio door open\" (Indicator: \"set \"; File: \"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\")\n Found string \"set CDAudio door closed\" (Indicator: \"set \"; File: \"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language","description":"w.kl::GetKeyboardLayout(System.Int32) at 304a913cde19525a4718187163380640-6000047-kl~VKCodeToUnicode","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614.001","relevance":3,"id":"stream-79","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language (API string)","description":"Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; File: \"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\")\n Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; Source: \"00000000-00006896.00000000.168403.00132000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"GetVolumeInformation\" (Indicator: \"GetVolumeInformation\"; File: \"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\")\n Found reference to API \"GetVolumeInformationA\" (Indicator: \"GetVolumeInformation\"; File: \"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\")\n Found reference to API \"GetVolumeInformation\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00006896.00000000.168403.00132000.00000002.mdmp\")\n Found reference to API \"GetVolumeInformationA\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00006896.00000000.168403.00132000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"Cat probiv.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CAT PROBIV.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET TA_ABUSED_SERVICES Tunneling Service in DNS Lookup (* .ply .gg)\" (SID: 2054989, Rev: 1, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"General","name":"Calls an API typically used to copy file from one location to another","description":"\"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\" called \"CopyFileW\" to copy C:\\d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe to new location %ALLUSERSPROFILE%\\Cat probiv.exe (UID: 00000000-00001804)\n \"Cat probiv.exe\" called \"CopyFileW\" to copy %ALLUSERSPROFILE%\\Cat probiv.exe to new location %APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\a60b4c9bb474e5da8291e6d7cc11751e.exe (UID: 00000000-00006896)\n \"Cat probiv.exe\" called \"CopyFileW\" to copy %ALLUSERSPROFILE%\\Cat probiv.exe to new location C:\\Cat probiv.exe.exe (UID: 00000000-00006896)\n \"Cat probiv.exe\" called \"CopyFileW\" to copy %ALLUSERSPROFILE%\\Cat probiv.exe to new location Z:\\Cat probiv.exe.exe (UID: 00000000-00006896)","origin":"API Call","mitre_attack_id":"T1005","relevance":3,"id":"api-123","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\Microsoft\\CLR_v2.0_32 (UID: 00000000-00001804)\n \"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\Microsoft\\CLR_v2.0_32\\UsageLogs (UID: 00000000-00001804)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\" called \"CreateProcessW\" with parameter \"\"%ALLUSERSPROFILE%\\Cat probiv.exe\"\" - (UID: 00000000-00001804)\n \"Cat probiv.exe\" called \"CreateProcessW\" with parameter \"netsh firewall add allowedprogram \"%ALLUSERSPROFILE%\\Cat probiv.exe\" \"Cat probiv.exe\" ENABLE\" - (UID: 00000000-00006896)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2a","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2b","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"147.185.221.18:29246\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"General","name":"Contains ability to download files with network (Dotnet)","description":"Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadFile\" in \"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadData\" in \"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadFile\" in \"a60b4c9bb474e5da8291e6d7cc11751e.exe\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadData\" in \"a60b4c9bb474e5da8291e6d7cc11751e.exe\"","origin":"Static Parser","mitre_attack_id":"T1105","relevance":1,"id":"static-99","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"General","name":"Contains ability to set file attributes (Dotnet)","description":"Observed Namespace \"System.IO.File\" and MemberReference \"SetAttributes\" in \"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\"\n Observed Namespace \"System.IO.File\" and MemberReference \"SetAttributes\" in \"a60b4c9bb474e5da8291e6d7cc11751e.exe\"","origin":"Static Parser","mitre_attack_id":"T1222","relevance":1,"id":"static-155","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; File: \"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00006896.00000000.168403.00132000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"General","name":"Contains ability to start a process (Dotnet)","description":"Observed function \"Process.Start\" in \"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\"\n Observed function \"Process.Start\" in \"a60b4c9bb474e5da8291e6d7cc11751e.