24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 4c:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T48e,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan/Generic Sample d678623c64c7… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample d678623c64c7…. Malware family: Trojan/Generic. Threat score 100/100. 14/27 AV engines flagged this file. 13 malicious and 34 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8","keywords":["Malicious","Trojan/Generic","malware analysis","sandbox report","threat intelligence","d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8"],"about":{"@type":"SoftwareApplication","name":"cw.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan/Generic","antivirusDetections":{"malicious":14,"total":27},"behavioralIndicators":{"malicious":13,"suspicious":34},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T494,"CreateCompatibleDC" (Indicator: "CreateCompatibleDC") "DeleteObject" (Indicator: "DeleteObject") "SelectObject" (Indicator: "SelectObject") "LoadResourceFont" (Indicator: "LoadResource") "connectdevelop" (Indicator: "connect") "folder-openchart-bar" (Indicator: "open") "stop-circlehandshake envelope-open" (Indicator: "open") "flushed frown-open" (Indicator: "open") "deaf sign-language low-visionhandshake envelope-open" (Indicator: "open") "level-up-altlock-open" (Indicator: "open") "blenderbook-open" (Indicator: "open") "door-closeddoor-open" (Indicator: "open") "teeth teeth-open theater-masks traffic-light truck-monster" (Indicator: "open") "envelope-open-text" (Indicator: "open") "*Cannot open log {0} on computer '{1}'. {2}" (Indicator: "open") "@Cannot open log for source '{0}'. You may not have write access." (Indicator: "open") "'Cannot open registry key {0}\\{1}\\{2}." (Indicator: "open") "GSource property was not set before opening the event log in write mode." (Indicator: "open") "9Cannot open registry key {0}\\{1}\\{2} on computer '{3}'." (Indicator: "open") "-Cannot open registry key {0} on computer {1}." (Indicator: "open")26:T89d,"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.bin" file has an entrypoint instructions - "jmpdword ptr [0x402000],addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al," "inject.exe" file has an entrypoint instructions - "pushr13,pushr12,movecx, 0xfffffff5,pushrbp,pushrdi,pushrsi,pushrbx,xoresi, esi,subrsp, 0x58,callqword ptr [rip + 0x1cc7],leardx, [rsp + 0x30],movrcx, rax,callqword ptr [rip + 0x1c71],testeax, eax,je0x40276b,movzxeax, word ptr [rsp + 0x34],xoresi, esi,orax, word ptr [rsp + 0x36],setesil,callqword ptr [rip + 0x1c4f],xoredx, edx,cmpword ptr [rax], 0x22,learbx, [rax + 2],setedl,jmp0x40279b,cmpax, 0x20,ja0x40278b,testdl, 1,je0x4027b0,movecx, edx,addrbx, 2,xorecx, 1," "Driver.sys" file has an entrypoint instructions - "movqword ptr [rsp + 8], rbx,pushrdi,subrsp, 0x20,movrbx, rdx,movrdi, rcx,call0x140005000,movrdx, rbx,movrcx, rdi,call0x14000177c,movrbx, qword ptr [rsp + 0x30],addrsp, 0x20,poprdi,ret,int3,movrax, rsp,movqword ptr [rax + 8], rbx,movqword ptr [rax + 0x10], rbp,movqword ptr [rax + 0x18], rsi,movqword ptr [rax + 0x20], rdi,pushr14,subrsp, 0x30,xorebp, ebp,movrsi, rdx,movrdi, rcx,testrcx, rcx,jne0x1400017ac,call0x140001170,jmp0x140001868,learax, [rip + 0x18cd],"27:T6d8,Pattern match: "http://schemas.awesome.incremented/wpf/xaml/fontawesome.sharp" Pattern match: "https://fontawesome.com" Pattern match: "github.com/dotnet/runtime" Pattern match: "www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl0a" Pattern match: "www.microsoft.com/pkiops/certs/MicCodSigPCA2011_2011-07-08.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt0" Pattern match: "www.microsoft.com/pkiops/docs/primarycps.htm0@" Pattern match: "http://www.microsoft.com0" Pattern match: "crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl0Z" Pattern match: "http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z" Pattern match: "http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0" Pattern match: "www.microsoft.com/PKI/docs/CPS/default.htm0@" Pattern match: "http://www.w3.org/2000/xmlns/" Pattern match: "http://james.newtonking.com/projects/json" Heuristic match: "Json.NET is a popular high-performance JSON framework for .NET" Pattern match: "www.apache.org/licenses/LICENSE-2.0" Pattern match: "www.apache.org/licenses/LICENSE-2.0RobotoMedium" Pattern match: "www.apache.org/licenses/LICENSE-2.0RobotoThin" Pattern match: "http://www.microsoft.com/typography/fonts/You" Pattern match: "www.ascendercorp.com/http://www.ascendercorp.com/typedesigners.htmlLicensed" Heuristic match: ":..\drivers\Win64e\iqvw64e.SY" Pattern match: "https://download.simpletoolz.fun/skillz/list.json" Pattern match: "https://hyperhaxz.com/api.php" Pattern match: "https://hyperhaxz.com/Branding/ColdWar/"28:T664,"cw.exe" queried SystemProcessInformation at 00000000-00003444-00000105-7512309 "cw.exe" queried SystemProcessInformation at 00000000-00003444-00000105-9619868 "cw.exe" queried SystemProcessInformation at 00000000-00003444-00000105-11140742 "cw.exe" queried SystemProcessInformation at 00000000-00003444-00000105-11184560 "cw.exe" queried SystemProcessInformation at 00000000-00003444-00000105-13869432 "cw.exe" queried SystemProcessInformation at 00000000-00003444-00000105-17375855 "cw.exe" queried SystemProcessInformation at 00000000-00003444-00000105-24458187 "cw.exe" queried SystemProcessInformation at 00000000-00003444-00000105-24799088 "cw.exe" queried SystemProcessInformation at 00000000-00003444-00000105-25125197 "cw.exe" queried SystemProcessInformation at 00000000-00003444-00000105-25452790 "cw.exe" queried SystemProcessInformation at 00000000-00003444-00000105-26280398 "cw.exe" queried SystemProcessInformation at 00000000-00003444-00000105-26660078 "cw.exe" queried SystemProcessInformation at 00000000-00003444-00000105-27007730 "cw.exe" queried SystemProcessInformation at 00000000-00003444-00000105-27341835 "cw.exe" queried SystemProcessInformation at 00000000-00003444-00000105-27801267 "cw.exe" queried SystemProcessInformation at 00000000-00003444-00000105-28212893 "cw.exe" queried SystemProcessInformation at 00000000-00003444-00000105-28578184 "cw.exe" queried SystemProcessInformation at 00000000-00003444-00000105-28887767 "cw.exe" queried SystemProcessInformation at 00000000-00003444-00000105-29649733 "cw.exe" queried SystemProcessInformation at 00000000-00003444-00000105-2995179329:T799,Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API "ZwAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API "ZwAllocateVirtualMemory Failed:%p" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00004956.00000000.129897.05A20000.00000004.mdmp") Found reference to API "ZwAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00004956.00000000.129897.05A20000.00000004.