26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 48:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T44d,{"@context":"https://schema.org","@type":"TechArticle","headline":"Clean Sample d4c14e034969… — Score 0/100 — Hybrid Analysis","description":"Clean verdict for sample d4c14e034969…. Threat score 0/100. 0/27 AV engines flagged this file. 1 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4","keywords":["Clean","malware analysis","sandbox report","threat intelligence","d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4"],"about":{"@type":"SoftwareApplication","name":"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4","applicationCategory":["peexe","assembly","executable"],"identifier":"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4","additionalType":"Clean sample"},"threatScore":0,"antivirusDetections":{"malicious":0,"total":27},"behavioralIndicators":{"malicious":1,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T9d1,Found reference to API "System.Runtime.InteropServices" (Indicator: "time"; Source: "sample.bin"), Found reference to API "TimeStamp" (Indicator: "time"; Source: "sample.bin"), Found reference to API "TimeStamp" (Indicator: "times"; Source: "sample.bin"), Found reference to API "set_CommandTimeout" (Indicator: "time"; Source: "sample.bin"), Found reference to API "UpdateHistoryCurrentStateInDB" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet" (Indicator: "read"; Source: "sample.bin"), Found reference to API "lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet" (Indicator: "time"; Source: "sample.bin"), Found reference to API "reader" (Indicator: "read"; Source: "sample.bin"), Found reference to API "s_strTIMEPrefix" (Indicator: "time"; Source: "sample.bin"), Found reference to API "IPStatus" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "CreateFile" (Indicator: "creat"; Source: "sample.bin"), Found reference to API "OnlineAccessDenied" (Indicator: "access"; Source: "sample.bin"), Found reference to API "time="" (Indicator: "time"; Source: "sample.bin"), Found reference to API "bConnectWMI" (Indicator: "connect"; Source: "sample.bin"), Found reference to API "ThreadPool" (Indicator: "read"; Source: "sample.bin"), Found reference to API "XmlTextReader" (Indicator: "read"; Source: "sample.bin"), Found reference to API "StreamReader" (Indicator: "read"; Source: "sample.bin"), Found reference to API "ExecuteReader" (Indicator: "read"; Source: "sample.bin"), Found reference to API "ThreadStart" (Indicator: "read"; Source: "sample.bin"), Found reference to API "hClientActivityThread" (Indicator: "read"; Source: "sample.bin"), Found reference to API "datetime" (Indicator: "time"; Source: "sample.bin"), Found reference to API "GetSqlConnection" (Indicator: "connect"; Source: "sample.bin"), Found reference to API "ServiceControllerStatus" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "RuntimeCompatibilityAttribute" (Indicator: "time"; Source: "sample.bin"), Found reference to API "Log Created" (Indicator: "creat"; Source: "sample.bin"), Found reference to API "set_Timeout" (Indicator: "time"; Source: "sample.bin"), Found reference to API "Open" (Indicator: "open"; Source: "sample.bin")28:T44b,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00003564.00000000.98181.00C51000.00000020.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00003564.00000000.98181.00C51000.00000020.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003564.00000000.98181.00C51000.00000020.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003564.00000000.98181.00C51000.00000020.mdmp")29:T97b,"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG\DEFAULT") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\02FAF3E291435468607857694DF5E45B68851868") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\039EEDB80BE7A03C6953893B20D2D9323A4C2AFD") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\07E032E020B72C3F192F0628A2593A19A70F069E") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\2796BAE63F1801E277261BA0D77770028F20EEE4") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\323C118E1BF7B8B65254E2E2100DD6029037F096") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\3679CA35668772304D30A5FB873B0FA77BB70D54") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\3E2BF7F2031B96F38CE6C4D8A85D3E2D58476A0F")2a:T330e,"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000290071000000683a2e0000000000710000000000000014000000000000000000000000000000000000000000000002000002180e2d007e00007e0000000000000000000000008000000000000000b00000b078f92c000100000000000000020000000c00000008102900081029000310290000000000000000000000290000000001bcf328000000000044f5280095e1007775491e00feffffff435c04775059047794000000a000000002102900001029009400000078f52800fdfefc75e0f42800ec29e7645c0c0000fcf42800ff29e76400000000000000000000000000000000 (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006491946400000000649194640000000018f328009f480177669194640000000038f3280000000000669194643cf328004da3f374000000000000000038f328006491946400000000000000000400000068f328000fa3f374649194640200000000000000000000000800000064919464ffffffff0100008002000000b8f3280042a2f374e9fd00000800000064919464020000000000000001000000 (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000424100035c000000d8552e00c4002900020026001d0000000000290000000000086d290084fa28000c000000380129000000000000eb2c00f8692900106b290068ff2c00f06d290002000000000000004800000088fa280004fa28002c48886400002900000000004b4888647dd31e04010000002c8dde6400000000084a2e00034a2e000000000040fa28006017d764ffffffff4b488864aa4888640000290000000000400000004cfa2800e543886428ff2d00e848886435d31e04010000002c8dde6400000000cb0000000200000074fa2800a0fbd864ffffffffe8488864 (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000006b002000310000000000424100035c000000d8552e00c4002900020026001d0000000000290000000000086d290084fa28000c000000380129000000000000eb2c00f8692900106b290068ff2c00f06d290002000000000000004800000088fa280004fa28002c48886400002900000000004b4888647dd31e043f8794647dd31e04010000002c8dde64000000006cfa280020fa28002876d464ffffffff3f8794645d87946455d31e04010000002c8dde64000000006cfa280048fa28002877d464ffffffff5d8794647b8794642dd31e04010000002c8dde64000000006cfa2800 (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000002c0001000100a0f8280074f8280074f828002459057700000000d0f828000cb7a664a0f8280006000000ecf828000c8701770000000002000000ecf82800626f047734870177b1a3327714d5de6472c6fc750000000001000100060000000000000008d5de6450c52d0075d8e76450dede6400000000bacb2bccb616f34c8990d74c2e8af500b1a3327790f828000000000074fa280095e10077e5471e00feffffff34870177c4b6a6644096a66428ff2d00fcb6a6640100000028f92800d9b6a6641cd5de640100000028ff2d00bccefc7500000000000000000000000054fa2800 (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000029001a00000050552e00000000001a0000000000000014000000000000000000000000000000000000000000000002000002180e2d002f00002f000000000000000000000000800000000000000053410012f0fb2c000100000000000000020000000c00000068422e0068422e0063422e000000000000000000000029000000000158f428000000000074fa280095e1007775491e00feffffff435c04775059047794000000a000000062422e0060422e0094000000fcf52800fdfefc757cf52800ec29e7645c0c000098f52800ff29e76400000000000000000000000000000000 (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000d2000000d20000000c000000301a300001000000020000000200000010000000d426de6401000000383dde6401000000e0f1280070f12800de448864b8ec2e00a0f128009f448864b8448864d9d81e04d0842d00e0f12800010000000000000000000000bcf128001ce3d764ffffffffb84488647d448864b1d81e04d0842d00a0e92f00010000008a418e6471db1e04d0842d00f8f72f0000000000739f8d6479db1e04d0842d00f8f72f0000000000383dde6400000000e1a78d6400000000d0842d00 (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000200000001b0075000100000000000000d4ea00011c560477c8783000086d2900d0e928002000000038eb280000000000a8513000f8692900186b2900484d3000c06e29003c6e047754ea28000000000088eb2800484d3000e9e90477484d300000000000200000000000000000000000080000000200000048eb280072dcfc750000000079dcfc754ba906fb38b121750000000000001f7500000000000000009ceb2800c0eb2800c715d57500000000f0fe2c000000000000eb280014eb280074ec280002000000000000002800000079dcfc7598eb2800c976f374 (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000827503777401000030ea280079b1327754ea28000dbe017778010000ac852d000400000078ea2800040000004cea2800110000004017550000005500e017550098ec28003016956800000000301695680000000084ea28009f4801773216956800000000a4ea28000000000032169568a8ea28004da3f3740000000000000000a4ea280030169568000000000000000004000000d4ea28000fa3f374301695680200000000000000000000000800000030169568ffffffff010000800200000024eb280042a2f374e9fd00000800000030169568020000000000000001000000 (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000280094df280002000000020000000100420005000000000000000000000000000000f8e0280054770477d4df28000000000014000000bf7704770000b763000000000000800054e02800f000b763000000000000000000000000000000000000000000000000000000000000000012001400ace128007ce128000100000000000000ff2b0477d5bb3277000000009401290000002900c5bb3277c071bd630000ffff2300000000000000000000000800d400440100000100680023000000d4e0280020000000086d290044010000010000000200000000000000a0ec2c00f8692900 (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000002800782fad0068e9280080f4ed750000ad000000000089f4ed7519d70ffb02000000dce92800d8e928000cea2800e8e928008ed50f0000000000000010002ce92800c83af775a0e92800d58cef75dce9280070e9280042a4ed75a802f775b0e92800d2f4ed75080000006ef5ed7544f5ed75c1d70ffb02000000ec361477000029004548147784e928000200000000002900ec361477b4e9280042a4ed75a802f775f8e92800c035147708000000953514777acd470402000000ec3614770000290045481477902fad00782fad00c4e92800e061167784ea28001ed814771a117b73 (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000063003400330032006400320061003200300063003000650065006500380064003600350033003100350066003600640063003900650036003100660039003900380063003400360064003000630034002e00650078006500000000000000000000000000000000000000000000000000000000000000ff2b047701b33277d8eb2277ac01290000002900000000000000000025004201960000000000000000000000000000000000000026003d01960000000000000000000000086d29000000000020000000000000000000000060943300f8692900186b290040883500c06e2900 (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000280095e100774d471e00feffffffff2b04779a2a047700000000bc9427040000000090942704b40000b4000000008000000000000000c25300917809290001000000200f3200020000000800000090942704909427048b94270400000000eb0729000000290000000001eceb2800f8692901020000000000000020000000fefffffff8ec28002c48886400002900000000004b48886481c51e0400000000bc9427041600000000ed2800609b88640000190034ed28006017d764ffffffff4b488864aa48886400002900000000001600000040ed2800d3488864a000000000000000 (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000004010000040100000c000000f007290001000000020000000200000010000000d426de6401000000383dde640100000000e0280090df2800de448864b8ec2e00c0df28009f448864b8448864b9f61e04a009360000e02800010000000000000000000000dcdf28001ce3d764ffffffffb84488647d44886491f61e04a009360040253700010000008a418e6451c91e04a009360058c7310000000000739f8d6459c91e04a009360058c7310000000000383dde6400000000e1a78d6400000000a0093600 (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000ca000000ca0000000c00000038bb300001000000020000000200000010000000d426de6401000000383dde64010000008cdd28001cdd2800de448864b8ec2e004cdd28009f448864b844886435f41e04201336008cdd280001000000000000000000000068dd28001ce3d764ffffffffb84488647d4488640df41e0420133600a0553100010000008a418e64cdf41e0420133600f8c6310000000000739f8d64d5f41e0420133600f8c6310000000000383dde6400000000e1a78d640000000020133600 (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000da000000da0000000c00000068f7280401000000020000000200000010000000d426de6401000000383dde640100000040dc2800d0db2800de448864b8ec2e0000dc28009f448864b844886479f51e0448fa370040dc28000100000000000000000000001cdc28001ce3d764ffffffffb84488647d44886451f51e0448fa370098e72704010000008a418e6411f51e0448fa370078c8310000000000739f8d6419f51e0448fa370078c8310000000000383dde6400000000e1a78d640000000048fa3700 (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000002010000020100000c000000a80c290401000000020000000200000010000000d426de6401000000383dde640100000038e22800c8e12800de448864b8ec2e00f8e128009f448864b844886481c81e0448fb370038e2280001000000000000000000000014e228001ce3d764ffffffffb84488647d44886459cb1e0448fb3700a8e92704010000008a418e6419cb1e0448fb3700d8c8310000000000739f8d6421cb1e0448fb3700d8c8310000000000383dde6400000000e1a78d640000000048fb3700 (UID: 00000000-00005208)2b:T1630,"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100005300780053005c007800380036005f006d006900630072006f0073006f00660074002e0076006300380030002e006300720074005f0031006600630038006200330062003900610031006500310038006500330062005f0038002e0030002e00350030003700320037002e0034003900 (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000636d7e6400005500000000006c6d7e649f801e04d8d7de64c8f42800c4f428000000326b0000000084f4280000000000d8d7de641cf4280098f428008cf42800c8f428005cf42800ff237e64c83b87649cf4280031177e64080000001c5c037714a10477ffffffff2400000084f42800 (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000034006100300034003400630033006400390063003400330032006400320061003200300063003000650065006500380064003600350033003100350066003600640063003900650036003100660039003900380063003400360064003000630034002e00650078006500000007000007 (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310075e4eb2800502d1f75484d3000000000000000000004ec28001c2d1f7500001f75010000000000000001000000010000000100000024ec280034291f7500001f75010000000000000054ed28000000000001000000000000000100000000001f7501000000000000000000000044ec2800 (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310064b8eb280031177e64080000001c5c037714a10477ffffffff24000000a0eb280004000000000000000100000034f9956801000000eceb2800935c057740830c77d4a00477b1b03277000000000100000001000000d0852d0000000000bceb28001bc6fc7528ec280095e10077a55f1e00 (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000b0000003ce1280048e128000200000000000000100000002ce1280048e12800c976f3740000290000001400da76f37439a306fb000000000000b76301000000935c057700000000000000000000000010e1280001000000e0e32800bd06f5749134dd8f00000000bd14b76348f82d00 (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eb22774088350000e0fd7f9a5c057700f0fd7f1ce9280044e0fd7f00000000400000003f0000002200000000e0fd7f10e92800c15c057760820c772200000000e0fd7f9a5c057700f0fd7f34e928005789047780830c771317f474d8eb2277 (UID: 00000000-00005208) "csc.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000636d7e6400008800000000006c6d7e64c8947c1ad8d7de641cec120018ec12000000326b00000000d8eb120000000000d8d7de6470eb1200eceb1200e0eb12001cec1200b0eb1200ff237e64c83b8764f0eb120031177e64080000001c5c037714a10477ffffffff24000000d8eb1200 (UID: 00000000-00003400) "csc.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100ff435c04775059047728000000300000005a1788005817880028000000000000002800000088fe120095e10077a1b71f000000000000001000002000000010000000000100ffeffd7fef142562f03f88006017880000000000000000000000000000001d0000005a010000000000001900 (UID: 00000000-00003400) "csc.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003400) "csc.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310064a4e812008b76976808000000896f97687cfd261ab0519868705198681bc6fc758a78e0aef04f8800d04f880070e812001bc6fc7510e912007d2e9868e07aa372feffffff896f9768936f9768c03e986846749768c03e98683076976842177e6400000000fa759768b051986800000000 (UID: 00000000-00003400) "csc.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000003b000000000000000000000000000000000000002c010000000000000000000000000000 (UID: 00000000-00003400) "csc.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000000000000000000a4ea1200000000000000000000000000cb5a751accea120075d8e7640000000098ea1200186df37498ea12002a6df37400009c630000000080fe12000000000012001300c0772a62d8ea1200d8ea12002af4e46400000000635a751aa0ef1200bccefc7500009c63 (UID: 00000000-00003400)2c:Td34,"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "ENABLEDHCP"; Value: "") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTRATIONENABLED"; Value: "") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTERADAPTERNAME"; Value: "") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DOMAIN"; Value: "") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPDOMAIN"; Value: "") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "NAMESERVER"; Value: "") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPNAMESERVER"; Value: "") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "NAMESERVER"; Value: "") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPNAMESERVER"; Value: "")2d:T865,"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\2E4916B07F3DE90C8DDE2566FD9B9B400D89BBBA"; Key: "BLOB") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\E6A3B45B062D509B3382282D196EFE97D5956CCB"; Key: "BLOB") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\F5AD0BCC1AD56CD150725B1C866C30AD92EF21B0"; Key: "BLOB") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB")2e:T317d,"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\mscorlib\9f895c66454577eff9c77442d0c84f71\mscorlib.ni.dll (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "LoadLibrary" with a parameter RichEd20.dll (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorsec.dll (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "LoadLibrary" with a parameter mscorsec.dll (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "LoadLibrary" with a parameter WINTRUST.DLL (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CRYPT32.dll (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "LoadLibrary" with a parameter imagehlp.dll (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "LoadLibrary" with a parameter ncrypt.dll (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\bcryptprimitives.dll (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\cryptnet.dll (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "LoadLibrary" with a parameter cryptnet.dll (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "LoadLibrary" with a parameter SensApi.dll (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "LoadLibrary" with a parameter WINHTTP.dll (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "LoadLibrary" with a parameter wshtcpip (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "LoadLibrary" with a parameter wship6.dll (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "LoadLibrary" with a parameter NSI.dll (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "LoadLibrary" with a parameter CFGMGR32.dll (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L1-1-0.dll (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L2-1-0.dll (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-winsvc-L1-1-0.dll (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "LoadLibrary" with a parameter profapi.dll (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "LoadLibrary" with a parameter DNSAPI.dll (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ole32.dll (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "LoadLibrary" with a parameter AdvApi32.dll (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System\ad92dab7f418877d6a1e0358ce35658a\System.ni.dll (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\5859b21b683c9f7f14622b57a90c63f1\System.ServiceProcess.ni.dll (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Xml\77c1dc46ea139bf5e1eaa9b87ef03c7a\System.Xml.ni.dll (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Configuration\ad8dd536906e94c4bc9cb9b82285580b\System.Configuration.ni.dll (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\culture.dll (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\en-US\mscorrc.dll (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\en\mscorrc.dll (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Drawing\ce3c98f2bf220ef17b0cf4233cac6ceb\System.Drawing.ni.dll (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\367e5b8a038ac76eba17528bb7b3688e\System.Windows.Forms.ni.dll (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ole32.dll (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\MSCTF.dll (UID: 00000000-00005208) "csc.