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-111","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"General","name":"Contains reference to Windows Startup folder","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-265","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\SM0:1804:168:WilStaging_02\"\n \"SM0:1804:64:WilError_01\"\n \"a60b4c9bb474e5da8291e6d7cc11751e\"\n \"SM0:1804:168:WilStaging_02\"\n \"Local\\SM0:1804:64:WilError_01\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\SM0:6896:168:WilStaging_02\"\n \"SM0:6896:64:WilError_01\"\n \"SM0:6896:168:WilStaging_02\"\n \"Global\\.net clr networking\"","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"General","name":"Dotnet code contains ability to modify/delete registry","description":"$2f","origin":"Static Parser","mitre_attack_id":"T1112","relevance":1,"id":"static-139","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"General","name":"Dotnet code contains ability to query registry","description":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"OpenSubKey\" in \"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"GetValue\" in \"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"GetValueNames\" in \"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"OpenSubKey\" in \"a60b4c9bb474e5da8291e6d7cc11751e.exe\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"GetValue\" in \"a60b4c9bb474e5da8291e6d7cc11751e.exe\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"GetValueNames\" in \"a60b4c9bb474e5da8291e6d7cc11751e.exe\"","origin":"Static Parser","mitre_attack_id":"T1012","relevance":1,"id":"static-138","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"General","name":"Dotnet source code contains suspicious native API","description":"Observed API \"GetAsyncKeyState\" in \"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\"\n Observed API \"MapVirtualKey\" in \"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\"\n Observed API \"GetAsyncKeyState\" in \"a60b4c9bb474e5da8291e6d7cc11751e.exe\"\n Observed API \"MapVirtualKey\" in \"a60b4c9bb474e5da8291e6d7cc11751e.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-126","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$30","origin":"API Call","mitre_attack_id":"T1574.002","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"a60b4c9bb474e5da8291e6d7cc11751e.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"General","name":"Found Native API in Dotnet file","description":"$31","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-101","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$32","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\7aa13700a6fcdcb57e6cb353e54d0ab9\\mscorlib.ni.dll\" at 722F0000\n \"Cat probiv.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\7aa13700a6fcdcb57e6cb353e54d0ab9\\mscorlib.ni.dll\" at 722F0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 77150000\n \"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73830000\n \"Cat probiv.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 77150000\n \"Cat probiv.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73830000\n \"netsh.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 77150000\n \"netsh.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73830000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75990000\n \"Cat probiv.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75990000\n \"netsh.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75990000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\" was detected as \".NET\" and name: \"Library\"\n \"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\" was detected as \"VB.NET\" and name: \"Compiler\"\n \"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"a60b4c9bb474e5da8291e6d7cc11751e.exe\" was detected as \".NET\" and name: \"Library\"\n \"a60b4c9bb474e5da8291e6d7cc11751e.exe\" was detected as \"VB.NET\" and name: \"Compiler\"\n \"a60b4c9bb474e5da8291e6d7cc11751e.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$33","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"\n \"a60b4c9bb474e5da8291e6d7cc11751e.exe\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","relevance":1,"id":"static-144","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\" has an executable section named \".text\"\n \"a60b4c9bb474e5da8291e6d7cc11751e.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$34","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\SysWOW64\\netsh.exe\" [Source: 00000000-00006896-00000BC0-1635997470]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"Cat probiv.exe\" (UID: 00000000-00006896) was launched with new environment variables: \"USERDNSDOMAIN=\"DESKTOP-FVVF82A\", PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"Cat probiv.exe\" (UID: 00000000-00006896) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"photography-ringtones.gl.at.ply.gg\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"Cat probiv.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"Cat probiv.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"Cat probiv.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"Cat probiv.exe\" (UID: 00000000-00006896)\n Spawned process \"netsh.exe\" with commandline \"netsh firewall add allowedprogram \"%ALLUSERSPROFILE%\\\\Cat probiv ...\" (UID: 00000000-00003860)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"Cat probiv.exe\" (UID: 00000000-00006896)\n Spawned process \"netsh.exe\" with commandline \"netsh firewall add allowedprogram \"%ALLUSERSPROFILE%\\\\Cat probiv ...\" (UID: 00000000-00003860)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"a60b4c9bb474e5da8291e6d7cc11751e.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"Cat probiv.