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API "IcaCreateThread" (Indicator: "CreateThread"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp")2a:T984,file/memory contains long string with (Indicator: "WaitForSingleObject"; File: "WinD64.sys") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API "KeWaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API "IcaWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API "IcaWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API "KeWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API "KeWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API "KeSetTimer" (Indicator: "SetTimer"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp")2b:T492,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp")2c:T1ada,Found reference to "System.Security.Cryptography.RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00004956.00000000.129897.05A20000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00004956.00000000.129897.05A20000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00004956.00000000.129897.05A20000.00000004.mdmp") Found reference to "System.Security.Cryptography.RSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "RSACng"; Source: "00000000-00004956.00000000.129897.05A20000.00000004.mdmp") Found reference to "System.Security.Cryptography.DSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "DSACng"; Source: "00000000-00004956.00000000.129897.05A20000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00004956.00000000.129897.05A20000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesManaged"; Source: "00000000-00004956.00000000.129897.05A20000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellman"; Source: "00000000-00004956.00000000.129897.05A20000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellmanCng"; Source: "00000000-00004956.00000000.129897.05A20000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsa"; Source: "00000000-00004956.00000000.129897.05A20000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsaCng"; Source: "00000000-00004956.00000000.129897.05A20000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00004956.00000000.129897.05A20000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00004956.00000000.129897.05A20000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00004956.00000000.129897.05A20000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00004956.00000000.129897.05A20000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00004956.00000000.129897.05A20000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00004956.00000000.129897.05A20000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512CryptoServiceProvider"; Source: "00000000-00004956.00000000.129897.05A20000.00000004.mdmp") Found reference to "RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00004956.00000000.129897.05A20000.00000004.mdmp") Found reference to "System.Security.Cryptography.HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00004956.00000000.129897.05A20000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00004956.00000000.129897.05A20000.00000004.mdmp") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00004956.00000000.129897.05A20000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384" (Indicator: "SHA384"; Source: "00000000-00004956.00000000.129897.05A20000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng" (Indicator: "SHA384"; Source: "00000000-00004956.00000000.129897.05A20000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider" (Indicator: "SHA384"; Source: "00000000-00004956.00000000.129897.05A20000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00004956.00000000.129897.05A20000.00000004.mdmp") Found reference to "SHA512" (Indicator: "SHA512"; Source: "00000000-00004956.00000000.129897.05A20000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512" (Indicator: "SHA512"; Source: "00000000-00004956.00000000.129897.05A20000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512Cng" (Indicator: "SHA512"; Source: "00000000-00004956.00000000.129897.05A20000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider" (Indicator: "SHA512"; Source: "00000000-00004956.00000000.129897.05A20000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider" (Indicator: "SHA512CryptoServiceProvider"; Source: "00000000-00004956.00000000.129897.05A20000.00000004.mdmp") Found reference to "System.Security.Cryptography.HMAC" (Indicator: "HMAC"; Source: "00000000-00004956.00000000.129897.05A20000.00000004.mdmp") Found reference to "System.Security.Cryptography.KeyedHashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00004956.00000000.129897.05A20000.00000004.mdmp") Found reference to "System.Security.Cryptography.KeyedHashAlgorithm" (Indicator: "KeyedHashAlgorithm"; Source: "00000000-00004956.00000000.129897.05A20000.00000004.mdmp")2d:T5bf,d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8 has big resource with name: "fqqq1dj.rsha39xgt" size: "14544" and abnormal entropy:"6.0863862414350915" d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8 has big resource with name: "j442sem9u.oyfp9nklw2k4" size: "491796" and abnormal entropy:"7.999284763588835" d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8 has big resource with name: "wfje2y3.y0phqwqx" size: "19130" and abnormal entropy:"7.98347410627986" d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8 has big resource with name: "b0494a1f-4bd3-dAhDuj8aTBjj9LwARTrL7w==" size: "459264" and abnormal entropy:"6.479659632618565" d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8 has big resource with name: "b0494a1f-4bd3-OiOto5G9n54c/RSy1Qs6yw==" size: "18312" and abnormal entropy:"6.439506871486808" d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8 has big resource with name: "b0494a1f-4bd3-XlUqNfKuHp1+pBShBQt+EA==" size: "18312" and abnormal entropy:"6.423768379721757" d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8 has big resource with name: "b0494a1f-4bd3-EH6KekXyECR0/59jEc4BQQ==" size: "29064" and abnormal entropy:"6.121902817091642" d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8 has big resource with name: "b0494a1f-4bd3-HaC1GYJMmjI2aplxbWN9CA==" size: "6167552" and abnormal entropy:"6.548327017375355"2e:T475,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to perform encryption (API string) Matched sigs: Contains ability to import cryptographic keys (seen in ransomware) Matched sigs: Able to access crypto-related API (String) Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains reference to cryptographic keys Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Reads the cryptographic machine GUID Matched sigs: Contains ability to perform symmetric encryption (Dotnet) Matched sigs: Contains ability to perform symmetric decryption (Dotnet) Matched sigs: Contains ability to perform crypto operations Matched sigs: Able to decode string content at runtime (.NET) Matched sigs: Contains ability to perform symmetric crypto operations Matched sigs: Dotnet file contains encryption/decryption functions Matched sigs: YARA signature match - RC4 Encryption2f:T44e5,Found XOR loop in file "WinD64.exe" at offset 67764; code bytes = 33c1 Found XOR loop in file "WinD64.exe" at offset 75061; code bytes = 8030 Found XOR loop in file "Driver.sys" at offset 6660; code bytes = 8030 Found XOR loop in file "inject.exe" at offset 67764; code bytes = 33c1 Found XOR loop in file "inject.exe" at offset 75061; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 217491; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 233545; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 239128; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 311595; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 337506; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 355158; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 493693; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 531708; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 606993; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 624628; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 646973; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 655103; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 846348; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 