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll (UID: 00000000-00003400) "csc.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003400) "csc.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\alink.dll (UID: 00000000-00003400) "csc.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00003400) "csc.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\clr.dll (UID: 00000000-00003400) "csc.exe" called "LoadLibrary" with a parameter AdvApi32.dll (UID: 00000000-00003400) "csc.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00003400) "csc.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003400) "csc.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00003400) "csc.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorpe.dll (UID: 00000000-00003400) "csc.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ole32.dll (UID: 00000000-00003400) "csc.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003400)2f:Tf51b,"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionAndSpinCount (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter IsProcessorFeaturePresent (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter _set_error_mode (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter ?set_terminate@@YAP6AXXZP6AXXZ@Z (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter _get_terminate (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter FindActCtxSectionStringW (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter SetLoadedByMscoree (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter GetCLRFunction (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter GetTraceLoggerHandle (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter GetTraceEnableLevel (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter GetTraceEnableFlags (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter TraceEvent (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter IEE (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter IEE_RetAddr (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter GetStartupFlags (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter GetStartupFlags_RetAddr (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter GetHostConfigurationFile (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter GetHostConfigurationFile_RetAddr (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter GetCORVersion_RetAddr (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter GetCORVersion (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter GetCORSystemDirectory (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter GetCORSystemDirectory_RetAddr (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter RtlUnwind (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter SetThreadStackGuarantee (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter AddVectoredContinueHandler (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter RemoveVectoredContinueHandler (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter GetWriteWatch (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter ResetWriteWatch (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter CreateMemoryResourceNotification (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter QueryMemoryResourceNotification (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter ImmCreateContext (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter ImmDestroyContext (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter ImmNotifyIME (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringA (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringA (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringW (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringW (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter ImmSetCandidateWindow (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter GetPublisher (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter CoInitializeEE (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter CoInitializeEE_RetAddr (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter WintrustCertificateTrust (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter CORPolicyEE (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter SoftpubInitialize (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter SoftpubLoadMessage (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter SoftpubLoadSignature (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter SoftpubCheckCert (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter CryptAcquireContextA (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter DllCanUnloadNow (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter CryptSIPPutSignedDataMsg (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter CryptSIPGetSignedDataMsg (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter ImageGetCertificateData (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter BCryptOpenAlgorithmProvider (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter GetHashInterface (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter BCryptGetProperty (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter BCryptCreateHash (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter BCryptHashData (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter WVTAsn1SpcIndirectDataContentDecode (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter CryptSIPVerifyIndirectData (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter WVTAsn1SpcPeImageDataDecode (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter BCryptFinishHash (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter BCryptDestroyHash (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter BCryptCloseAlgorithmProvider (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter CryptSetHashParam (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter CryptVerifySignatureA (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter GetUserProfileDirectoryW (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter ConvertStringSidToSidW (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter I_CryptNetGetConnectivity (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter IsNetworkAlive (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter CryptRetrieveObjectByUrlW (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter UrlGetPartW (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter WinHttpOpen (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter StrRChrA (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter GetProductInfo (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceW (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceA (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter RpcStringBindingComposeW (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter RpcBindingFromStringBindingW (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter RpcBindingSetAuthInfoExW (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter RpcBindingSetOption (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter RpcStringFreeW (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter WinHttpSetTimeouts (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter WinHttpSetOption (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter WinHttpCrackUrl (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter StrCmpNW (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter WinHttpConnect (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter WSAStringToAddressW (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter WSHAddressToString (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter WSHEnumProtocols (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter WSHGetProviderGuid (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter WSHGetSockaddrType (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter WSHGetSocketInformation (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter WSHGetWSAProtocolInfo (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter WSHGetWildcardSockaddr (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter WSHGetWinsockMapping (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter WSHIoctl (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter WSHJoinLeaf (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter WSHNotify (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter WSHOpenSocket (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter WSHOpenSocket2 (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter WSHSetSocketInformation (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter WSHStringToAddress (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter WinHttpOpenRequest (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter UrlCanonicalizeW (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter WinHttpGetDefaultProxyConfiguration (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter WinHttpGetIEProxyConfigForCurrentUser (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter GetBestInterfaceEx (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter SHGetValueA (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter RtlConvertSidToUnicodeString (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter RegDeleteTreeA (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter RegDeleteTreeW (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter StringFromIID (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter NsiAllocateAndGetTable (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter CM_Open_Class_Key_ExW (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter ConvertInterfaceGuidToLuid (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter GetIfEntry2 (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter GetIpForwardTable2 (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter GetIpNetEntry2 (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter FreeMibTable (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter NsiFreeTable (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter WinHttpGetProxyForUrl (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter RpcAsyncInitializeHandle (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter OpenSCManagerW (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter OpenServiceW (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter CloseServiceHandle (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter NotifyServiceStatusChangeW (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter QueryServiceStatus (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter NdrAsyncClientCall (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter RpcAsyncCompleteCall (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter WinHttpTimeFromSystemTime (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter WinHttpSendRequest (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter DnsGetProxyInformation (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter FreeAddrInfoW (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter WSARecv (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter WinHttpReceiveResponse (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter WinHttpQueryHeaders (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter StrStrIW (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter WinHttpQueryDataAvailable (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter WinHttpReadData (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter WinHttpCloseHandle (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter RpcBindingFree (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter QueryServiceConfigA (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter ChangeServiceConfigA (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter StartServiceW (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter RpcStringBindingComposeA (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter RpcBindingFromStringBindingA (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter RpcEpResolveBinding (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter RpcStringFreeA (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter NdrClientCall2 (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter CryptGetKeyParam (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter CertDllVerifyRevocation (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter SoftpubAuthenticode (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter SoftpubCleanup (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter SaferiSearchMatchingHashRules (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter CoUninitializeEE (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter CoUninitializeEE_RetAddr (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter CryptGetHashParam (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter CryptExportKey (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter CryptGenKey (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter CryptSignHashA (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter CryptGetProvParam (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter CryptGetUserKey (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter CryptEnumProvidersA (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter GetVersionEx (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter GetVersionExW (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter SetCurrentDirectory (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter SetCurrentDirectoryW (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter SetErrorMode (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter lstrlen (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter lstrlenW (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter ND_RI2 (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter ND_RI2_RetAddr (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter LoadLibraryShim_RetAddr (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter LoadLibraryShim (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter ConvertLangIdToCultureName (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter GetTempPath (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter GetCurrentDirectory (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter GetStdHandleW (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter CreateProcess (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter CreateProcessW (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter DeleteFile (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter RtlMoveMemory (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter RtlMoveMemoryW (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter StartServiceCtrlDispatcher (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter StartServiceCtrlDispatcherW (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter FormatMessage (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter GetUserObjectInformation (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter GetUserObjectInformationA (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter GetActiveWindow (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter OleInitialize (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter CoRegisterMessageFilter (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter EnumThreadWindows (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter GetFocus (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter MessageBox (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter MessageBoxW (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter GetLayout (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter GdiRealizationInfo (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter FontIsLinked (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter GetTextFaceAliasW (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter GetFontAssocStatus (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter GdiIsMetaPrintDC (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter SendMessage (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter SendMessageW (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter RegQueryInfoKey (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter RegEnumKeyEx (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter CreateWellKnownSidW (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter CreateMutex (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter CreateMutexW (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter OpenMutex (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter OpenMutexW (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter RegSetValueEx (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter RegCreateKeyEx (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter GetRequestedRuntimeInfo (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter GetRequestedRuntimeInfoW (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter GetRequestedRuntimeInfo_RetAddr (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter RegFlushKey (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter RegisterEventSource (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter RegisterEventSourceW (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter DeregisterEventSource (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter ReportEvent (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter ReportEventW (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00005208) "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00005208) "csc.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003400) "csc.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00003400) "csc.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00003400) "csc.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00003400) "csc.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003400) "csc.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003400) "csc.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003400) "csc.exe" called "GetProcAddress" with a parameter SetLoadedByMscoree (UID: 00000000-00003400) "csc.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00003400) "csc.