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$36","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops a Windows setup information (INF) file","description":"\"autorun.inf\" has type \"Microsoft Windows Autorun file\"","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-55","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$37","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\" queries basic process information of the \"C:\\d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\" (UID: 1804)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$38","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$39","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Able to identify sandbox environment running process\n Matched sigs: Possibly tries to evade analysis by sleeping many times","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$3a","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"Cat probiv.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\a60b4c9bb474e5da8291e6d7cc11751e.exe\"\n \"Cat probiv.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\a60b4c9bb474e5da8291e6d7cc11751e.exe:Zone.Identifier\"\n \"Cat probiv.exe\" touched file \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\a60b4c9bb474e5da8291e6d7cc11751e.exe\"\n \"Cat probiv.exe\" touched file \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\a60b4c9bb474e5da8291e6d7cc11751e.exe:Zone.Identifier\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$3b","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$3c","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"$3d","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\CLR_v2.0_32\\UsageLogs\\d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe.log\"\n \"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\" writes a file \"%LOCALAPPDATA%\\Microsoft\\CLR_v2.0_32\\UsageLogs\\d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe.log\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate via sockets (Dotnet)","description":"$3e","origin":"Static Parser","mitre_attack_id":"T1095","relevance":1,"id":"static-159","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00006896-00000C29-1636881371\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (Dotnet)","description":"Observed Namespace \"System.Net.WebClient\" and MemberReference \".ctor\" in \"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadFile\" in \"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadData\" in \"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \".ctor\" in \"a60b4c9bb474e5da8291e6d7cc11751e.exe\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadFile\" in \"a60b4c9bb474e5da8291e6d7cc11751e.exe\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadData\" in \"a60b4c9bb474e5da8291e6d7cc11751e.exe\"","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-158","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicates via socket (possible C&C communication)","description":"Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"set_ReceiveTimeout\" in \"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\"\n Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"Receive\" in \"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\"\n Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"set_ReceiveTimeout\" in \"a60b4c9bb474e5da8291e6d7cc11751e.exe\"\n Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"Receive\" in \"a60b4c9bb474e5da8291e6d7cc11751e.exe\"","origin":"Static Parser","mitre_attack_id":"T1071","relevance":1,"id":"static-151","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"Network Related","name":"Contains ability to provide interface for network protocols (Dotnet)","description":"Observed namespace \"System.Net.Sockets\" in \"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\"\n Observed namespace \"System.Net\" in \"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\"\n Observed namespace \"System.Net.Sockets\" in \"a60b4c9bb474e5da8291e6d7cc11751e.exe\"","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-110","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"Network Related","name":"Detects NETSH process execution","description":"Process \"netsh.exe\" with commandline \"netsh firewall add allowedprogram \"%ALLUSERSPROFILE%\\\\Cat probiv.exe\" \"Cat probiv.exe\" ENABLE\" (UID: 00000000-00003860)","origin":"Monitored Target","mitre_attack_id":"T1562.004","relevance":2,"id":"target-186","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$40","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e\n Observed JA3 fingerprint: bd0bf25947d4a37404f0424edf4db9ad","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://dl.dropbox.com\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$41","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"Cat probiv.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"Cat probiv.exe\" called \"GetComputerNameW\" (UID: 00000000-00006896)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$42","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$43","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen information (Dotnet)","description":"Observed Namespace \"System.Windows.Forms::Screen\" and MemberReference \"get_PrimaryScreen\" in \"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\"\n Observed Namespace \"Microsoft.VisualBasic.Devices::Computer\" and MemberReference \"get_Keyboard\" in \"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\"\n Observed Namespace \"System.Windows.Forms::Screen\" and MemberReference \"get_PrimaryScreen\" in \"a60b4c9bb474e5da8291e6d7cc11751e.exe\"\n Observed Namespace \"Microsoft.VisualBasic.Devices::Computer\" and MemberReference \"get_Keyboard\" in \"a60b4c9bb474e5da8291e6d7cc11751e.exe\"","origin":"Static Parser","mitre_attack_id":"T1113","relevance":1,"id":"static-164","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screenshot","description":"Observed function \"System.Drawing.CopyFromScreen\" in \"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\"\n Observed function \"System.Drawing.CopyFromScreen\" in \"a60b4c9bb474e5da8291e6d7cc11751e.exe\"","origin":"Static Parser","mitre_attack_id":"T1113","relevance":1,"id":"static-113","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; File: \"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\")\n Found reference to API \"GetProcessById\" (Indicator: \"GetProcessById\"; File: \"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\")\n Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00006896.00000000.168403.00132000.00000002.mdmp\")\n Found reference to API \"GetProcessById\" (Indicator: \"GetProcessById\"; Source: \"00000000-00006896.00000000.168403.00132000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to find logical drives of the machine (API string)","description":"Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; File: \"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\")\n Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00006896.00000000.168403.00132000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-84","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to gather process details (Dotnet)","description":"Observed function \"GetProcessById\" in \"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\"\n Observed function \"get_ProcessName\" in \"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\"\n Observed function \"GetProcessById\" in \"a60b4c9bb474e5da8291e6d7cc11751e.exe\"\n Observed function \"get_ProcessName\" in \"a60b4c9bb474e5da8291e6d7cc11751e.exe\"","origin":"Static Parser","mitre_attack_id":"T1057","relevance":1,"id":"static-100","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetTempPath\" (Indicator: \"GetTempPath\"; File: \"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\")\n Found reference to API \"GetTempFileName\" (Indicator: \"GetTempFileName\"; File: \"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\")\n Found reference to API \"GetTempPath\" (Indicator: \"GetTempPath\"; Source: \"00000000-00006896.00000000.168403.00132000.00000002.mdmp\")\n Found reference to API \"GetTempFileName\" (Indicator: \"GetTempFileName\"; Source: \"00000000-00006896.00000000.168403.00132000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about pressed keystrokes (API string)","description":"$44","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"applicationName=\"/\" requiresUniqueEmail=\"false\" passwordFormat=\"Hashed\" maxInvalidPasswordAttempts=\"5\" minRequiredPasswordLength=\"7\" minRequiredNonalphanumericCharacters=\"1\" passwordAttemptWindow=\"10\" passwordStrengthRegularExpression=\"\"/>\" (Indicator: \"password\"; Source: \"00000000-00006896.00000000.168403.04D60000.00000004.mdmp\")\n Found string \"passwordFormat\" (Indicator: \"password\"; Source: \"00000000-00006896.00000000.168403.04D60000.00000004.mdmp\")\n Found string \"passwordAttemptWindow\" (Indicator: \"password\"; Source: \"00000000-00006896.00000000.168403.04D60000.00000004.mdmp\")\n Found string \"passwordStrengthRegularExpression\" (Indicator: \"password\"; Source: \"00000000-00006896.00000000.168403.04D60000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"password\"; Source: \"00000000-00006896.00000000.168403.04D60000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00001804-00000C29-1631097496\")\n Found string \"OpenProcessTokenW\" (Indicator: \"OpenProcess\"; Source: \"00000000-00006896-00000C29-1636318004\")\n Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00006896-00000C29-1636318951\")\n Found string \"OpenProcessW\" (Indicator: \"OpenProcess\"; Source: \"00000000-00006896-00000C29-1636319040\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"Cat probiv.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00006896)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00006896.00000000.168403.02810000.00000004.mdmp, 00000000-00006896.00000001.170322.02810000.00000004.mdmp, 00000000-00006896.00000002.172242.02810000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00006896.00000000.168403.04D60000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown -s -t 00\" (Indicator: \"shutdown \") in Source: d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\n Observed string: \"shutdown -r -t 00\" (Indicator: \"shutdown \") in Source: d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\n Observed string: \"shutdown -l -t 00\" (Indicator: \"shutdown \") in Source: d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\n Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00006896-00000C29-1658476512","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"Cat probiv.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$45","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to multiple windows system processes","description":"Found strings \"smss.exe,csrss.exe,wininit.exe,winlogon.exe,services.exe\" (Source: \"00000000-00006896.00000001.170322.02B10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":3,"id":"string-455","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"a60b4c9bb474e5da8291e6d7cc11751e.exe\" - Location: [%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\a60b4c9bb474e5da8291e6d7cc11751e.exe]- [targetUID: 00000000-00006896]\n Dropped file: \"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe.log\" - Location: [%LOCALAPPDATA%\\Microsoft\\CLR_v2.0_32\\UsageLogs\\d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe.log]- [targetUID: 00000000-00001804]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"\n \"a60b4c9bb474e5da8291e6d7cc11751e.