970881; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3707532; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3878378; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3883413; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3897078; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4055188; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4071651; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4098815; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4103799; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4187888; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4216806; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4217111; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4233573; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4240226; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4258168; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4286895; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4366451; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4409857; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4412611; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4442827; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4459039; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4459543; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4459675; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4459775; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4459823; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4460775; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4554967; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4585356; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4603328; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4616101; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4631095; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4631499; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4638315; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4775051; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5551626; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5676643; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6400988; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6571834; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6576869; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6590534; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6748644; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6765107; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6792271; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6797255; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6881344; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6910262; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6910567; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6927029; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6933682; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6951624; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6980351; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7059907; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7103313; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7106067; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7136283; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7152495; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7152999; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7153131; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7153231; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7153279; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7154231; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7248423; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7278812; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7296784; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7309557; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7324551; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7324955; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7331771; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7502176; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8160689; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8161889; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8172245; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8179229; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8220485; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8237686; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8244463; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8256534; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8279113; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8332535; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8339977; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8466284; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8475436; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8492383; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8494871; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8526559; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8579948; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8633370; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8640812; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8767119; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8776271; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8793218; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8795706; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8827394; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9415261; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9635414; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9722615; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 317293; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 342238; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 361251; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 465905; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 541404; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 650168; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2645824; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2890050; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4127788; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4175573; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4377784; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4471769; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4897943; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4901061; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4911834; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4931556; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4931645; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5379550; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5549949; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5743299; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5926071; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5929189; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5939962; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5959684; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5959773; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6821244; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6869029; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7071240; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7165225; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8185289; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8185364; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8325497; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8325823; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8357463; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8372413; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8408847; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8441294; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8626332; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8626658; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8658298; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8673248; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8709682; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8742129; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8947096; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 9276938; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 9276947; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 9506533; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 9508801; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 