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00003400) "csc.exe" called "GetProcAddress" with a parameter DllGetClassObjectInternal (UID: 00000000-00003400) "csc.exe" called "GetProcAddress" with a parameter GetCLRFunction (UID: 00000000-00003400) "csc.exe" called "GetProcAddress" with a parameter GetCORVersion_RetAddr (UID: 00000000-00003400) "csc.exe" called "GetProcAddress" with a parameter GetCORVersion (UID: 00000000-00003400) "csc.exe" called "GetProcAddress" with a parameter CreateALink (UID: 00000000-00003400) "csc.exe" called "GetProcAddress" with a parameter DllGetClassObject_RetAddr (UID: 00000000-00003400) "csc.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00003400) "csc.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00003400) "csc.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00003400) "csc.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00003400) "csc.exe" called "GetProcAddress" with a parameter GetSidSubAuthorityCount (UID: 00000000-00003400) "csc.exe" called "GetProcAddress" with a parameter GetSidSubAuthority (UID: 00000000-00003400) "csc.exe" called "GetProcAddress" with a parameter GetCORSystemDirectory_RetAddr (UID: 00000000-00003400) "csc.exe" called "GetProcAddress" with a parameter IEE (UID: 00000000-00003400) "csc.exe" called "GetProcAddress" with a parameter IEE_RetAddr (UID: 00000000-00003400) "csc.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003400) "csc.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003400) "csc.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003400) "csc.exe" called "GetProcAddress" with a parameter StrongNameTokenFromPublicKey (UID: 00000000-00003400) "csc.exe" called "GetProcAddress" with a parameter StrongNameTokenFromPublicKey_RetAddr (UID: 00000000-00003400) "csc.exe" called "GetProcAddress" with a parameter StrongNameErrorInfo (UID: 00000000-00003400) "csc.exe" called "GetProcAddress" with a parameter CryptAcquireContextA (UID: 00000000-00003400) "csc.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00003400) "csc.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00003400) "csc.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00003400) "csc.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00003400) "csc.exe" called "GetProcAddress" with a parameter CryptGetHashParam (UID: 00000000-00003400) "csc.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00003400) "csc.exe" called "GetProcAddress" with a parameter CryptExportKey (UID: 00000000-00003400) "csc.exe" called "GetProcAddress" with a parameter CryptGenKey (UID: 00000000-00003400) "csc.exe" called "GetProcAddress" with a parameter CryptGetKeyParam (UID: 00000000-00003400) "csc.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00003400) "csc.exe" called "GetProcAddress" with a parameter CryptVerifySignatureA (UID: 00000000-00003400) "csc.exe" called "GetProcAddress" with a parameter CryptSignHashA (UID: 00000000-00003400) "csc.exe" called "GetProcAddress" with a parameter CryptGetProvParam (UID: 00000000-00003400) "csc.exe" called "GetProcAddress" with a parameter CryptGetUserKey (UID: 00000000-00003400) "csc.exe" called "GetProcAddress" with a parameter CryptEnumProvidersA (UID: 00000000-00003400) "csc.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00003400) "csc.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00003400) "csc.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00003400) "csc.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00003400) "csc.exe" called "GetProcAddress" with a parameter StrongNameFreeBuffer (UID: 00000000-00003400) "csc.exe" called "GetProcAddress" with a parameter StrongNameFreeBuffer_RetAddr (UID: 00000000-00003400) "csc.exe" called "GetProcAddress" with a parameter GetRealProcAddress (UID: 00000000-00003400) "csc.exe" called "GetProcAddress" with a parameter GetRealProcAddress_RetAddr (UID: 00000000-00003400) "csc.exe" called "GetProcAddress" with a parameter CreateAssemblyNameObject (UID: 00000000-00003400) "csc.exe" called "GetProcAddress" with a parameter CompareAssemblyIdentity (UID: 00000000-00003400) "csc.exe" called "GetProcAddress" with a parameter LoadLibraryShim (UID: 00000000-00003400) "csc.exe" called "GetProcAddress" with a parameter LoadLibraryShim_RetAddr (UID: 00000000-00003400) "csc.exe" called "GetProcAddress" with a parameter CreateICeeFileGen (UID: 00000000-00003400) "csc.exe" called "GetProcAddress" with a parameter DestroyICeeFileGen (UID: 00000000-00003400) "csc.exe" called "GetProcAddress" with a parameter GetCORSystemDirectory (UID: 00000000-00003400) "csc.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00003400) "csc.exe" called "GetProcAddress" with a parameter CreateStreamOnHGlobal (UID: 00000000-00003400) "csc.exe" called "GetProcAddress" with a parameter GetCORRequiredVersion_RetAddr (UID: 00000000-00003400) "csc.exe" called "GetProcAddress" with a parameter GetCORRequiredVersion (UID: 00000000-00003400) "csc.exe" called "GetProcAddress" with a parameter DllCanUnloadNow_RetAddr (UID: 00000000-00003400) "csc.exe" called "GetProcAddress" with a parameter DllCanUnloadNow (UID: 00000000-00003400) "csc.exe" called "GetProcAddress" with a parameter DllCanUnloadNowInternal (UID: 00000000-00003400) "csc.exe" called "GetProcAddress" with a parameter CorExitProcess (UID: 00000000-00003400) "csc.exe" called "GetProcAddress" with a parameter CorExitProcess_RetAddr (UID: 00000000-00003400) "csc.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00003400) "csc.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00003400) "cvtres.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00005992) "cvtres.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00005992) "cvtres.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005992) "cvtres.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005992) "cvtres.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005992) "cvtres.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005992)30:T1843,"Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00003564.00000000.98181.00C51000.00000020.mdmp "ailed to open reg key Software\Microsoft\CCM\Logging\@GLOBAL on server - " in Source: 00000000-00005208.00000000.96334.000F2000.00000020.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00005208.00000001.97736.00290000.00000004.mdmp "To enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00005208.00000001.97736.01CB0000.00000004.mdmp "To turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00005208.00000001.97736.01CB0000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\EventLog" in Source: 00000000-00005208.00000001.97736.01CB0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\." in Source: 00000000-00005208.00000001.97736.01CB0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog" in Source: 00000000-00005208.00000001.97736.01CB0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application\." in Source: 00000000-00005208.00000001.97736.01CB0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application" in Source: 00000000-00005208.00000001.97736.01CB0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application\chcService\." in Source: 00000000-00005208.00000001.97736.01CB0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents\." in Source: 00000000-00005208.00000001.97736.01CB0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents" in Source: 00000000-00005208.00000001.97736.01CB0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents\chcService\." in Source: 00000000-00005208.00000001.97736.01CB0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer\." in Source: 00000000-00005208.00000001.97736.01CB0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer" in Source: 00000000-00005208.00000001.97736.01CB0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer\chcService\." in Source: 00000000-00005208.00000001.97736.01CB0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service\." in Source: 00000000-00005208.00000001.97736.01CB0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service" in Source: 00000000-00005208.00000001.97736.01CB0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service\chcService\." in Source: 00000000-00005208.00000001.97736.01CB0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center\." in Source: 00000000-00005208.00000001.97736.01CB0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center" in Source: 00000000-00005208.00000001.97736.01CB0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center\chcService\." in Source: 00000000-00005208.00000001.97736.01CB0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts\." in Source: 00000000-00005208.00000001.97736.01CB0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts" in Source: 00000000-00005208.00000001.97736.01CB0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts\chcService\." in Source: 00000000-00005208.00000001.97736.01CB0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security\." in Source: 00000000-00005208.00000001.97736.01CB0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security" in Source: 00000000-00005208.00000001.97736.01CB0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security\chcService\." in Source: 00000000-00005208.00000001.97736.01CB0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\." in Source: 00000000-00005208.00000001.97736.01CB0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System" in Source: 00000000-00005208.00000001.97736.01CB0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\chcService\." in Source: 00000000-00005208.00000001.97736.01CB0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell\." in Source: 00000000-00005208.00000001.97736.01CB0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell" in Source: 00000000-00005208.00000001.97736.01CB0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell\chcService\." in Source: 00000000-00005208.00000001.97736.01CB0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application\MaxSize" in Source: 00000000-00005208.00000001.97736.01CB0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application\AutoBackupLogFiles" in Source: 00000000-00005208.00000001.97736.01CB0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application\chcService" in Source: 00000000-00005208.00000001.97736.01CB0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00005208.00000001.97736.01CB0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application\chcService\EventMessageFile" in Source: 00000000-00005208.00000001.97736.01CB0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00005208.00000001.97736.04270000.00000004.mdmp31:T2934,"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" loaded module "VERSION.DLL" at base 74390000 "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORWKS.DLL" at base 64880000 "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" loaded module "USER32.DLL" at base 76200000 "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" loaded module "MSCOREE.DLL" at base 6b3b0000 "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" loaded module "NTDLL" at base 76ff0000 "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" loaded module "ADVAPI32.DLL" at base 75cf0000 "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" loaded module "SHELL32.DLL" at base 763a0000 "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" loaded module "OLE32.DLL" at base 757a0000 "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" loaded module "KERNEL32.DLL" at base 75f80000 "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 75230000 "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" loaded module "PROFAPI.DLL" at base 74f00000 "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MSCORLIB\9F895C66454577EFF9C77442D0C84F71\MSCORLIB.NI.DLL" at base 63ce0000 "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" loaded module "IMM32.DLL" at base 77190000 "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" loaded module "RICHED20.DLL" at base 63b70000 "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORSEC.DLL" at base 68950000 "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" loaded module "MSCORSEC.DLL" at base 68950000 "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" loaded module "CRYPTSP.DLL" at base 74900000 "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74690000 "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" loaded module "CRYPTBASE.DLL" at base 74df0000 "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" loaded module "WINTRUST.DLL" at base 751f0000 "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 75070000 "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" loaded module "IMAGEHLP.DLL" at base 77140000 "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" loaded module "NCRYPT.DLL" at base 74a30000 "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 745d0000 "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" loaded module "BCRYPT.DLL" at base 74a10000 "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" loaded module "USERENV.DLL" at base 75020000 "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" loaded module "GPAPI.DLL" at base 744d0000 "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL" at base 75230000 "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" loaded module "RPCRT4.DLL" at base 756f0000 "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL" at base 75230000 "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 714a0000 "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" loaded module "CRYPTNET.DLL" at base 714a0000 "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" loaded module "SENSAPI.DLL" at base 6b580000 "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" loaded module "SHLWAPI.DLL" at base 75c30000 "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" loaded module "WINHTTP.DLL" at base 70d20000 "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" loaded module "WS2_32.DLL" at base 771b0000 "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" loaded module "SSPICLI.DLL" at base 74d80000 "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" loaded module "CREDSSP.DLL" at base 74590000 "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 748c0000 "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" loaded module "WSHTCPIP" at base 74420000 "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" loaded module "WSHIP6.DLL" at base 748b0000 "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" loaded module "%WINDIR%\SYSTEM32\WSHQOS.DLL" at base 71690000 "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" loaded module "IPHLPAPI.DLL" at base 73250000 "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" loaded module "DHCPCSVC6.DLL" at base 73160000 "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" loaded module "DHCPCSVC.DLL" at base 73080000 "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" loaded module "NTDLL.DLL" at base 76ff0000 "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" loaded module "NSI.DLL" at base 77180000 "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" loaded module "CFGMGR32.DLL" at base 751c0000 "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" loaded module "OLEAUT32.DLL" at base 75da0000 "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" loaded module "API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL" at base 75230000 "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" loaded module "DNSAPI.DLL" at base 74780000 "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 74420000 "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 748b0000 "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" loaded module "RASADHLP.DLL" at base 71590000 "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 73180000 "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 75230000 "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM\AD92DAB7F418877D6A1E0358CE35658A\SYSTEM.NI.DLL" at base 62bc0000 "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.SERVICEPROCE#\5859B21B683C9F7F14622B57A90C63F1\SYSTEM.SERVICEPROCESS.NI.DLL" at base 62b30000 "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORJIT.DLL" at base 62ad0000 "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" loaded module "PSAPI.DLL" at base 752b0000 "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.XML\77C1DC46EA139BF5E1EAA9B87EF03C7A\SYSTEM.XML.NI.DLL" at base 624b0000 "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CONFIGURATION\AD8DD536906E94C4BC9CB9B82285580B\SYSTEM.CONFIGURATION.NI.DLL" at base 623a0000 "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CULTURE.DLL" at base 62370000 "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74da0000 "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.DRAWING\CE3C98F2BF220EF17B0CF4233CAC6CEB\SYSTEM.DRAWING.NI.DLL" at base 63850000 "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.WINDOWS.FORMS\367E5B8A038AC76EBA17528BB7B3688E\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 61790000 "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 739c0000 "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" loaded module "DWMAPI.DLL" at base 735f0000 "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 757a0000 "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 762d0000 "csc.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORWKS.DLL" at base 64880000 "csc.exe" loaded module "USER32.DLL" at base 76200000 "csc.exe" loaded module "CRYPTBASE.DLL" at base 74df0000 "csc.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\ALINK.DLL" at base 68970000 "csc.exe" loaded module "CLBCATQ.DLL" at base 75e40000 "csc.exe" loaded module "%WINDIR%\SYSTEM32\MSCOREE.DLL" at base 6b3b0000 "csc.exe" loaded module "MSCOREE.DLL" at base 6b3b0000 "csc.exe" loaded module "ADVAPI32.DLL" at base 75cf0000 "csc.exe" loaded module "CRYPTSP.DLL" at base 74900000 "csc.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74690000 "csc.exe" loaded module "KERNEL32.DLL" at base 75f80000 "csc.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORPE.DLL" at base 639c0000 "csc.exe" loaded module "OLE32.DLL" at base 757a0000 "csc.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74da0000 "csc.exe" loaded module "OLEAUT32.DLL" at base 75da0000 "cvtres.