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"\"RuntimeBroker.exe\" (Indicator: \"runtimebroker.exe\")","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"Cat probiv.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\" has section name .rsrc with entropy \"7.465873168470856\"\n \"a60b4c9bb474e5da8291e6d7cc11751e.exe\" has section name .rsrc with entropy \"7.465873168470856\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Calls an API typically used to acquire handle to a key container within a CSP","description":"\"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\" called \"CryptAcquireContextA\" with parameters {\"phProv\": \"`c%\"\n \"dwProvType\": \"1\"\n \"dwFlags\": \"4026531840\"}","origin":"API Call","mitre_attack_id":"T1027","relevance":1,"id":"api-228","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Dropped file has high entropy (likely encrypted/compressed content)","description":"Dropped file \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\a60b4c9bb474e5da8291e6d7cc11751e.exe\" has high entropy 7.376604247896153\n Dropped file \"%ALLUSERSPROFILE%\\Cat probiv.exe\" has high entropy 7.376604247896153\n Dropped file \"C:\\Cat probiv.exe.exe\" has high entropy 7.376604247896153","origin":"Binary File","mitre_attack_id":"T1027","relevance":5,"id":"binary-60","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to evade analysis by sleeping many times","description":"\"Cat probiv.exe\" (Thread ID: 3020) slept \"525\" times (threshold: 500)","origin":"API Call","mitre_attack_id":"T1497.003","relevance":10,"id":"api-47","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"suspicious","category":"General","name":"PE file has unusual entropy resources","description":"\"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\" has resource with unusual entropy \"RT_ICON:7.9892005588700865\"\n \"a60b4c9bb474e5da8291e6d7cc11751e.exe\" has resource with unusual entropy \"RT_ICON:7.9892005588700865\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":5,"id":"static-92","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\" reads file \"C:\\Users\\%OSUSER%\\Documents\\desktop.ini\"\n \"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\" reads file \"C:\\Users\\%OSUSER%\\Music\\desktop.ini\"\n \"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\" reads file \"C:\\Users\\%OSUSER%\\Pictures\\desktop.ini\"\n \"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\" reads file \"C:\\Users\\%OSUSER%\\Videos\\desktop.ini\"\n \"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\" reads file \"C:\\Users\\%OSUSER%\\Downloads\\desktop.ini\"\n \"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\" reads file \"C:\\Users\\%OSUSER%\\OneDrive\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"a60b4c9bb474e5da8291e6d7cc11751e.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"- Location: [%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\a60b4c9bb474e5da8291e6d7cc11751e.exe]- [targetUID: 00000000-00006896]\n \"Cat probiv.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"- Location: [%ALLUSERSPROFILE%\\Cat probiv.exe]- [targetUID: 00000000-00006896]\n \"Cat probiv.exe.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"- Location: [C:\\Cat probiv.exe.exe]- [targetUID: 00000000-00006896]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"Cat probiv.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"A60B4C9BB474E5DA8291E6D7CC11751E\"; Value: \"\"%ALLUSERSPROFILE%\\Cat probiv.exe\" ..\")\n \"Cat probiv.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"A60B4C9BB474E5DA8291E6D7CC11751E\"; Value: \"\"%ALLUSERSPROFILE%\\Cat probiv.exe\" ..\")","origin":"Registry Access","mitre_attack_id":"T1547.001","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection","description":"System.Net.Sockets.TcpClient::get_Client() at 304a913cde19525a4718187163380640-600003a-OK~Sendb\n System.Net.Sockets.TcpClient::Close() at 304a913cde19525a4718187163380640-6000020-OK~connect\n Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateCall(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[],System.Boolean) at 304a913cde19525a4718187163380640-600002f-OK~Ind\n Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateCall(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[],System.Boolean) at 304a913cde19525a4718187163380640-6000037-OK~RC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1571","relevance":5,"id":"stream-85","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"suspicious","category":"Network Related","name":"Possible high-risk domain detected","description":"Domain: \"photography-ringtones.gl.at.ply.gg\" possible high risk indicator","origin":"Network Traffic","mitre_attack_id":"T1566","relevance":5,"id":"network-84","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"suspicious","category":"Network Related","name":"Spawned process connects to a network","description":"Process \"%ALLUSERSPROFILE%\\Cat probiv.exe\" connects to 147.185.221.18 on port 29246 (TCP); Domain: \"photography-ringtones.gl.at.ply.gg\"","origin":"Monitored Target","mitre_attack_id":"T1071","relevance":5,"id":"target-412","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"suspicious","category":"Network Related","name":"Spawned processes likely due to injection","description":"Process \"%ALLUSERSPROFILE%\\Cat probiv.exe\" spawned likely due to injection","origin":"Monitored Target","mitre_attack_id":"T1055","relevance":3,"id":"target-413","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"WmiPrvSE.exe\" (Indicator: \"wmiprvse.exe\"; in Source: \"00000000-00006896.00000001.170322.02B10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used for keylogging","description":"\"Cat probiv.exe\" called \"GetAsyncKeyState\" with parameters {\"vKey\": \"0\"}\n \"Cat probiv.