9515748; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 9694514; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 9724636; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 866359; code bytes = 30040e Found XOR loop in file "sample.bin" at offset 1020729; code bytes = 30040e Found XOR loop in file "sample.bin" at offset 26107; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 27056; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 95317; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 100662; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 176716; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 275103; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 336127; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 444559; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 745545; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 748893; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 749283; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 749397; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 749823; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 750561; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 846321; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 993694; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1030673; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1084774; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1110917; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1162379; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1162381; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1556953; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1562305; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1562657; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1709096; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1953451; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1955505; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2603447; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2604471; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2605791; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2608879; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2609287; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2640663; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2791238; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2960214; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3427949; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4780694; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5100375; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5322792; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5540157; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5903906; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6128503; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6350920; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7507819; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7746592; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8127618; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8151967; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8198893; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8251601; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8254455; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8302054; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8570252; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8602889; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8871087; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8954393; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9294417; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9295771; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9416905; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9482139; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9496390; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9558819; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9576680; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9598351; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9612392; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9615604; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9635742; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9638984; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9654790; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9662586; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9672419; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9693247; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9782465; code bytes = 803030:T422,file/memory contains long string with (Indicator: "NtQuerySystemInformation"; File: "WinD64.exe") file/memory contains long string with (Indicator: "ZwQuerySystemInformation"; File: "WinD64loader.sys") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API "NtQuerySystemInformationW" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00004956-00000C2B-1054569585") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API "ZwQuerySystemInformation" (Indicator: "ZwQuerySystemInformation"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp")31:T4ab,Found reference to API "SendMessage" (Indicator: "sendmessage"; Source: "00000000-00004956-00000C2B-1052838328") Found reference to API "SendMessageW" (Indicator: "sendmessage"; Source: "00000000-00004956-00000C2B-1052838354") Found reference to API "PostMessage" (Indicator: "postmessage"; Source: "00000000-00004956-00000C2B-1053393974") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00004956-00000C2B-1053394008") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00004956.00000000.129897.03A30000.00000004.mdmp, 00000000-00004956.00000001.131819.03A30000.00000004.mdmp, 00000000-00004956.00000002.133737.03A30000.00000004.mdmp") Found reference to API "sendMessageChannelCache" (Indicator: "sendmessage"; Source: "00000000-00004956.00000000.129897.05A20000.00000004.mdmp") Found reference to API "System.ServiceModel.Activities.Configuration.SendMessageChannelCacheElement, System.ServiceModel.Activities, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" (Indicator: "sendmessage"; Source: "00000000-00004956.00000000.129897.05A20000.00000004.mdmp")32:T26ac,"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000001800000080825a03b3ea4071f0056f01687d5c7498f56f0150184171148f7773feffffffb4f46f01d27c3f7158f46f0100007a7550f56f01eb7c3f71e0df807508000000000000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff3400000000000000e0f46f010000000008000000000000000000000000000000000000000000000000000000f8825a030000000020f56f0169922377ffffffff34000000e0f46f01080000000000000000007a7550f56f0127942377e8f46f010b0000000000000038f56f01 (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000a0d66f0144d66f01226e20740000ff03000000002d6e2074af0918e92d000000ecb7bb75c8d66f0100008003381eab03e067a903030000008000000008d66f01000080038cd66f0170c8217413ae519cfeffffff2d000000d0ccca75270000005cd66f01856a22741c2327749cd66f01f85f227408000000bb692174b2692174770918e92d000000ecb7bb7527000000d0ccca7570d66f012d000000d0ccca7527000000a0d66f01856a22741c232774e8d66f017e8ac975ee8cc975738ac975957776392d000000ecb7bb7527000000d0ccca757c29ff031029ff0395777639b0d66f01fc5207769cd76f01e084c97545501c4efeffffff738ac975 (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000007870187d787000000000d0a9817400007a7490117b7400b7a503d8b5a40340bea703e8ec6f01feffffff90ef6f01506a47772f6f65b9feffffffa8ed6f01eaa9437700b7a5030000000040bea703a11400000a000b00b29778705c7678706876787040bea7033849b10314000000000000000000000000b7a503d0ed6f01cc2d487740bea703000000004cbea70300000000f800717000000000cc0d24385ce8467768404577ec04000019000000110000001000000088c0a30308ee6f018d9ad97348bda303d471aa030000000028ee6f012c05a303d471aa0340ee6f0100007170feffffff0400000020afd97300000000000000000000717030ee6f01 (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000a5035005fb72000000002a00bd73fc86b6732a00bd73fb8c44770000000000000000fc86b67300ec6f010000000000000000000000002a00bd7309000000b0cda50309000000fc86b673000000005005fb7218000000e09d5a03b3ea407110fd6e010000000080ee6f0150184171148f7773feffffffc0eb6f010a9b3f7170eb6f010000000000000000239b3f71eceb6f0100000000000000000000000000000000000000000000000001000000000000000100000000000000e8eb6f0100000000f8eb6f0100000000eceb6f010000000000000000000000004b000674d89d5a0300ec6f0184da2177637145cf04ec6f01dab921770000f272f8eb6f01 (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000003f71b0ea6f010000000000000000c1ad3f7100000000000000000000000060eb6f0168eb6f01010000000000000004000000000000000000000000000000000000000000000000000000000000002c05000000000000ffffffffffffffff6ceb6f01000000000000000000000000000000000000000060eb6f010000000068eb6f0100000000010000000000000000000000000000000400000000000000000000000000000000000000389c5a0370eb6f01ad4923772c050000ffffffff6ceb6f01000000000000000060eb6f0168eb6f0101000000000000000400000005400080000000000000000000000000001000000000ee08a0eb6f011e879073 (UID: 00000000-00004956) "cmd.