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6873000032:Tc1b,"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "80jpydb6.dll" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "DISMHOST.EXE.6AE906FB.bin" file has an entrypoint instructions - "call 0x100a7e6,jmp 0x10097f4,int3 ,int3 ,int3 ,int3 ,int3 ,push 0x14,push 0x1010878,call 0x1009d10,and dword ptr [ebp - 4], 0,dec dword ptr [ebp + 0x10],js 0x1009afc,mov ecx, dword ptr [ebp + 8],sub ecx, dword ptr [ebp + 0xc],mov dword ptr [ebp + 8], ecx,call dword ptr [ebp + 0x14],jmp 0x1009abc,mov eax, dword ptr [ebp - 0x14],mov dword ptr [ebp - 0x1c], eax,mov eax, dword ptr [ebp - 0x1c],mov eax, dword ptr [eax],mov dword ptr [ebp - 0x20], eax,mov eax, dword ptr [ebp - 0x20],cmp dword ptr [eax], 0xe06d7363,je 0x1009af3,mov dword ptr [ebp - 0x24], 0,mov eax, dword ptr [ebp - 0x24],ret ,call dword ptr [0x1001210],mov esp, dword ptr [ebp - 0x18],"33:T801,Process "csc.exe" (UID: 00000000-00003400) was launched with new environment variables: "computername="%OSUSER%-PC", commonprogramfiles="%PROGRAMFILES%\Common Files", homedrive="C:", pathext=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", path="%ALLUSERSPROFILE%\Oracle\Java\javapath;%WINDIR%\system32;%WINDIR%\%WINDIR%\System32\Wbem;%WINDIR%\System32\WindowsPowerShell\v1.0\;%WINDIR%\System32\WindowsPowerShell\v1.0\;C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python38-32\Scripts\;C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python38-32\;C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python36-32\Scripts\;C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python36-32\", comspec="%WINDIR%\system32\cmd.exe", homepath="\Users\%OSUSER%", sessionname="Console", tmp="%LOCALAPPDATA%\Temp", processor_revision="4f00", localappdata="%USERPROFILE%\AppData\Local", userprofile="C:\Users\%OSUSER%", number_of_processors="8", programfiles="C:\Program Files", processor_level="6", userdnsdomain="%OSUSER%-PC", processor_architecture="x86", processor_identifier="x86 Family 6 Model 79 Stepping 0 GenuineIntel", logonserver="\\%OSUSER%-PC", systemroot="C:\Windows", userdomain="%OSUSER%-PC", allusersprofile="C:\ProgramData", public="C:\Users\Public", fp_no_host_check="NO", temp="%LOCALAPPDATA%\Temp", os="Windows_NT", programdata="C:\ProgramData", psmodulepath="%WINDIR%\system32\WindowsPowerShell\v1.0\Modules\;%PROGRAMFILES%\AutoIt3\AutoItX", _clrrestrictsecattributes="1", systemdrive="C:", appdata="%USERPROFILE%\AppData\Roaming", username="%OSUSER%"" Process "csc.exe" (UID: 00000000-00003400) was launched with missing environment variables: "PROCESSOR_LEVEL, FP_NO_HOST_CHECK, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, SystemDrive, USERNAME, PATHEXT, ProgramData, HOMEPATH, PROCESSOR_IDENTIFIER, ProgramFiles, PUBLIC, LOCALAPPDATA, USERDOMAIN, LOGONSERVER, APPDATA, CommonProgramFiles, Path, OS, COMPUTERNAME, PROCESSOR_REVISION, ComSpec, SystemRoot, TEMP, HOMEDRIVE, USERPROFILE, TMP, NUMBER_OF_PROCESSORS"34:T1286,Observed system executable string:"C:\> "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /t:library /utf8output /R:"C:\d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" /R:"C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorlib.dll" /R:"C:\Windows\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.Xml.dll" /out:"C:\Users\HAPUBWS\AppData\Local\Temp\80jpydb6.dll" /debug- /optimize+ /nostdlib /D:_DYNAMIC_XMLSERIALIZER_COMPILATION "C:\Users\HAPUBWS\AppData\Local\Temp\80jpydb6.0.cs"Microsoft (R) Visual C# 2005 Compiler version 8.00.50727.5483for Microsoft (R) Windows (R) 2005 Framework version 2.0.50727Copyright (C) Microsoft Corporation 2001-2005. All rights reserved." [Source: 80jpydb6.out] Observed system executable string:"/t:library /utf8output /R:"C:\d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" /R:"C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorlib.dll" /R:"C:\Windows\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.Xml.dll" /out:"C:\Users\HAPUBWS\AppData\Local\Temp\80jpydb6.dll" /debug- /optimize+ /nostdlib /D:_DYNAMIC_XMLSERIALIZER_COMPILATION "C:\Users\HAPUBWS\AppData\Local\Temp\80jpydb6.0.cs"" [Source: 80jpydb6.cmdline] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll" [Source: 00000000-00005208-00000C2B-340599580] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_32\mscorlib\9f895c66454577eff9c77442d0c84f71\mscorlib.ni.dll" [Source: 00000000-00005208-00000C2B-342106646] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorsec.dll" [Source: 00000000-00005208-00000C2B-342840684] Observed system executable string:"%WINDIR%\system32\CRYPT32.dll" [Source: 00000000-00005208-00000C2B-343864940] Observed system executable string:"%WINDIR%\system32\bcryptprimitives.dll" [Source: 00000000-00005208-00000C2B-344490453] Observed system executable string:"%WINDIR%\system32\cryptnet.dll" [Source: 00000000-00005208-00000C2B-345448722] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ole32.dll" [Source: 00000000-00005208-00000C2B-352219640] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_32\System\ad92dab7f418877d6a1e0358ce35658a\System.ni.dll" [Source: 00000000-00005208-00000C2B-353060625] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\5859b21b683c9f7f14622b57a90c63f1\System.ServiceProcess.ni.dll" [Source: 00000000-00005208-00000C2B-355569350] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll" [Source: 00000000-00005208-00000C2B-355845201] Observed system executable string:"%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00005208-00000C2B-356129432] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Xml\77c1dc46ea139bf5e1eaa9b87ef03c7a\System.Xml.ni.dll" [Source: 00000000-00005208-00000C2B-356488123] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Configuration\ad8dd536906e94c4bc9cb9b82285580b\System.Configuration.ni.dll" [Source: 00000000-00005208-00000C2B-356908057] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v2.0.50727\culture.dll" [Source: 00000000-00005208-00000C2B-358137450] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v2.0.50727\en-US\mscorrc.dll" [Source: 00000000-00005208-00000C2B-358251979] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v2.0.50727\en\mscorrc.dll" [Source: 00000000-00005208-00000C2B-358365607] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll" [Source: 00000000-00005208-00000C2B-358484836] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Drawing\ce3c98f2bf220ef17b0cf4233cac6ceb\System.Drawing.ni.dll" [Source: 00000000-00005208-00000C2B-361388859] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\367e5b8a038ac76eba17528bb7b3688e\System.Windows.Forms.ni.dll" [Source: 00000000-00005208-00000C2B-361522545] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00005208-00000C2B-361973642] Observed system executable string:"%WINDIR%\system32\ole32.dll" [Source: 00000000-00005208-00000C2B-362555513] Observed system executable string:"%WINDIR%\system32\MSCTF.dll" [Source: 00000000-00005208-00000C2B-362701899] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v2.0.50727\EventLogMessages.dll" [Source: 00000000-00005208-00000BC1-366662158]35:T730,"80jpydb6.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%TEMP%\80jpydb6.dll]- [targetUID: 00000000-00005208] "DISMHOST.EXE.6AE906FB.bin" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 4 sections"- [targetUID: 00000000-00005208] "80jpydb6.0.cs" has type "Unicode text UTF-8 (with BOM) text with CRLF line terminators"- Location: [%TEMP%\80jpydb6.0.cs]- [targetUID: 00000000-00005208] "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "Microsoft Cabinet archive data Windows 2000/XP setup 5652 bytes 1 file at 0x2c last modified Oct 18 2026 18:55:36 +A "disallowedcert.stl" number 1 1 datablock 0x1 compression"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00005208] "RES2A0D.tmp" has type "Intel i386 COFF object file not stripped 3 sections symbol offset=0x426 9 symbols created Mon Nov 2 20:56:01 2026 1st section name ".debug$S" 2nd section name ".rsrc$01""- [targetUID: 00000000-00005208] "80jpydb6.out" has type "Unicode text UTF-8 (with BOM) text with very long lines (486) with CRLF line terminators"- Location: [%TEMP%\80jpydb6.out]- [targetUID: 00000000-00005208] "CSC29FC.tmp" has type "Microsoft Visual C binary resource file"- [targetUID: 00000000-00005208] "80jpydb6.cmdline" has type "Unicode text UTF-8 (with BOM) text with very long lines (425) with no line terminators"- Location: [%TEMP%\80jpydb6.cmdline]- [targetUID: 00000000-00005208] "CHStatus.xml" has type "XML 1.0 document ASCII text with CRLF line terminators"- Location: [C:\CHStatus.xml]- [targetUID: 00000000-00005208] "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00005208]36:T6df,"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: ""; Value: "") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: ""; Value: "") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\LINKAGE"; Key: ""; Value: "") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CLASS\{4D36E972-E325-11CE-BFC1-08002BE10318}"; Key: ""; Value: "") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD"; Key: ""; Value: "") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-8D-DE"; Key: ""; Value: "") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: ""; Value: "")37:T1006,"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "SEARCHLIST"; Value: "") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "ENABLEDHCP"; Value: "") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTRATIONENABLED"; Value: "") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTERADAPTERNAME"; Value: "") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DOMAIN"; Value: "") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPDOMAIN"; Value: "") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPV6DOMAIN"; Value: "") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "NAMESERVER"; Value: "") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "NAMESERVER"; Value: "") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPNAMESERVER"; Value: "") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "NAMESERVER"; Value: "") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPNAMESERVER"; Value: "")38:Tc22,"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" trying to touch file "C:\Windows\SYSTEM32\MSCOREE.DLL" "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" trying to touch file "C:\Windows\SYSTEM32\MSCOREE.DLL.local" "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-synch-l1-2-0.DLL" "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" trying to touch file "C:\Windows\Temp\VxOle32.dll" "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" trying to touch file "C:\FLTLIB.DLL" "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" trying to touch file "C:\Windows\system32\FLTLIB.DLL" "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" trying to touch file "C:\MSVCP140.dll" "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" trying to touch file "C:\Windows\system32\MSVCP140.dll" "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" trying to touch file "C:\VCRUNTIME140.dll" "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" trying to touch file "C:\Windows\system32\VCRUNTIME140.dll" "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" trying to touch file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" trying to touch file "C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll" "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" trying to touch file "C:\ucrtbase.DLL" "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" trying to touch file "C:\Windows\system32\ucrtbase.DLL"39:T6dd,"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config" "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch" "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config" "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch" "csc.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "csc.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "csc.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "csc.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "csc.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll"3a:Tde4,"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" trying to access non-existent file "C:\FLTLIB.DLL" "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" trying to access non-existent file "C:\MSVCP140.dll" "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" trying to access non-existent file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" trying to access non-existent file "C:\ucrtbase.DLL" "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" trying to access non-existent file "C:\api-ms-win-core-timezone-l1-1-0.dll" "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" trying to access non-existent file "C:\api-ms-win-core-file-l2-1-0.dll" "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" trying to access non-existent file "C:\api-ms-win-core-localization-l1-2-0.dll" "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" trying to access non-existent file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" trying to access non-existent file "C:\api-ms-win-core-file-l1-2-0.dll" "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" trying to access non-existent file "C:\api-ms-win-crt-heap-l1-1-0.dll" "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" trying to access non-existent file "C:\api-ms-win-crt-string-l1-1-0.dll" "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" trying to access non-existent file "C:\api-ms-win-crt-stdio-l1-1-0.dll" "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" trying to access non-existent file "C:\api-ms-win-crt-convert-l1-1-0.dll" "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" trying to access non-existent file "C:\api-ms-win-crt-locale-l1-1-0.dll" "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" trying to access non-existent file "C:\api-ms-win-crt-filesystem-l1-1-0.dll" "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" trying to access non-existent file "C:\api-ms-win-crt-time-l1-1-0.dll"3b:T6de,"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" trying to access non-existent file "C:\Windows\SYSTEM32\MSCOREE.DLL.local" "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" trying to access non-existent file "C:\d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe.config" "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" trying to access non-existent file "C:\d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe.Local\" "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\fusion.localgac" "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config" "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch" "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config" "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch" "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" trying to access non-existent file "\DEVICE\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}" "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" trying to access non-existent file "\DEVICE\NETBT_TCPIP_{6BF8667D-AFE0-478A-9AA7-D762C1E66954}"3c:T682,"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" writes file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\metadata\57c8edb95df3f0ad4ee2dc2b8cfd4157" "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" writes file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\content\57c8edb95df3f0ad4ee2dc2b8cfd4157" "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" writes file "c:\users\%osuser%\appdata\local\temp\80jpydb6.0.cs" "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" writes file "c:\users\%osuser%\appdata\local\temp\80jpydb6.cmdline" "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" writes file "c:\users\%osuser%\appdata\local\temp\80jpydb6.out" "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" writes file "c:\chstatus.xml" "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" writes file "%temp%\80jpydb6.dll" "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" writes file "%temp%\80jpydb6.0.cs" "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" writes file "%localappdata%\ow\microsoft\cryptneturlcache\content\57c8edb95df3f0ad4ee2dc2b8cfd4157" "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" writes file "%temp%\80jpydb6.out" "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" writes file "%temp%\80jpydb6.cmdline" "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" writes file "%localappdata%\ow\microsoft\cryptneturlcache\metadata\57c8edb95df3f0ad4ee2dc2b8cfd4157"3d:T520,Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00005208-00000C2C-347267083") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00005208-00000C2C-348357693") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; Source: "00000000-00005208-00000C2C-348991145") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00005208-00000C2C-348991145") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00005208-00000C2C-348991145") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; Source: "00000000-00005208-00000C2C-350739153") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00005208-00000C2C-350739153") Found reference to API "WSARecv" (Indicator: "WSARecv"; Source: "00000000-00005208-00000C2C-350974996") Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00005208-00000C2C-350975719") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00005208-00000C2C-350978714") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00005208-00000C2C-350979198")3e:T3e2a,Found URL "http://crl.microsoft.com/pki/crl/products/cspca.crl0h<0:08,http://www.microsoft.com/pki/certs/cspca.crt0jt;1_zw9gjs2r6$rofh&9ipnt8jo,nv\0p1+0)" - Source: "00000000-00005208.00000000.96334.00290000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/cspca.crl0h<0:08,http://www.microsoft.com/pki/certs/cspca.crt0jt;1_zw9gjs2r6$rofh&9ipnt8jo0p1+0)" - Source: "00000000-00005208.00000000.96334.00290000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/tspca.crl0h<0:08,http://www.microsoft.com/pki/certs/tspca.crt0np;lo,5;cb(x:0@enwashington1redmond1microsoft" - Source: "00000000-00005208.00000000.96334.00290000.00000004.mdmp") Found URL "http://www.microsoft.com/smserver/0u8soi<%9g9jg)fcwashington1redmond1microsoft" - Source: "00000000-00005208.00000000.96334.00290000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/tspca.crl0h<0:08,http://www.microsoft.com/pki/certs/tspca.crt0np;lo,5;cb(x:0@en<" - Source: "00000000-00005208.00000000.96334.00290000.00000004.mdmp") Found URL "http://www.microsoft.com/smserver/1.2.840.113549.1.9.6washington1redmond1microsoft" - Source: "00000000-00005208.00000000.96334.00290000.00000004.mdmp") Found URL "http://is.ocsp.identrust.com0;/http://apps.identrust/dstrootcax3.p7c0" - Source: "00000000-00005208.00000000.96334.00290000.00000004.mdmp") Found URL "http://cps.root-x1.letsen?,y)?r<0" - Source: "00000000-00005208.00000000.96334.00290000.00000004.mdmp") Found URL "http://g.symcd.com0e0c0a60301%http://www.geotrust.com/resources/cps06/0-0+%http://g.symcb.com/geotrustpca-g3.crl0symantecpki-1-697033ti^l" - Source: "00000000-00005208.00000000.96334.00290000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00005208.00000000.96334.00290000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czc0?1$0" - Source: "00000000-00005208.00000000.96334.00290000.00000004.mdmp") Found URL "http://isrg.trustid.ocsp.identrust.com0;/http://apps.identrust.com/roots/dstrootcax3.p7c0m0k0000." - Source: "00000000-00005208.00000000.96334.00290000.00000004.mdmp") Found URL "http://cps.root-x1.letsencrypt.org0<50301+http://crl.identrust.com/dstrootcax3crl.crl0ig'" - Source: "00000000-00005208.00000000.96334.00290000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00005208.00000000.96334.00290000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00005208.00000000.96334.00290000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0" - Source: "00000000-00005208.00000000.96334.00290000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/cspca.crl:\windows\microsoft.net\framework\v2.0.50727\mscorjit.dllegoextenderuninitializenegotiatenegoextender)8)8)s-1-5-21-2092356043-4041700817-663127204-1001raudulentsa/sha1raudulentsa/sha1raudulentntrustedtrustedtrustedtrustedtrustedtrusteda/sha1audulent4b372709d6c2ad766c34d274501dc76_4b372709d6c2ad766c34d274501dc76_b372709d6c2ad766c34d274501dc76_f987767ee121eb773e3e93d13c2f30_b372709d6c2ad766c34d274501dc76_f987767ee121eb773e3e93d13c2f30_b372709d6c2ad766c34d274501dc76_b372709d6c2ad766c34d274501dc76_ystem.securitystem.securitydentitytypeaseidentityystem.data.sqlxmlstem.data.sqlxmlcrosoft" - Source: "00000000-00005208.00000001.97736.00290000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/cspca.crl0h<0:08,http://www.microsoft.com/pki/certs/cspca.crt0jt;1_zw9gjs2r6$rofh&9ipnt8jo1.3.6.1.4.1.311.20.2wvtasn1spcspagencyinfodecodemicuuwvtasn1spcpeimagedatadecodedse" - Source: "00000000-00005208.00000001.97736.00290000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/tspca.crl0h<0:08,http://www.microsoft.com/pki/certs/tspca.crt0np;lo,5;cb(x:0@en<" - Source: "00000000-00005208.00000001.97736.00290000.00000004.mdmp") Found URL "http://g.symcd.com0e0c0a60301%http://www.geotrust.com/resources/cps06/0-0+%http://g.symcb.com/geotrustpca-g3.crl0symantecpki-1-697033ti^l" - Source: "00000000-00005208.00000001.97736.00290000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00005208.00000001.97736.00290000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czc0?1$0" - Source: "00000000-00005208.00000001.97736.00290000.00000004.mdmp") Found URL "http://isrg.trustid.ocsp.identrust.com0;/http://apps.identrust.com/roots/dstrootcax3.p7c0m0k0000." - Source: "00000000-00005208.00000001.97736.00290000.00000004.mdmp") Found URL "http://cps.root-x1.letsencrypt.org0<50301+http://crl.identrust.com/dstrootcax3crl.crl0ig'" - Source: "00000000-00005208.00000001.97736.00290000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00005208.00000001.97736.00290000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00005208.00000001.97736.00290000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0p1<92a@ef" - Source: "00000000-00005208.00000001.97736.00290000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1english1sea" - Source: "00000000-00005208.00000001.97736.00290000.00000004.mdmp") Found URL "https://secure.comodo.com/cps0" - Source: "00000000-00005208.00000001.97736.00290000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com05addons.mozilla.orgwww.addons.mozilla.org0zsb)j9e/salt" - Source: "00000000-00005208.00000001.97736.00290000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0%www.google.comgoogle.com0io]l,e9n(" - Source: "00000000-00005208.00000001.97736.00290000.00000004.mdmp") Found URL "http://www.public-trust.com/cps/omniroot.html0w0u1gte" - Source: "00000000-00005208.00000001.97736.00290000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0dmxt*j]+xijom5onej-+\lu>gvpob\hzagxr" - Source: "00000000-00005208.00000001.97736.00290000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?com1" - Source: "00000000-00005208.00000001.97736.00290000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnk't" - Source: "00000000-00005208.00000001.97736.00290000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00005208.00000001.97736.00290000.00000004.mdmp") Found URL "http://www.microsoft.com/smserver/-vh]74\-v-v4\-vp/:k" - Source: "00000000-00005208.00000001.97736.00290000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005208.00000001.97736.01CB0000.00000004.mdmp") Found URL "http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cabhttp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab" - Source: "00000000-00005208.00000001.97736.04270000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20certificate%20list%20ca%202024.crl0pd0b0" - Source: "00000000-00005208.00000001.97736.04270000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20certificate%20list%20ca%202024.crt0y" - Source: "00000000-00005208.00000001.97736.04270000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/cspca.crl0h<0:08,http://www.microsoft.com/pki/certs/cspca.crt0jt;1_zw9gjs2r6$rofh&9ipnt8jo" - Source: "00000000-00005208.00000001.97736.04270000.00000004.mdmp") Found URL "http://www.microsoft.com0h3y0w'q<@2/l:p" - Source: "00000000-00005208.00000001.97736.04270000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00005208.00000001.97736.04270000.00000004.mdmp") Found URL "http://ocsp.entrust.net0d=0;09000.://www.digicert.com.my/cps.htm02+0)0'!http://crl.entrust.net/2048ca.crl0system.security.permissions.fileiopermissionattribute," - Source: "00000000-00005208.00000001.97736.04270000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/cspca.crl0h<0:08,http://www.microsoft.com/pki/certs/cspca.crt0jt;1_zw9gjs2r6$rofh&9ipnt8jox-5o\rustdcndedcndedcndedcndedcndedcndedcndedcndedcndedcndedcndefttsz!" - Source: "00000000-00005208.00000001.97736.04270000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/cspca.crl0h<0:08,http://www.microsoft.com/pki/certs/cspca.crt0jt;1_zw9gjs2r6$rofh&9ipnt8joo8wz!h.$j>qq1n" (Indicator: "RsaCryptoServiceProvider"; Source: "00000000-00005208.00000001.97736.01CB0000.00000004.mdmp"), Found string "Base64" (Indicator: "base64"; Source: "00000000-00005208.00000001.97736.01CB0000.00000004.mdmp")42:Tf1a,Found reference to API "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; File: "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4") Found reference to API "CopySid" (Indicator: "CopySid"; File: "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4") Found reference to API "SetSecurityDescriptorOwner" (Indicator: "SetSecurityDescriptorOwner"; File: "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4") Found reference to API "GetSecurityDescriptorGroup" (Indicator: "GetSecurityDescriptorGroup"; File: "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4") Found reference to API "IsValidSecurityDescriptor" (Indicator: "IsValidSecurityDescriptor"; File: "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4") Found reference to API "GetSecurityDescriptorSacl" (Indicator: "GetSecurityDescriptorSacl"; File: "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4") Found reference to API "GetSecurityDescriptorControl" (Indicator: "GetSecurityDescriptorControl"; File: "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4") Found reference to API "AddAce" (Indicator: "AddAce"; File: "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4") Found reference to API "GetSidLengthRequired" (Indicator: "GetSidLengthRequired"; File: "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; File: "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4") Found reference to API "MakeAbsoluteSD" (Indicator: "MakeAbsoluteSD"; File: "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; File: "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4") Found reference to API "GetAclInformation" (Indicator: "GetAclInformation"; File: "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4") Found reference to API "GetSecurityDescriptorOwner" (Indicator: "GetSecurityDescriptorOwner"; File: "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; File: "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4") Found reference to API "IsValidSid" (Indicator: "IsValidSid"; File: "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4") Found reference to API "InitializeSid" (Indicator: "InitializeSid"; File: "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4") Found reference to API "SetSecurityDescriptorGroup" (Indicator: "SetSecurityDescriptorGroup"; File: "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4") Found reference to API "AddAce" (Indicator: "AddAce"; Source: "00000000-00003564.00000000.98181.00C51000.00000020.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00003564.00000000.98181.00C51000.00000020.mdmp") Found reference to API "GetSecurityDescriptorControl" (Indicator: "GetSecurityDescriptorControl"; Source: "00000000-00003564.00000000.98181.00C51000.00000020.mdmp") Found reference to API "MakeAbsoluteSD" (Indicator: "MakeAbsoluteSD"; Source: "00000000-00003564.00000000.98181.00C51000.00000020.mdmp") Found reference to API "GetSecurityDescriptorSacl" (Indicator: "GetSecurityDescriptorSacl"; Source: "00000000-00003564.00000000.98181.00C51000.00000020.mdmp") Found reference to API "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; Source: "00000000-00003564.00000000.98181.00C51000.00000020.mdmp") Found reference to API "GetSecurityDescriptorGroup" (Indicator: "GetSecurityDescriptorGroup"; Source: "00000000-00003564.00000000.98181.00C51000.00000020.mdmp")43:Td41,Observed import api "AddAce" which can "add one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: DISMHOST.EXE.6AE906FB.bin] Observed import api "CopySid" which can "copy a security identifier (SID) to a buffer" [Source: DISMHOST.EXE.6AE906FB.bin] Observed import api "GetAclInformation" which can "retrieve information about an access control list (ACL)" [Source: DISMHOST.EXE.6AE906FB.bin] Observed import api "GetLengthSid" which can "return the length in bytes of a valid security identifier (SID)" [Source: DISMHOST.EXE.6AE906FB.bin] Observed import api "GetSecurityDescriptorControl" which can "retrieve a security descriptor control and revision information" [Source: DISMHOST.EXE.6AE906FB.bin] Observed import api "GetSecurityDescriptorDacl" which can "retrieve a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: DISMHOST.EXE.6AE906FB.bin] Observed import api "GetSecurityDescriptorGroup" which can "retrieve the primary group information from a security descriptor" [Source: DISMHOST.EXE.6AE906FB.bin] Observed import api "GetSecurityDescriptorOwner" which can "retrieve the owner information from a security descriptor" [Source: DISMHOST.EXE.6AE906FB.bin] Observed import api "GetSecurityDescriptorSacl" which can "retrieve a pointer to the system access control list (SACL) in a specified security descriptor" [Source: DISMHOST.EXE.6AE906FB.bin] Observed import api "GetSidLengthRequired" which can "return the length, in bytes, of the buffer required to store a SID with a specified number of subauthorities" [Source: DISMHOST.EXE.6AE906FB.bin] Observed import api "GetSidSubAuthority" which can "return a pointer to a specified subauthority in a security identifier (SID)" [Source: DISMHOST.EXE.6AE906FB.bin] Observed import api "InitializeAcl" which can "initialize a new ACL structure" [Source: DISMHOST.EXE.6AE906FB.bin] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: DISMHOST.EXE.6AE906FB.bin] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: DISMHOST.EXE.6AE906FB.bin] Observed import api "IsValidSecurityDescriptor" which can "determine whether the components of a security descriptor are valid" [Source: DISMHOST.EXE.6AE906FB.bin] Observed import api "IsValidSid" which can "validate a security identifier (SID) by verifying that the revision number is within a known range and that the number of subauthorities is less than the maximum" [Source: DISMHOST.EXE.6AE906FB.bin] Observed import api "MakeAbsoluteSD" which can "create a security descriptor in absolute format by using a security descriptor in self-relative format as a template" [Source: DISMHOST.EXE.6AE906FB.bin] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: DISMHOST.EXE.6AE906FB.bin] Observed import api "SetSecurityDescriptorGroup" which can "set the primary group information of an absolute-format security descriptor replacing any primary group information already present in the security descriptor" [Source: DISMHOST.EXE.6AE906FB.bin] Observed import api "SetSecurityDescriptorOwner" which can "set the owner information of an absolute-format security descriptor" [Source: DISMHOST.EXE.6AE906FB.bin]44:T1006,"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "SEARCHLIST"; Value: "") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "ENABLEDHCP"; Value: "") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTRATIONENABLED"; Value: "") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTERADAPTERNAME"; Value: "") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DOMAIN"; Value: "") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPDOMAIN"; Value: "") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPV6DOMAIN"; Value: "") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "NAMESERVER"; Value: "") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "NAMESERVER"; Value: "") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPNAMESERVER"; Value: "") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "NAMESERVER"; Value: "") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPNAMESERVER"; Value: "")45:T879,"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\80jpydb6.pdb" with delete access "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" opened "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch.5208.2565548" with delete access "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" opened "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch.5208.2565548" with delete access "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\80jpydb6.cmdline" with delete access "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\80jpydb6.tmp" with delete access "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\80jpydb6.dll" with delete access "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\80jpydb6.out" with delete access "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\80jpydb6.err" with delete access "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\80JPYDB6.PDB" with delete access "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\80jpydb6.0.cs" with delete access "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" opened "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\SECURITY.CONFIG.CCH.5208.2565548" with delete access "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" opened "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\ENTERPRISESEC.CONFIG.CCH.5208.2565548" with delete access "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\CLR SECURITY CONFIG\V2.0.50727.312\SECURITY.CONFIG.CCH.5208.2566032" with delete access46:T10a7,"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS") "d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE")47:T590,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD80lEQVR4Xu2W21cTVxTG/b/6Tq22VuSi4DWiLXYtXAoiIOiChNwDMQawSDCESwiEgNTWVmpfbSH2wSf7ZN/oCyHJZGYyueDXfWZIMkwyQmwXfaiz1rfO5JyZs3/7O/ucyZEjH6//+rI63RgYtB2qBi0OFAEsNgf+eLuJ12/+JL39V/V1t6diyyBKDtiH8et69B9pfeMVNqK/Y+OVonW6/436mLTPMu0BMJkdSAlpZDMSMlL6A6S8J1WQ9lkWQ8zktAB2ufMwVQaQy+flgbW1l3jxy+sDae3nl8jnsrKi0WhFFTL/5NqULHZfESC/C8AmrutbQv3dMBr6F9FoXMBpcwhnrCE0O4NoHprDOc8Mznun5Wf/2txEJi2UWa1VVQCXbKswOJ7A4FxBy/AyrngiuOpdwldji2gdX8A1Xwjf+OdVAHxZ5lU5wH7sqADavD+gbfR7XH/4FDcekXyraPc/QUdgBbdml9EZjKBrIVwEyBIAm1iSRKVNK63WgRrTqD4ALyoDbNKuyefo8f+EnsCP6J19hpsU/Lo/jNbJIC5P+GHwTaJlylcCEIWyzLUOsOAnHzr1ATheLAIYgy9wb+45WkZCOGGbwKeWEXzmeIDjQx58ft+NE94hnBxzqgB2HaDM5e3HWo0LLHjzXP/BANoff4fj5nHUDI7iqM2LY04KPnwfXzwYxpejLnmyU4/sKoBUWeZaB1jw1mdt+gApFUCNcUzJ2k7Bi1lT8DEXar914NSEDfWPLXtqQKLDKC3q7wYW/P0AQgngqHXXcpa1h4KPDMlZ147bUeezosFvxumAqbQLxP13wQEASkV4zEVZu1WWs6zJ8vpJKxqnBnFm2ogmsrQIIPBVHeP7AqgLrXbcgTqyvIEsbwxQ8JkBWs97OBfqq+ocqApAXWj1BcunTWia7cfZ4F2cX+jFxXD3HoDM7g7QBqukfQHUhSZbPmNUsp7vw4XFO7i41A3DcmcRIE01wApQu/WYWJ9IYxzHIZFIIJmI7w+gLrSm2QHKmlneiwvhHlyKdOHySidaVjuKANJ7tqGUpnkJMJlMIB6PIxHf1gFQnYTqQjs7zyy/I1tuiNym4LdwZbUdV5/eUAFwFbMvOCBQkbLMY7EYtrdjlQEEUfmjMD2zLE98EE0FIsoSCPpFKPA8UlySAm8rADEdgGRKcYB929mk1UhIlRxgLasHnk+BSynrzrLe2tqSpQsQ59LyJxk7GWQlHkAWyFNfRkCOhB2J+t6Rdkh5ZRwZvMspRVY4/9OiCJ4cSVFwjjJP0Nqz9S+IuaELwAYOS3sA2H/0vgGz3PkhMtH7FrsLdpcbVocbZqsTxgrPqXWz43YJ4OP1v7/+BnvlpAT3X7SfAAAAAElFTkSuQmCC1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"clean","threat_score":0,"unified_at_epoch_ms":1793653025540,"unified_at":"2026-11-02T20:57:05.540Z","metadata":{"hashes":{"sha256":"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4","sha1":"75be7a26559d6ea7a8c5358d85d8bf917dc6d188","md5":"632afd52b8008cf06347f200e2f389e2","sha512":"f368ca74e2a4f786c363974024c9ff3789e7f1f54a7620294c4e0c247357059e196b77aeeee099524375d93104005ce79d82c00c8745a20efb93b5a18a87ec38","ssdeep":"768:JEBXVOoWIiVJTS6AeCIkSk9Mdf1NPGU4jvG2Y2pDdMi2jpvF:6XVO8iPS6jCI1k9wKLjvg21m95F","ssdeep_chunks":["768:JEBXVOo","768:EBXVOoW","768:BXVOoWI","768:XVOoWIi","768:VOoWIiV","768:OoWIiVJ","768:oWIiVJT","768:WIiVJTS","768:IiVJTS6","768:iVJTS6A","768:VJTS6Ae","768:JTS6AeC","768:TS6AeCI","768:S6AeCIk","768:6AeCIkS","768:AeCIkSk","768:eCIkSk9","768:CIkSk9M","768:IkSk9Md","768:kSk9Mdf","768:Sk9Mdf1","768:k9Mdf1N","768:9Mdf1NP","768:Mdf1NPG","768:df1NPGU","768:f1NPGU4","768:1NPGU4j","768:NPGU4jv","768:PGU4jvG","768:GU4jvG2","768:U4jvG2Y","768:4jvG2Y2","768:jvG2Y2p","768:vG2Y2pD","768:G2Y2pDd","768:2Y2pDdM","768:Y2pDdMi","768:2pDdMi2","768:pDdMi2j","768:DdMi2jp","768:dMi2jpv","768:Mi2jpvF","1536:JEBXVOo","1536:EBXVOoW","1536:BXVOoWI","1536:XVOoWIi","1536:VOoWIiV","1536:OoWIiVJ","1536:oWIiVJT","1536:WIiVJTS","1536:IiVJTS6","1536:iVJTS6A","1536:VJTS6Ae","1536:JTS6AeC","1536:TS6AeCI","1536:S6AeCIk","1536:6AeCIkS","1536:AeCIkSk","1536:eCIkSk9","1536:CIkSk9M","1536:IkSk9Md","1536:kSk9Mdf","1536:Sk9Mdf1","1536:k9Mdf1N","1536:9Mdf1NP","1536:Mdf1NPG","1536:df1NPGU","1536:f1NPGU4","1536:1NPGU4j","1536:NPGU4jv","1536:PGU4jvG","1536:GU4jvG2","1536:U4jvG2Y","1536:4jvG2Y2","1536:jvG2Y2p","1536:vG2Y2pD","1536:G2Y2pDd","1536:2Y2pDdM","1536:Y2pDdMi","1536:2pDdMi2","1536:pDdMi2j","1536:DdMi2jp","1536:dMi2jpv","1536:Mi2jpvF","768:6XVO8iP","768:XVO8iPS","768:VO8iPS6","768:O8iPS6j","768:8iPS6jC","768:iPS6jCI","768:PS6jCI1","768:S6jCI1k","768:6jCI1k9","768:jCI1k9w","768:CI1k9wK","768:I1k9wKL","768:1k9wKLj","768:k9wKLjv","768:9wKLjvg","768:wKLjvg2","768:KLjvg21","768:Ljvg21m","768:jvg21m9","768:vg21m95","768:g21m95F"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":67440,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1793652920000,"last_seen":1793652920000,"last_multi_scan":1793652920000}},"detections":{"summary":{"verdict":"clean","score":0,"tags":["autokms","wacatac","wacapew","evasive"]},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":65},"sandbox_signatures":{"informative_count":164,"suspicious_count":17,"malicious_count":1,"total":182},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"whitelisted","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains native function calls (syscalls strings)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Calls an API typically used to create a process"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to list processes on remote desktop session host"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Able to gather system file/directory information (.NET)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Able to perform SQL operations"},{"type":"informative","value":"Contains SQL queries"},{"type":"informative","value":"Able to perform SQL operations (Dotnet)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"YARA signature match - RSA algorithm (keys)"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"informative","value":"Able to utilize the Windows bcrypt cryptographic API"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Loads the Bcrypt module DLL"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contains references to network communication API (string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"informative","value":"Contains ability to execute WMI queries (Dotnet)"},{"type":"suspicious","value":"Found a reference to a WMI query string known to be used for VM detection"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":".NET code is able to query registry"},{"type":"informative","value":"Contains registry location strings"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"tactic":"Stealth","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"suspicious","value":"Calls an API typically used to query local/system time as file