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"16\"}\n \"Cat probiv.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"17\"}\n \"Cat probiv.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"18\"}\n \"Cat probiv.exe\" called \"GetAsyncKeyState\" with parameters {\"vKey\": \"1\"}\n \"Cat probiv.exe\" called \"GetAsyncKeyState\" with parameters {\"vKey\": \"2\"}\n \"Cat probiv.exe\" called \"GetAsyncKeyState\" with parameters {\"vKey\": \"3\"}\n \"Cat probiv.exe\" called \"GetAsyncKeyState\" with parameters {\"vKey\": \"4\"}\n \"Cat probiv.exe\" called \"GetAsyncKeyState\" with parameters {\"vKey\": \"5\"}\n \"Cat probiv.exe\" called \"GetAsyncKeyState\" with parameters {\"vKey\": \"6\"}","origin":"API Call","mitre_attack_id":"T1056.001","relevance":10,"id":"api-40","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to find and list the Windows drive types","description":"\"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00001804)\n \"Cat probiv.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00006896)","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-110","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"System.Diagnostics.Process::GetProcessById(System.Int32) at 304a913cde19525a4718187163380640-600003f-kl~AV\n System.Diagnostics.Process::GetProcessById(System.Int32) at 304a913cde19525a4718187163380640-6000053-mgr~protect","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve keyboard strokes","description":"w.kl::GetAsyncKeyState(System.Int32) at 304a913cde19525a4718187163380640-6000048-kl~WRK\n w.kl::GetKeyboardState(System.Byte[]) at 304a913cde19525a4718187163380640-6000047-kl~VKCodeToUnicode","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1056.001","relevance":8,"id":"stream-12","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found system commands related strings","description":"Found string \"taskkill /F /IM PING.EXE\" (Indicator: \"ping.exe\"; File: \"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\")\n Found string \"cmd.exe /k ping 0 & del \"\" (Indicator: \"ping\"; File: \"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\"), Found string \"cmd.exe /k ping 0 & del \\\"\" (Indicator: \"ping\"; File: \"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\")\n Found string \"askkill /F /IM PING.EXE\" (Indicator: \"ping.exe\"; Source: \"00000000-00006896.00000000.168403.00132000.00000002.mdmp\")\n Found string \"md.exe /k ping 0 & del \"\" (Indicator: \"ping\"; Source: \"00000000-00006896.00000000.168403.00132000.00000002.mdmp\"), Found string \"hostname\" (Indicator: \"hostname\"; Source: \"00000000-00006896.00000000.168403.04D60000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"Cat probiv.exe\" marked \"C:\\share\\Cat probiv.exe.exe\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\" opened \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\SECURITY.CONFIG.CCH.1804.908957984\" with delete access\n \"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\" opened \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\ENTERPRISESEC.CONFIG.CCH.1804.908957984\" with delete access\n \"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\CLR SECURITY CONFIG\\V2.0.50727.312\\SECURITY.CONFIG.CCH.1804.908958171\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\" called \"CreateProcessW\" with parameter \"\"%ALLUSERSPROFILE%\\Cat probiv.exe\"\" - (UID: 00000000-00001804)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"15/19 Antivirus vendors marked dropped file \"a60b4c9bb474e5da8291e6d7cc11751e.exe\" as malicious (classified as \"Packed.Bladabindi\" with 78% detection rate)\n 15/19 Antivirus vendors marked dropped file \"Cat probiv.exe\" as malicious (classified as \"Packed.Bladabindi\" with 78% detection rate)\n 15/19 Antivirus vendors marked dropped file \"Cat probiv.exe.exe\" as malicious (classified as \"Packed.Bladabindi\" with 78% detection rate)","origin":"Binary File","mitre_attack_id":"T1204.002","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"15/19 Antivirus vendors marked spawned process \"Cat probiv.exe\" (PID: 6896) as malicious (classified as \"Packed.Bladabindi\" with 78% detection rate)","origin":"Monitored Target","mitre_attack_id":"T1204.002","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"malicious","category":"Installation/Persistence","name":"Drops a Windows autorun file","description":"\"autorun.inf\" has type \"Microsoft Windows Autorun file\"","origin":"Binary File","mitre_attack_id":"T1091","relevance":5,"id":"binary-6","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"malicious","category":"Installation/Persistence","name":"Drops executable files to