time"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Able to access control system service controller"},{"type":"informative","value":"Contains ability to control system service controller"}],"sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Connects to LPC ports"}],"sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Loads rich edit control libraries"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"}],"sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"tactic":"Execution","technique":"DLL","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","identifiers":[{"type":"informative","value":"Potential hijacking of DLL execution flow detected"}],"sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Dotnet code contains ability to modify/delete registry"},{"type":"suspicious","value":"Modifies Software Policy Settings"}],"sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Imports system security related APIs"}],"sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"},{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"},{"type":"suspicious","value":"Adjusts debug privileges"}],"sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"tactic":"Discovery","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"}],"sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Queries the user identity associated with the current process token"}],"sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"tactic":"Discovery","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"suspicious","value":"Tries to sleep for a long time (more than two minutes)"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"tactic":"Discovery","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"suspicious","value":"Queries kernel debugger information"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"tactic":"Discovery","technique":"Domain Groups","attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"References Windows LDAP client module"},{"type":"informative","value":"Loads Windows LDAP client module"}],"sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to query network adapter information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API typically used to get handle of currently active window"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"}],"sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"tactic":"Discovery","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"suspicious","value":"Calls an API that may be used to take screenshots"}],"sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Calls an API typically used to send the specified request to the HTTP server"},{"type":"informative","value":"Calls an API typically used to to receive the response to a HTTP requests"},{"type":"informative","value":"Contains ability to provide interface for network protocols (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"informative","value":"Drops temp files"},{"type":"informative","value":"Drops XML files"}],"sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"suspicious","value":"Disables Windows services"},{"type":"informative","value":"Able to change the configuration parameters of a service"},{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains ability to perform encryption (API string)"},{"type":"informative","value":"Able to access crypto-related API (String)"},{"type":"informative","value":"Contains reference to crypto DLLs"},{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"tactic":"Stealth","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"tactic":"Stealth","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"tactic":"Stealth","technique":"Compile After Delivery","attack_id":"T1027.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/004","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"tactic":"Stealth","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"tactic":"Stealth","technique":"Masquerade File Type","attack_id":"T1036.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/008","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"tactic":"Stealth","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"tactic":"Stealth","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"tactic":"Stealth","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"tactic":"Stealth","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"tactic":"Defense Impairment","technique":"Disable or Modify Tools","attack_id":"T1685","attack_id_wiki":"https://attack.mitre.org/techniques/T1685","identifiers":[{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"}],"sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"tactic":"Defense Impairment","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a valid certificate"},{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]}],"sandbox_signatures":[{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RSA algorithm (keys)","description":"YARA signature for RSA public and private key matched on file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1027","id":"yara-62","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"General","name":"Contains native function calls (syscalls strings)","description":"$27","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-5000","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"Software\\Microsoft\\CCM\\Logging\\PolicyRequest\" in Source: sample.bin, \"Failed to open reg key Software\\Microsoft\\CCM\\Logging\\@GLOBAL on server - \" in Source: sample.bin, \"Software\\Microsoft\\SMS\\MP\" in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-120","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFile\" (Indicator: \"CreateFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-315","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"Found reference to API (Indicator: \"CreateFile\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"Sleep\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"CreateDirectory\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"QueueUserWorkItem\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"GetLength\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"CHCService.pdb\"","origin":"sample.bin","id":"string-7","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1074.001","id":"string-423","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"SELECT Name,Started,State,Status FROM Win32_Service where Name='WINMGMT' or Name='CCMEXEC' or Name='BITS' or Name='CLISVC' or Name='CCMSETUP'\" (Source: sample.bin, Indicator: \"select name,started,state,status from win32_service where name='winmgmt' or name='ccmexec' or name='bits' or name='clisvc' or name='ccmsetup'\")","origin":"sample.bin","mitre_attack_id":"T1213","id":"string-16","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"Ping is not configured to run on schedule.\" (Indicator: \"ping\"; Source: \"sample.bin\"), Found string \"Load Settings Ping\" (Indicator: \"ping\"; Source: \"sample.bin\"), Found string \"Done Loading Ping Settings\" (Indicator: \"ping\"; Source: \"sample.bin\"), Found string \"Ping\" (Indicator: \"ping\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-126","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-85","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to perform SQL operations","description":"Found string \"System.Data.SqlClient\" (Indicator: \"System.Data.SqlClient\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1213","id":"string-836","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"Found string \"SELECT Name,Started,State,Status FROM Win32_Service where Name='WINMGMT' or Name='CCMEXEC' or Name='BITS' or Name='CLISVC' or Name='CCMSETUP'\" (Indicator: \" Win32_Service\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-507","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"Found string \"Ping is not configured to run on schedule.\" (Indicator: \"ping \"; Source: \"sample.bin\"), Found string \"Ping\" (Indicator: \"ping\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1018","id":"string-417","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"2.0.0.0\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"Unable to connect the Registry for MP \" (Indicator: \" connect \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-899","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"crl.microsoft.com/pki/crl/products/cspca.crl0h\", Pattern match: \"http://www.microsoft.com/pki/certs/cspca.crt0\", Pattern match: \"http://www.microsoft.com/smserver/0\", Pattern match: \"crl.microsoft.com/pki/crl/products/tspca.crl0h\", Pattern match: \"http://www.microsoft.com/pki/certs/tspca.crt0\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a reference to a WMI query string known to be used for VM detection","description":"\"SELECT Name,Started,State,Status FROM Win32_Service where Name='WINMGMT' or Name='CCMEXEC' or Name='BITS' or Name='CLISVC' or Name='CCMSETUP'\" (Indicator: \" win32_service\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1047","id":"string-55","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetCreationTime\" (Indicator: \"GetCreationTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.006","id":"string-249","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00003564.00000000.98181.00C51000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00003564.00000000.98181.00C51000.00000020.mdmp\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00003564.00000000.98181.00C51000.00000020.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00003564.00000000.98181.00C51000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00005208.00000001.97736.01CB0000.00000004.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00005208.00000001.97736.01CB0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"SA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00005208.00000000.96334.00290000.00000004.mdmp, 00000000-00005208.00000001.97736.00290000.00000004.mdmp\")\n Found reference to \"CryptCNGInitHMAC\" (Indicator: \"HMAC\"; Source: \"00000000-00005208.00000000.96334.00290000.00000004.mdmp, 00000000-00005208.00000001.97736.00290000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00005208.00000001.97736.008F0000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005208.00000001.97736.01CB0000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$29","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4\")\n Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; File: \"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4\")\n Found reference to API \"OutputDebugStringA\" (Indicator: \"OutputDebugString\"; File: \"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4\")\n Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"file/memory contains long string with (Indicator: \"CryptProtectData\"; Source: \"00000000-00005208.00000001.97736.01CB0000.00000004.mdmp\")\n Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00005208.00000001.97736.01CB0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to utilize the Windows bcrypt cryptographic API","description":"Found reference to API \"BCryptOpenAlgorithmProvider\" (Indicator: \"BCryptOpenAlgorithmProvider\"; Source: \"00000000-00005208-00000C2C-344486203\")\n Found reference to API \"BCryptCloseAlgorithmProvider\" (Indicator: \"BCryptCloseAlgorithmProvider\"; Source: \"00000000-00005208-00000C2C-344782328\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-927","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"file/memory contains long string with (Indicator: \"CryptProtectData\"; Source: \"00000000-00005208.00000001.97736.01CB0000.00000004.mdmp\")\n Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00005208.00000001.97736.01CB0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00003564.00000000.98181.00330000.00000004.mdmp\")\n Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00005208.00000000.96334.00290000.00000004.mdmp, 00000000-00005208.00000001.97736.00290000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00005208.00000000.96334.00290000.00000004.mdmp, 00000000-00005208.00000001.97736.00290000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Able to utilize the Windows bcrypt cryptographic API\n Matched sigs: Contains reference to crypto DLLs\n Matched sigs: Contains reference to cryptographic keys\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to perform encryption (API string)\n Matched sigs: Able to access crypto-related API (String)\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Calls an API typically used to import cryptographic keys into a CSP\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"Found XOR loop in file \"DISMHOST.EXE.6AE906FB.bin\" at offset 76665; code bytes = 30d0\n Found XOR loop in file \"DISMHOST.EXE.6AE906FB.bin\" at offset 77648; code bytes = 8030\n Found XOR loop in file \"DISMHOST.EXE.6AE906FB.bin\" at offset 77788; code bytes = 8030\n Found XOR loop in file \"DISMHOST.EXE.6AE906FB.bin\" at offset 78978; code bytes = 8030\n Found XOR loop in file \"sample.bin\" at offset 63417; code bytes = 8030","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system file/directory information (.NET)","description":"Observed dotnet function \"GetFiles\" in \"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":3,"id":"static-200","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"DISMHOST.EXE.6AE906FB.bin\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00003564.00000000.98181.00C51000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00005208-00000C2C-342379663\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00005208-00000C2C-341298023\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00005208-00000C2C-341298772\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; File: \"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00003564.00000000.98181.00C51000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00005208-00000C2C-350854892\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; File: \"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4\")\n Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; Source: \"00000000-00003564.00000000.98181.00C51000.00000020.mdmp\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00003564.00000000.98181.00C51000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"SendMessage\" (Indicator: \"sendmessage\"; Source: \"00000000-00005208-00000C2C-366381260\")\n Found reference to API \"SendMessageW\" (Indicator: \"sendmessage\"; Source: \"00000000-00005208-00000C2C-366381811\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00005208)\n \"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00005208)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00005208)\n \"csc.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00003400)\n \"cvtres.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00005992)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe\" called \"GetForegroundWindow\" (UID: 00000000-00005208)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe\" called \"IsWow64Process\" with parameter \"5208\" - (UID: 00000000-00005208)\n \"csc.exe\" called \"IsWow64Process\" with parameter \"3400\" - (UID: 00000000-00003400)\n \"cvtres.exe\" called \"IsWow64Process\" with parameter \"5992\" - (UID: 00000000-00005992)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get handle of currently active window","description":"\"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe\" called \"GetActiveWindow\" (UID: 00000000-00005208)","origin":"API Call","mitre_attack_id":"T1010","relevance":5,"id":"api-150","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005208)\n \"csc.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00003400)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2a","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe\" called \"OpenMutexW\" with parameter \"Global\\CLR_CASOFF_MUTEX\" - (UID: 00000000-00005208)\n \"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe\" called \"OpenMutexW\" with parameter \"Local\\MSCTF.Asm.MutexDefault1\" - (UID: 00000000-00005208)\n \"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe\" called \"OpenMutexW\" with parameter \"Global\\netfxeventlog.1.0\" - (UID: 00000000-00005208)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$2b","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe\" called \"GetLocaleInfoW\" with parameter \"1024\" - (UID: 00000000-00005208)\n \"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00005208)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute WMI queries (Dotnet)","description":"Observed namespace \"System.Management.ManagementObjectSearcher\" in \"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4\"","origin":"Static Parser","mitre_attack_id":"T1047","relevance":1,"id":"static-114","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionExA\" (Indicator: \"GetVersionExA\"; File: \"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4\")\n Found reference to API \"GetVersionExA\" (Indicator: \"GetVersion\"; File: \"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4\")\n Found reference to API \"GetVersionExA\" (Indicator: \"GetVersionExA\"; Source: \"00000000-00003564.00000000.98181.00C51000.00000020.mdmp\")\n Found reference to API \"GetVersionExA\" (Indicator: \"GetVersion\"; Source: \"00000000-00003564.00000000.98181.00C51000.00000020.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"00000000-00003564.00000000.98181.00C51000.00000020.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"00000000-00003564.00000000.98181.00C51000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; File: \"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$2c","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Environment Awareness","name":"Queries the user identity associated with the current process token","description":"\"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe\" queried token user identity (UID: 00000000-00005208)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-328","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/26 Antivirus vendors marked sample as clean (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"General","name":".NET code is able to query registry","description":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"OpenRemoteBaseKey\" in \"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"OpenSubKey\" in \"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"GetValue\" in \"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4\"","origin":"Static Parser","mitre_attack_id":"T1012","relevance":5,"id":"static-138","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"file/memory contains long string(File: \"DISMHOST.EXE.6AE906FB.bin\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00003564.00000000.98181.00C51000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00003564.00000000.98181.00C51000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$2d","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe\" called \"CreateDirectoryW\" with parameter C:\\Users\\%OSUSER% (UID: 00000000-00005208)\n \"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData\\Roaming (UID: 00000000-00005208)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\csc.exe\" /noconfig /fullpaths @\"%TEMP%\\80jpydb6.cmdlin\" - (UID: 00000000-00005208), \"csc.exe\" called \"CreateProcessW\" with parameter \"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 \"/OUT:%LOCALAPPDATA%\\Temp\" - (UID: 00000000-00003400)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2e","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2f","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00003564.00000000.98181.00C51000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; File: \"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; File: \"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00003564.00000000.98181.00C51000.00000020.mdmp\")\n Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; Source: \"00000000-00003564.00000000.98181.00C51000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4\")\n Found reference to API \"CommandLineToArgvW\" (Indicator: \"CommandLineToArgv\"; File: \"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00003564.00000000.98181.00C51000.00000020.mdmp\")\n Found reference to API \"CommandLineToArgvW\" (Indicator: \"CommandLineToArgv\"; Source: \"00000000-00003564.00000000.98181.00C51000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00003564.00000000.98181.00C51000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00003564.00000000.98181.00C51000.00000020.