the application program directory (%ProgramData%)","description":"File type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\" was dropped at \"%ALLUSERSPROFILE%\\Cat probiv.exe\"","origin":"Binary File","mitre_attack_id":"T1036","relevance":7,"id":"binary-27","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe\" wrote 00000004 bytes to a remote process \"C:\\ProgramData\\Cat probiv.exe\" (Handle: 1432)\n \"Cat probiv.exe\" wrote 00000004 bytes to a remote process \"C:\\Windows\\SysWOW64\\netsh.exe\" (Handle: 832)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 147.185.221.18 on port 29246","origin":"Network Traffic","mitre_attack_id":"T1571","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"$46","origin":"YARA Signature","relevance":9,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Contains ability to capture the screen","description":"System.Drawing.Graphics::CopyFromScreen(System.Int32,System.Int32,System.Int32,System.Int32,System.Drawing.Size,System.Drawing.CopyPixelOperation) at 304a913cde19525a4718187163380640-600002f-OK~Ind","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1113","relevance":3,"id":"stream-72","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"level":"malicious","category":"System Security","name":"Modifies firewall settings","description":"Process \"netsh.exe\" with commandline \"netsh firewall add allowedprogram \"%ALLUSERSPROFILE%\\\\Cat probiv.exe\" \"Cat probiv.exe\" ENABLE\" (UID: 00000000-00003860)","origin":"Monitored Target","mitre_attack_id":"T1562.004","relevance":8,"id":"target-15","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"name":"Persistence","details_count":5,"details":[{"detail":"Writes data to a remote process"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Modifies firewall settings"},{"detail":"Writes a file to the startup folder"},{"detail":"Drops executable files to the application program directory (%ProgramData%)"}],"sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"name":"Fingerprint","details_count":4,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Queries sensitive IE security settings"},{"detail":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Marks file for deletion"},{"detail":"Possibly tries to evade analysis by sleeping many times"}],"sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]}]},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":11,"imported_dlls_count":139,"dropped_files_count":0,"extracted_files_count":8,"files_written_count":13,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["commodity","targetedcrimeware","spynote","ddos","targeted","redlinestealer","xworm","criminal","mobilemalware","asyncrat","warzone","modular","rat","backdoor","remcos","njrat","meterpreter","darkcomet","informationstealer","xenorat","deploymentframework","proxy","loda","ahmyth","keylogger","metasploit","quasar","credentialharvesting","njratlime","opensource","exploit","ransomware","downloader","windows-server-utility"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","Launch Failed","User Comment"],"sandbox_reports":[{"id":"67ce642566aa95675a0dbabf","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["USA"],"submit_name":"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe","analysis_start_time":"2025-03-10T04:01:41+00:00","indicators_count":{"informative":128,"suspicious":43,"malicious":11},"tags":["Multi-Process","Network Traffic","Extracted Files","Launch Failed","User Comment"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"147.185.221.18","port":29246,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]}],"dns_resolutions":[{"domain":"photography-ringtones.gl.at.ply.gg","address":"147.185.221.18","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}],"processes":[{"pid":1804,"ppid":0,"name":"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe","command_line":"","sha256":"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5","normalized_path":"C:\\d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe","uid":"00000000-00001804","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":6896,"ppid":1804,"name":"Cat probiv.exe","command_line":"","sha256":"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5","normalized_path":"%ALLUSERSPROFILE%\\Cat probiv.exe","parent_uid":"00000000-00001804","uid":"00000000-00006896"},{"pid":3860,"ppid":6896,"name":"netsh.exe","command_line":"netsh firewall add allowedprogram \"%ALLUSERSPROFILE%\\Cat probiv.exe\" \"Cat probiv.exe\" ENABLE","sha256":"6b22dd9817e7fb63d45f675c08121d7051ed626efe65304603de8bf4b93b32cb","normalized_path":"%WINDIR%\\SysWOW64\\netsh.exe","parent_uid":"00000000-00006896","uid":"00000000-00003860"}],"all_imported_dlls":["mscoree.dll","advapi32.dll","aepic.dll","msvcp90.dll","iertutil.dll","kernel32.dll","ncrypt.dll","mscoreei.dll","msIso.dll","rasapi32.dll","adsldpc.dll","P2P.dll","rpcnsh.dll","ws2_32.dll","cfgmgr32.dll","mprapi.dll","wcmapi.dll","user32.dll","cryptbase.dll","edputil.dll","msctf.dll","atl.dll","win32u.dll","version.dll","ntdll.dll","mscorwks.dll","shell32.dll","Microsoft.VisualBasic.ni.dll","msasn1.dll","mdmregistration.dll","imm32.dll","eappcfg.dll","winipsec.dll","apphelp.dll","sspicli.dll","rasadhlp.dll","ntasn1.dll","netshell.dll","nlaapi.dll","devobj.dll","rpcrt4.dll","urlmon.dll","ole32.dll","ntmarta.dll","authfwcfg.dll","hnetmon.dll","wlanapi.dll","slc.dll","combase.dll","imagehlp.dll","nsi.dll","fwcfg.dll","crypt32.dll","ktmw32.dll","msvcp_win.dll","httpapi.dll","Wldap32.dll","sechost.dll","bcrypt.dll","Windows.StateRepositoryPS.dll","FirewallAPI.dll","dhcpcmonitor.dll","dot3cfg.dll","KernelBase.dll","mfc42u.dll","polstore.dll","p2pnetsh.dll","gpapi.dll","mscorjit.dll","msvcp110_win.dll","wow64cpu.dll","fltLib.dll","System.Configuration.ni.dll","ifmon.dll","winnsi.dll","nshhttp.dll","mprmsg.dll","nshipsec.dll","userenv.dll","cryptsp.dll","System.Drawing.ni.dll","rsaenh.dll","mswsock.dll","FWPUCLNT.DLL","bcryptprimitives.dll","msvcrt.dll","SHCore.dll","clbcatq.dll","rasman.dll","wlancfg.dll","WiFiDisplay.dll","dwmapi.dll","onex.dll","eappprxy.dll","cabinet.dll","wevtapi.dll","sppc.dll","oleaut32.dll","System.Windows.Forms.ni.dll","gdi32.dll","shlwapi.dll","cldapi.dll","System.Xml.ni.dll","shfolder.dll","nshwfp.dll","windows.storage.dll","fwbase.dll","dot3api.dll","dmcmnutils.dll","rmclient.dll","mscorlib.ni.dll","GROOVEEX.DLL","dhcpcsvc.dll","whhelper.dll","netiohlp.dll","profapi.dll","msvcr90.dll","dnsapi.dll","rasmontr.dll","VxSSL32.dll","powrprof.dll","uxtheme.dll","ATL90.dll","winhttp.dll","gdi32full.dll","propsys.dll","psapi.dll","wshelper.dll","kernel.appcore.dll","fwpolicyiomgr.dll","PeerDistSh.dll","wow64.dll","wow64win.dll","msvcr80.dll","System.ni.dll","IPHLPAPI.DLL","dhcpcsvc6.dll","activeds.dll","ucrtbase.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"Cat probiv.exe","sha256":"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"name":"a60b4c9bb474e5da8291e6d7cc11751e.exe","sha256":"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"name":"Cat probiv.exe.exe","sha256":"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"name":"d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe.log","sha256":"228bfcdb6713a150acbf89c32feb4419cdc4e3acaf6b60641c0d6aa20da32a0d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"name":"autorun.inf","sha256":"f96a72764a15e15734a1598682a0755226929332f8535e633a791db219f34d48","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"name":"Cat probiv.exe.exe%3AZone.Identifier","sha256":"1409cc4125f7e08d09a731da789dc35c09afa8e716c00ad22d9f3f1b17a2cb33","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"name":"Cat probiv.exe%3AZone.Identifier","sha256":"1409cc4125f7e08d09a731da789dc35c09afa8e716c00ad22d9f3f1b17a2cb33","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"name":"a60b4c9bb474e5da8291e6d7cc11751e.exe%3AZone.Identifier","sha256":"1409cc4125f7e08d09a731da789dc35c09afa8e716c00ad22d9f3f1b17a2cb33","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]}],"files_written":[{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"path":"%ALLUSERSPROFILE%\\Cat probiv.exe","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"path":"%ALLUSERSPROFILE%\\Cat probiv.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\CLR_v2.0_32\\UsageLogs\\d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5.exe.log","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\a60b4c9bb474e5da8291e6d7cc11751e.exe","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\a60b4c9bb474e5da8291e6d7cc11751e.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"path":"C:\\Cat probiv.exe.exe","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"path":"C:\\Cat probiv.exe.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"path":"C:\\autorun.inf","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"path":"C:\\share\\Cat probiv.exe.exe","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"path":"C:\\share\\autorun.inf","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\FUSION\\GACCHANGENOTIFICATION\\DEFAULT\\","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"name":"Local\\SM0:1804:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"name":"SM0:1804:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"name":"a60b4c9bb474e5da8291e6d7cc11751e","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"name":"SM0:1804:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"name":"Local\\SM0:1804:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"name":"Local\\SM0:6896:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"name":"SM0:6896:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"name":"SM0:6896:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]},{"name":"Global\\.net clr networking","sources":[{"report_type":"sandbox","report_id":"67ce642566aa95675a0dbabf"}]}]}},"report_ids":{"sandbox_job_ids":["67ce642566aa95675a0dbabf"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Worm.Bladabindi Sample d31eb15e0889… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample d31eb15e0889…. Malware family: Worm.Bladabindi. Threat score 100/100. 19/24 AV engines flagged this file. 11 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5"}],["$","meta","4",{"property":"og:title","content":"Malicious Worm.Bladabindi Sample d31eb15e0889… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample d31eb15e0889…. Malware family: Worm.Bladabindi. Threat score 100/100. 19/24 AV engines flagged this file. 11 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/d31eb15e08897bf1d309d5940b50eb811ab4c2b9e7ab8baa41038167a73a0ca5"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Worm.Bladabindi Sample d31eb15e0889… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample d31eb15e0889…. Malware family: Worm.Bladabindi. Threat score 100/100. 19/24 AV engines flagged this file. 11 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L47","11",{}]]