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00003564.00000000.98181.00C51000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex\"\n Process d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Global\\netfxeventlog.1.0\"\n Process d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe created mutex with name \"Global\\netfxeventlog.1.0\"\n Process d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe created mutex with name \"Global\\CLR_PerfMon_WrapMutex\"","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"General","name":"Dotnet code contains ability to modify/delete registry","description":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"SetValue\" in \"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4\"","origin":"Static Parser","mitre_attack_id":"T1112","relevance":1,"id":"static-139","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"80jpydb6.dll\" as clean (type is \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections\"), Antivirus vendors marked dropped file \"DISMHOST.EXE.6AE906FB.bin\" as clean (type is \"PE32 executable for MS Windows 5.01 (GUI) Intel i386 4 sections\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe\" failed to load missing module \"api-ms-win-appmodel-runtime-l1-1-2.dll\" - [base:0; Status:c0000135]\n \"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe\" failed to load missing module \"api-ms-win-appmodel-runtime-l1-1-0.dll\" - [base:0; Status:c0000135]\n \"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\ole32.dll\" - [base:0; Status:c0000135]\n \"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe\" failed to load missing module \"%WINDIR%\\assembly\\GAC_MSIL\\System\\2.0.0.0__b77a5c561934e089\\psapi.dll\" - [base:0; Status:c0000135]\n \"csc.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll\" - [base:0; Status:c0000135]\n \"csc.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\ole32.dll\" - [base:0; Status:c0000135]","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"80jpydb6.dll\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"DISMHOST.EXE.6AE906FB.bin\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"cvtres@comp.id\"\n Pattern match: \"info@diginotar.nl\"\n Pattern match: \"cps-requests@verisign.com\"\n Pattern match: \"premium-server@thawte.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$30","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"General","name":"Loads Windows LDAP client module","description":"\"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe\" loaded module \"%WINDIR%\\System32\\Wldap32.dll\" at 771F0000","origin":"Loaded Module","mitre_attack_id":"T1069.002","relevance":3,"id":"module-17","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$31","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe\" loaded module \"%WINDIR%\\System32\\riched20.dll\" at 63B70000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-2","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\9f895c66454577eff9c77442d0c84f71\\mscorlib.ni.dll\" at 63CE0000\n \"csc.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorlib.dll\" at 024D0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 74A10000\n \"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 745D0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 756F0000\n \"csc.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 756F0000\n \"cvtres.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 756F0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"150016002073e864@ADVAPI32.dll\"\n \"0e000f00e473e864@ADVAPI32.dll\"\n \"0e000f005074e864@ADVAPI32.dll\"\n \"11001200d47de864@ADVAPI32.dll\"\n \"110012007c7ee864@ADVAPI32.dll\"\n \"12001300cc7ee864@ADVAPI32.dll\"\n \"12001300387fe864@ADVAPI32.dll\"\n \"14001500dcb8e864@ADVAPI32.dll\"\n \"14001500f8b8e864@ADVAPI32.dll\"\n \"1400150014b9e864@ADVAPI32.dll\"\n \"1700180030b9e864@ADVAPI32.dll\"\n \"0d000e004cb9e864@ADVAPI32.dll\"\n \"110012005cb9e864@ADVAPI32.dll\"\n \"1100120074b9e864@ADVAPI32.dll\"\n \"0d000e009c7fe864@shell32.dll\"\n \"0d000e002880e864@shell32.dll\"\n \"10001100a4bae864@CRYPT32.dll\"\n \"12001300ccbae864@CRYPT32.dll\"\n \"0f001000e4bae864@ADVAPI32.dll\"\n \"14001500f8bae864@CRYPT32.dll\"\n \"1400150014bbe864@CRYPT32.dll\"\n \"1400150030bbe864@ADVAPI32.dll\"\n \"140015004cbbe864@ADVAPI32.dll\"\n \"1400150068bbe864@CRYPT32.dll\"\n \"1400150084bbe864@CRYPT32.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4\" was detected as \".NET\" and name: \"Library\"\n \"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"80jpydb6.dll\" was detected as \".NET\" and name: \"Library\"\n \"80jpydb6.dll\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"DISMHOST.EXE.6AE906FB.bin\" was detected as \".NET\" and name: \"Library\"\n \"DISMHOST.EXE.6AE906FB.bin\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"\n \"80jpydb6.dll\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","id":"static-144","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"DISMHOST.EXE.6AE906FB.bin\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4\" has an executable section named \".text\"\n \"80jpydb6.dll\" has an executable section named \".text\"\n \"DISMHOST.EXE.6AE906FB.bin\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"DISMHOST.EXE.6AE906FB.bin\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$32","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"\"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\csc.exe\" /noconfig /fullpaths @\"%TEMP%\\80jpydb6.cmdlin\" [Source: 00000000-00005208-00000C47-44928273466], Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 \"/OUT:%LOCALAPPDATA%\\Temp\" [Source: 00000000-00003400-00000C47-3260237914]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$33","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"General","name":"References Windows LDAP client module","description":"Found string \":\\Windows\\system32\\WLDAP32.dll\" (Source: \"00000000-00005208.00000001.97736.00290000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1069.002","relevance":1,"id":"string-987","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"General","name":"Sample shows a variety of benign indicators","description":"The input file/all extracted files were not detected as malicious and the input file is signed with a validated certificate","origin":"Indicator Combinations","relevance":10,"id":"summary-6","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"csc.exe\" with commandline \"/noconfig /fullpaths @\"%TEMP%\\\\80jpydb6.cmdline\"\" (UID: 00000000-00003400)\n Spawned process \"cvtres.exe\" with commandline \"/NOLOGO /READONLY /MACHINE:IX86 \"/OUT:%TEMP%\\\\RES2A0D.tmp\" \"%TEM ...\" (UID: 00000000-00005992)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"csc.exe\" with commandline \"/noconfig /fullpaths @\"%TEMP%\\\\80jpydb6.cmdline\"\" (UID: 00000000-00003400)\n Spawned process \"cvtres.exe\" with commandline \"/NOLOGO /READONLY /MACHINE:IX86 \"/OUT:%TEMP%\\\\RES2A0D.tmp\" \"%TEM ...\" (UID: 00000000-00005992)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=Microsoft Root Authority, OU=Microsoft Corporation, OU=Copyright c 1997 Microsoft Corp.\" (SHA1: 30:36:E3:B2:5B:88:A5:5B:86:FC:90:E6:E9:EA:AD:50:81:44:51:66; see report for more information)\n The input sample is signed with a certificate issued by \"CN=Microsoft Code Signing PCA, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US\" (SHA1: 96:17:09:4A:1C:FB:59:AE:7C:1F:7D:FD:B6:73:9E:4E:7C:40:50:8F; see report for more information)\n The input sample is signed with a certificate issued by \"CN=Microsoft Root Authority, OU=Microsoft Corporation, OU=Copyright c 1997 Microsoft Corp.\" (SHA1: 3E:A9:9A:60:05:82:75:E0:ED:83:B8:92:A9:09:44:9F:8C:33:B2:45; see report for more information)\n The input sample is signed with a certificate issued by \"CN=Microsoft Timestamping PCA, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US\" (SHA1: 05:FE:CB:74:5F:7F:3B:1A:0E:26:2A:73:43:5C:CB:7E:AA:ED:8B:37; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"General","name":"The input sample is signed with a valid certificate","description":"The entire certificate chain of the input sample was validated successfully.","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-2","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"80jpydb6.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"DISMHOST.EXE.6AE906FB.bin\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\80jpydb6.0.cs\"\n \"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\80jpydb6.cmdline\"\n \"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\80jpydb6.out\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","mitre_attack_id":"T1559","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00003564.00000000.98181.00C51000.00000020.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00003564.00000000.98181.00C51000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$35","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops XML files","description":"\"CHStatus.xml\" has type \"XML 1.0 document ASCII text with CRLF line terminators\" - Location: [C:\\CHStatus.xml]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-39","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"\"RES2A0D.tmp\" has type \"Intel i386 COFF object file not stripped 3 sections symbol offset=0x426 9 symbols created Mon Nov 2 20:56:01 2026 1st section name \".debug$S\" 2nd section name \".rsrc$01\"\"\n \"CSC29FC.tmp\" has type \"Microsoft Visual C binary resource file\"","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$36","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Installation/Persistence","name":"Potential hijacking of DLL execution flow detected","description":"\"80jpydb6.dll\" has type \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections\"- Location: [%TEMP%\\80jpydb6.dll]- [targetUID: 00000000-00005208]","origin":"Binary File","mitre_attack_id":"T1574.001","relevance":5,"id":"binary-91","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe\" queries basic process information of the \"C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp\" (UID: 5208)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$37","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe\" reads file \"c:\\windows\\microsoft.net\\framework\\v2.0.50727\\config\\machine.config\"\n \"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe\" reads file \"c:\\users\\%osuser%\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\57c8edb95df3f0ad4ee2dc2b8cfd4157\"\n \"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe\" reads file \"c:\\users\\%osuser%\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\7b2238aaccedc3f1ffe8e7eb5f575ec9\"\n \"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe\" reads file \"c:\\users\\%osuser%\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\7b2238aaccedc3f1ffe8e7eb5f575ec9\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Tries to sleep for a long time (more than two minutes)\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$38","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$39","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$3a","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$3b","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"$3c","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to send the specified request to the HTTP server","description":"\"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe\" called \"WinHttpSendRequest\" with parameters {\"hRequest\": \"383678\"\n \"lpszHeaders\": \"If-None-Match: \\\"084627641cfd61:0\\\"If-Modified-Since: Thu, 10 Dec 2020 22:11:52 GMT\"\n \"dwHeadersLength\": \"4294967295\"\n \"dwOptionalLength\": \"0\"\n \"dwTotalLength\": \"0\"\n \"dwContext\": \"0\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-190","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to to receive the response to a HTTP requests","description":"\"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"383678\"\n \"lpReserved\": \"0\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-191","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Network Related","name":"Contains ability to provide interface for network protocols (Dotnet)","description":"Observed namespace \"System.Net\" in \"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4\"\n Observed namespace \"System.Net.NetworkInformation\" in \"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4\"","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-110","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"www.mail.google.com0\" [Source: 00000000-00005208.00000001.97736.00290000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$3e","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLE7C0CFCE676EC47299F904170F41B]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00003564.00000000.98181.00330000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00003564.00000000.98181.00330000.00000004.mdmp\")\n Found string \":\\Windows\\system32\\kerberos.DLL\" (Indicator: \"kerberos\"; Source: \"00000000-00005208.00000001.97736.00290000.00000004.mdmp\")\n Found string \"crosoft Kerberos V1.0\" (Indicator: \"kerberos\"; Source: \"00000000-00005208.00000001.97736.00290000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to perform SQL operations (Dotnet)","description":"$3f","origin":"Static Parser","mitre_attack_id":"T1213","relevance":10,"id":"static-175","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegQueryValueExW\" in \"00000000-00003564.00000000.98181.00C51000.00000020.mdmp\"\n Found registry query API: \"RegOpenKeyExW\" in \"00000000-00003564.00000000.98181.00C51000.00000020.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$40","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$41","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query network adapter information (API string)","description":"Found reference to API \"447294,2324,3185,,GetAdaptersAddresses,Iphlpapi.dll,\"00:42:54.425\",RX=0,PX=0\" (Indicator: \"GetAdaptersAddresses\"; Source: \"00000000-00005208.00000001.97736.04270000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-118","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00003564.00000000.98181.00C51000.00000020.mdmp\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00003564.00000000.98181.00C51000.00000020.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00003564.00000000.98181.00C51000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00003564.00000000.98181.00C51000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; File: \"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4\")\n Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00003564.00000000.98181.00C51000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; File: \"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4\")\n Found reference to API \"GetSystemDirectoryW\" (Indicator: \"GetSystemDirectory\"; File: \"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4\")\n Found reference to API \"GetSystemDirectoryW\" (Indicator: \"GetSystemDirectory\"; Source: \"00000000-00003564.00000000.98181.00C51000.00000020.mdmp\")\n Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; Source: \"00000000-00003564.00000000.98181.00C51000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00003564.00000000.98181.00C51000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00003564.00000000.98181.00C51000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"p_DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00003564.00000000.98181.00C51000.00000020.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"file/memory contains long string with (Indicator: \"password\"; Source: \"00000000-00005208.00000001.97736.01CB0000.00000004.mdmp\")\n Found string \"passwordFormat\" (Indicator: \"password\"; Source: \"00000000-00005208.00000001.97736.01CB0000.00000004.mdmp\")\n Found string \"passwordAttemptWindow\" (Indicator: \"password\"; Source: \"00000000-00005208.00000001.97736.01CB0000.00000004.mdmp\")\n Found string \"passwordStrengthRegularExpression\" (Indicator: \"password\"; Source: \"00000000-00005208.00000001.97736.01CB0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"System Security","name":"Able to access control system service controller","description":"Found string \"ServiceController\" (Source: \"00000000-00005208.00000000.96334.000F2000.00000020.mdmp\")\n Found string \"ServiceControllerStatus\" (Source: \"00000000-00005208.00000000.96334.000F2000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-936","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"System Security","name":"Able to change the configuration parameters of a service","description":"Found string \"ChangeServiceConfigA\" (Indicator: \"changeserviceconfiga\"; Source: \"00000000-00005208-00000C2C-351220556\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-10073","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe\" called an API \"AdjustTokenPrivileges\"on file: C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp\" (UID: 00000000-00005208)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\HarddiskVolume2\\Windows\\Temp\\6E6EABFD-3E2E-4E8D-8AE7-88B79CC49EE3\\DismHost.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00003564.00000000.98181.00330000.00000004.mdmp\")\n Found string \"\\Device\\HarddiskVolume2\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll\" (Indicator: \"\\Device\\\"; Source: \"00000000-00005208.00000000.96334.00290000.00000004.mdmp, 00000000-00005208.00000001.97736.00290000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"System Security","name":"Contains ability to control system service controller","description":"Observed function \"ServiceController\" in \"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4\"","origin":"Static Parser","mitre_attack_id":"T1569.002","relevance":1,"id":"static-117","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00005208.00000001.97736.01CB0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$42","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00003564.00000000.98181.00C51000.00000020.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00003564.00000000.98181.00C51000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\EVENTLOG\\APPLICATION\"; Key: \"AUTOBACKUPLOGFILES\"; Value: \"0000000000\")\n \"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\EVENTLOG\\APPLICATION\\CHCSERVICE\")\n \"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\EVENTLOG\\APPLICATION\\CHCSERVICE\"; Key: \"EVENTMESSAGEFILE\"; Value: \"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\EventLogMessages.dll\")\n \"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"$43","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe\" opened \"\\Device\\KsecDD\"\n \"csc.exe\" opened \"\\Device\\KsecDD\"\n \"cvtres.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$44","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"\"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\LOCAL SETTINGS\\MUICACHE\\137\\52C64B7E\"; Key: \"LANGUAGELIST\"; Value: \"en-US\")\n \"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\EVENTLOG\\APPLICATION\"; Key: \"AUTOBACKUPLOGFILES\"; Value: \"0000000000\")\n \"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\EVENTLOG\\APPLICATION\\CHCSERVICE\"; Key: \"EVENTMESSAGEFILE\"; Value: \"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\EventLogMessages.dll\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"80jpydb6.dll\" has type \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections\"- Location: [%TEMP%\\80jpydb6.dll]- [targetUID: 00000000-00005208]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"57C8EDB95DF3F0AD4EE2DC2B8CFD4157\" - Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00005208]\n Dropped file: \"57C8EDB95DF3F0AD4EE2DC2B8CFD4157\" - Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00005208]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"QueueUserWorkItem\" (Source: d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4, API is part of module: KERNEL32.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4\" was detected as \"Microsoft Visual C# v7.0 / Basic .NET\"\n \"80jpydb6.dll\" was detected as \"Microsoft Visual C# v7.0 / Basic .NET\"\n \"DISMHOST.EXE.6AE906FB.bin\" was detected as \"Visual C++ 2005 Release -> Microsoft\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Queries kernel debugger information","description":"\"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe\" at 00000000-00005208-00000105-3612967\n \"csc.exe\" at 00000000-00003400-00000105-762502\n \"cvtres.exe\" at 00000000-00005992-00000105-62406","origin":"API Call","mitre_attack_id":"T1622","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Uses a Windows Living Off The Land Binaries (LOL bins)","description":"Process \"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\csc.exe\" launched with commandline \"/noconfig /fullpaths @\"%TEMP%\\\\80jpydb6.cmdline\"\" (UID: 00000000-00003400)","origin":"Monitored Target","relevance":3,"id":"target-411","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe\" is allocating memory with PAGE_GUARD access rights (Handle: 4294967295); (PID: 5208)","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"suspicious","category":"Environment Awareness","name":"Calls an API typically used to query local/system time as file time","description":"\"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe\" called \"FileTimeToSystemTime\" (UID: 00000000-00005208)","origin":"API Call","mitre_attack_id":"T1070.006","relevance":3,"id":"api-223","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"suspicious","category":"Environment Awareness","name":"Tries to sleep for a long time (more than two minutes)","description":"\"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe\" sleeping for \"1566804069\" milliseconds","origin":"API Call","mitre_attack_id":"T1497.003","relevance":10,"id":"api-24","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"80jpydb6.dll\" has type \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections\"- Location: [%TEMP%\\80jpydb6.dll]- [targetUID: 00000000-00005208]\n \"DISMHOST.EXE.6AE906FB.bin\" has type \"PE32 executable for MS Windows 5.01 (GUI) Intel i386 4 sections\"- [targetUID: 00000000-00005208]","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"root\\cimv2\" (Indicator: \"root\\cimv2\"; in Source: \"00000000-00005208.00000000.96334.000F2000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API that may be used to take screenshots","description":"\"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"b4010208\"\n \"cx\": \"479\"\n \"cy\": \"25\"}\n \"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"18010db5\"\n \"cx\": \"16\"\n \"cy\": \"16\"}\n \"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"18010db5\"\n \"cx\": \"479\"\n \"cy\": \"25\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":1,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found an instant messenger related domain","description":"\"login.skype.com0\" (Indicator: \"skype.com\")\n \"login.skype.com\" (Indicator: \"skype.com\")\n \"www.login.skype.com0\" (Indicator: \"skype.com\")","origin":"File/Memory","relevance":10,"id":"string-61","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\80jpydb6.cmdline\" for deletion\n \"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\80jpydb6.tmp\" for deletion\n \"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\80jpydb6.dll\" for deletion\n \"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\80jpydb6.out\" for deletion\n \"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\80jpydb6.err\" for deletion\n \"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\80jpydb6.0.cs\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$45","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"suspicious","category":"System Security","name":"Adjusts debug privileges","description":"\"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe\" adjusted SE_DEBUG_PRIVILEGE on file \"C:\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp\"","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-28","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"suspicious","category":"System Security","name":"Disables Windows services","description":"\"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\EVENTLOG\\APPLICATION\"; Key: \"AUTOBACKUPLOGFILES\"; Value: \"0000000000\")","origin":"Registry Access","mitre_attack_id":"T1489","relevance":5,"id":"registry-187","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$46","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"80jpydb6.dll\" claimed CRC 124672 while the actual is CRC 16173","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"SetSecurityDescriptorDacl\n RegOpenKeyExW\n RegCloseKey\n GetStartupInfoA\n CreateFileW\n FindResourceExW\n GetProcAddress\n GetVersionExA\n GetCommandLineW\n CreateFileMappingW\n GetFileAttributesW\n GetModuleHandleW\n GetSystemDirectoryW\n UnhandledExceptionFilter\n GetModuleHandleA\n GetTickCount\n Sleep\n GetModuleHandleExW\n LoadLibraryExW\n CreateThread\n GetVersionExW\n MapViewOfFile\n LoadLibraryW\n OutputDebugStringW\n OutputDebugStringA\n TerminateProcess\n GetModuleFileNameW","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe\" wrote 32 bytes to a remote process \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\csc.exe\" (Handle: 1168)\n \"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe\" wrote 52 bytes to a remote process \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\csc.exe\" (Handle: 1168)\n \"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe\" wrote 4 bytes to a remote process \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\csc.exe\" (Handle: 1168)\n \"csc.exe\" wrote 32 bytes to a remote process \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\cvtres.exe\" (Handle: 256)\n \"csc.exe\" wrote 52 bytes to a remote process \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\cvtres.exe\" (Handle: 256)\n \"csc.exe\" wrote 4 bytes to a remote process \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\cvtres.exe\" (Handle: 256)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]}],"intel_graph":{"map":{"File:00350bb2e80a1239a7d58091f0b94a375328780dbf5481ab41e47140e743eb02":{"type":"File","value":"00350bb2e80a1239a7d58091f0b94a375328780dbf5481ab41e47140e743eb02"},"File:0b9f806d0f78d35564dd84373cb77e79c8b37f87f6dbc70e2220eabd97af0587":{"type":"File","value":"0b9f806d0f78d35564dd84373cb77e79c8b37f87f6dbc70e2220eabd97af0587","filetype":"DER Encoded PKCS#7 Signed Data","filetype_short":"PKCS7","mime_type":"application/octet-stream"},"File:159da75250d5c459683d176637ea7c67db21453f2d367c77abd539c0efa35593":{"type":"File","value":"159da75250d5c459683d176637ea7c67db21453f2d367c77abd539c0efa35593"},"File:1f2719b100fcc59601f0dbb286aea5034e05bae881425792a115106e244a0ed0":{"type":"File","value":"1f2719b100fcc59601f0dbb286aea5034e05bae881425792a115106e244a0ed0"},"File:53ea37567da63d69e8752d19efb472b0a39a6e7c5b4998820e849e22b32d6920":{"type":"File","value":"53ea37567da63d69e8752d19efb472b0a39a6e7c5b4998820e849e22b32d6920"},"File:661de6c99651b0043af047b735c47180856fbff443fa2a6d29669e31fd268b30":{"type":"File","value":"661de6c99651b0043af047b735c47180856fbff443fa2a6d29669e31fd268b30"},"File:a5e8d00a0d1d2c892338e6a1d0e961f25ec6988f0bf8cad99156e6bcf10b0af6":{"type":"File","value":"a5e8d00a0d1d2c892338e6a1d0e961f25ec6988f0bf8cad99156e6bcf10b0af6"},"File:d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4":{"type":"File","value":"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4","filetype":"PE32 executable for MS Windows 4.00 (GUI), Intel i386 Mono/.Net assembly, 3 sections","filetype_short":"PE32"},"File:d760549df03762fdd3da9ff31799384025656a39ce7fb6f86eba859fb1405e2e":{"type":"File","value":"d760549df03762fdd3da9ff31799384025656a39ce7fb6f86eba859fb1405e2e"},"File:e9c2ff149b198f01b3bd4cc38af10132cfd33fc7419c04029a53010b4f0054dd":{"type":"File","value":"e9c2ff149b198f01b3bd4cc38af10132cfd33fc7419c04029a53010b4f0054dd"},"File:ecb636b278261eade712e68ec7d805d20e802628248da872d3d0ada1432ffc11":{"type":"File","value":"ecb636b278261eade712e68ec7d805d20e802628248da872d3d0ada1432ffc11"}},"chains":[{"id":"1566918689395362280","root":"File:d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4","to_key":"File:0b9f806d0f78d35564dd84373cb77e79c8b37f87f6dbc70e2220eabd97af0587"}],"verdict":{"verdict":"unknown"}},{"id":"sandbox_files","root":"File:d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4","edges":[{"edge_kind":"extracted","from_key":"File:d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4","to_key":"File:0b9f806d0f78d35564dd84373cb77e79c8b37f87f6dbc70e2220eabd97af0587"},{"edge_kind":"extracted","from_key":"File:d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4","to_key":"File:53ea37567da63d69e8752d19efb472b0a39a6e7c5b4998820e849e22b32d6920"},{"edge_kind":"extracted","from_key":"File:d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4","to_key":"File:ecb636b278261eade712e68ec7d805d20e802628248da872d3d0ada1432ffc11"},{"edge_kind":"extracted","from_key":"File:d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4","to_key":"File:e9c2ff149b198f01b3bd4cc38af10132cfd33fc7419c04029a53010b4f0054dd"},{"edge_kind":"extracted","from_key":"File:d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4","to_key":"File:d760549df03762fdd3da9ff31799384025656a39ce7fb6f86eba859fb1405e2e"},{"edge_kind":"extracted","from_key":"File:d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4","to_key":"File:00350bb2e80a1239a7d58091f0b94a375328780dbf5481ab41e47140e743eb02"},{"edge_kind":"extracted","from_key":"File:d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4","to_key":"File:1f2719b100fcc59601f0dbb286aea5034e05bae881425792a115106e244a0ed0"},{"edge_kind":"extracted","from_key":"File:d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4","to_key":"File:661de6c99651b0043af047b735c47180856fbff443fa2a6d29669e31fd268b30"},{"edge_kind":"extracted","from_key":"File:d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4","to_key":"File:159da75250d5c459683d176637ea7c67db21453f2d367c77abd539c0efa35593"},{"edge_kind":"extracted","from_key":"File:d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4","to_key":"File:a5e8d00a0d1d2c892338e6a1d0e961f25ec6988f0bf8cad99156e6bcf10b0af6"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":4,"imported_dlls_count":104,"dropped_files_count":0,"extracted_files_count":10,"files_written_count":14,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":2,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["autokms","wacatac","wacapew","evasive"],"sample_flags":["Extracted Files"],"sandbox_reports":[{"id":"6ae8f8b70602d1bf450acea4","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"clean","submit_name":"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4","analysis_start_time":"2026-11-02T20:55:21+00:00","indicators_count":{"informative":163,"suspicious":31,"malicious":1},"tags":["Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}],"processes":[{"pid":5208,"ppid":0,"name":"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe","command_line":"","sha256":"d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4","normalized_path":"C:\\d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4.exe","uid":"00000000-00005208","icon":"$47"},{"pid":3400,"ppid":5208,"name":"csc.exe","command_line":"/noconfig /fullpaths @\"%TEMP%\\80jpydb6.cmdline\"","sha256":"729aa4033009ac894c1ef2a57dfd097be5d562dda70533820540904c2ef7882a","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\csc.exe","parent_uid":"00000000-00005208","uid":"00000000-00003400"},{"pid":5992,"ppid":3400,"name":"cvtres.exe","command_line":"/NOLOGO /READONLY /MACHINE:IX86 \"/OUT:%TEMP%\\RES2A0D.tmp\" \"%TEMP%\\CSC29FC.tmp\"","sha256":"c97f276b4c70682c8f8d39b91e30f938bc6e86a42cd6b71e3ad08092dba528e9","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\cvtres.exe","parent_uid":"00000000-00003400","uid":"00000000-00005992"}],"all_imported_dlls":["System.XML.dll","ntdll.dll","crypt32.dll","IPHLPAPI.DLL","dhcpcsvc6.dll","System.Windows.Forms.ni.dll","rpcss.dll","mscorpe.dll","comctl32.dll","kernel32.dll","fltLib.dll","msvcp140.dll","api-ms-win-crt-string-l1-1-0.dll","msvcr80.dll","webio.dll","rasadhlp.dll","riched20.dll","mscoreei.dll","api-ms-win-core-synch-l1-2-0.dll","user32.dll","api-ms-win-core-file-l2-1-0.dll","msctf.dll","cryptnet.dll","System.ni.dll","wintrust.dll","cryptsp.dll","rsaenh.dll","gdi32.dll","lpk.dll","ole32.dll","api-ms-win-core-timezone-l1-1-0.dll","api-ms-win-crt-locale-l1-1-0.dll","mscoree.dll","sechost.dll","oleaut32.dll","shlwapi.dll","profapi.dll","api-ms-win-crt-math-l1-1-0.dll","imagehlp.dll","bcryptprimitives.dll","api-ms-win-crt-time-l1-1-0.dll","imm32.dll","userenv.dll","SensApi.dll","wship6.dll","mscorjit.dll","dwmapi.dll","nsi.dll","mscorsec.dll","dnsapi.dll","System.ServiceProcess.ni.dll","psapi.dll","Culture.dll","clbcatq.dll","api-ms-win-crt-stdio-l1-1-0.dll","sspicli.dll","credssp.dll","dhcpcsvc.dll","uxtheme.dll","alink.dll","msvcrt.dll","api-ms-win-core-localization-l1-2-0.dll","api-ms-win-crt-filesystem-l1-1-0.dll","api-ms-win-crt-environment-l1-1-0.dll","shell32.dll","gpapi.dll","rpcrt4.dll","vcruntime140.dll","api-ms-win-crt-convert-l1-1-0.dll","msasn1.dll","cryptbase.dll","mscorrc.dll","api-ms-win-core-processthreads-l1-1-1.dll","api-ms-win-crt-utility-l1-1-0.dll","winnsi.dll","cfgmgr32.dll","System.Configuration.ni.dll","System.Drawing.ni.dll","api-ms-win-crt-heap-l1-1-0.dll","mscorwks.dll","tzres.dll","advapi32.dll","api-ms-win-crt-runtime-l1-1-0.dll","api-ms-win-core-file-l1-2-0.dll","VxSSL32.dll","version.dll","mswsock.dll","cscompui.dll","cscomp.dll","mscorlib.dll","KernelBase.dll","ucrtbase.dll","ws2_32.dll","ncrypt.dll","Wldap32.dll","WSHTCPIP.DLL","FWPUCLNT.DLL","System.Xml.ni.dll","usp10.dll","mscorlib.ni.dll","bcrypt.dll","winhttp.dll","wshqos.dll","apphelp.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"0b9f806d0f78d35564dd84373cb77e79c8b37f87f6dbc70e2220eabd97af0587","sha256":"0b9f806d0f78d35564dd84373cb77e79c8b37f87f6dbc70e2220eabd97af0587","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"80jpydb6.dll","sha256":"53ea37567da63d69e8752d19efb472b0a39a6e7c5b4998820e849e22b32d6920","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"name":"DISMHOST.EXE.6AE906FB.bin","sha256":"ecb636b278261eade712e68ec7d805d20e802628248da872d3d0ada1432ffc11","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"name":"80jpydb6.cmdline","sha256":"e9c2ff149b198f01b3bd4cc38af10132cfd33fc7419c04029a53010b4f0054dd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"name":"RES2A0D.tmp","sha256":"d760549df03762fdd3da9ff31799384025656a39ce7fb6f86eba859fb1405e2e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"name":"CSC29FC.tmp","sha256":"00350bb2e80a1239a7d58091f0b94a375328780dbf5481ab41e47140e743eb02","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"name":"57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sha256":"1f2719b100fcc59601f0dbb286aea5034e05bae881425792a115106e244a0ed0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"name":"80jpydb6.0.cs","sha256":"661de6c99651b0043af047b735c47180856fbff443fa2a6d29669e31fd268b30","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"name":"80jpydb6.out","sha256":"159da75250d5c459683d176637ea7c67db21453f2d367c77abd539c0efa35593","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"name":"CHStatus.xml","sha256":"a5e8d00a0d1d2c892338e6a1d0e961f25ec6988f0bf8cad99156e6bcf10b0af6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]}],"files_written":[{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{6BF8667D-AFE0-478A-9AA7-D762C1E66954}","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"path":"C:\\CHStatus.xml","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"path":"%TEMP%\\80jpydb6.tmp","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"path":"%TEMP%\\80jpydb6.0.cs","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"path":"%TEMP%\\80jpydb6.dll","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"path":"%TEMP%\\80jpydb6.cmdline","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"path":"%TEMP%\\80jpydb6.out","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"path":"%TEMP%\\80jpydb6.err","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\FUSION\\GACCHANGENOTIFICATION\\DEFAULT\\","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\netfxeventlog.1.0","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"name":"Global\\netfxeventlog.1.0","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]},{"name":"Global\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"6ae8f8b70602d1bf450acea4"}]}]}},"report_ids":{"sandbox_job_ids":["6ae8f8b70602d1bf450acea4"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Clean Sample d4c14e034969… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Clean verdict for sample d4c14e034969…. Threat score 0/100. 0/27 AV engines flagged this file. 1 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4"}],["$","meta","4",{"property":"og:title","content":"Clean Sample d4c14e034969… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Clean verdict for sample d4c14e034969…. Threat score 0/100. 0/27 AV engines flagged this file. 1 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/d4c14e0349694fc4a044c3d9c432d2a20c0eee8d65315f6dc9e61f998c46d0c4"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Clean Sample d4c14e034969… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Clean verdict for sample d4c14e034969…. Threat score 0/100. 0/27 AV engines flagged this file. 1 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L48","11",{}]]