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004816) "cmd.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003624) "cmd.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003624) "cmd.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003624) "inject.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004992) "inject.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007536) "inject.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007584)33:T27df,"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00004956) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004816) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004816) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004816) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004816) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003624) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003624) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003624) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003624) "inject.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004992) "inject.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004992) "inject.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004992) "inject.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004992) "inject.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CI.DLL (UID: 00000000-00004992) "inject.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007536) "inject.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007536) "inject.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007536) "inject.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007536) "inject.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CI.DLL (UID: 00000000-00007536) "inject.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007584) "inject.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007584) "inject.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007584) "inject.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007584)34:T14038,"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter IsAppThemedW (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter CreateActCtx (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter CreateActCtxA (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter RegisterWindowMessage (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter RegisterWindowMessageW (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter FindFirstFile (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter FindNextFile (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter OpenSCManagerW (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter CreateService (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter CreateServiceW (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter CloseServiceHandle (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter OpenSCManager (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GetServiceKeyName (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GetServiceKeyNameW (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter OpenService (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter OpenServiceW (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter QueryServiceStatus (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter QueryServiceStatusW (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter CloseServiceHandleW (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter StartService (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter StartServiceW (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter CreatePipe (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter CreatePipeW (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter CreateProcess (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter CreateProcessW (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GetConsoleCP (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GetConsoleOutputCP (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter CreateDirectory (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter CreateDirectoryW (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GetUserObjectInformation (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GetUserObjectInformationA (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GetActiveWindow (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter OleInitialize (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter CoRegisterMessageFilter (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter EnumThreadWindows (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GetFocus (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter MessageBox (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter MessageBoxW (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter SendMessage (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter SendMessageW (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter DeleteFile (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter ImmCreateContext (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter ImmDestroyContext (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter ImmNotifyIME (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringA (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringA (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringW (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringW (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter ImmSetCandidateWindow (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter AdjustWindowRectEx (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter RegisterClass (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter RegisterClassW (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter CreateWindowEx (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter SetWindowLong (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter SetWindowLongW (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GetWindowLong (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GetWindowLongW (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter CallWindowProc (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter CallWindowProcW (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GetParent (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter SetTimer (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter IsWindow (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter KillTimer (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GdiplusStartup (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GdipLoadImageFromStream (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter IIDFromString (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GdipImageForceValidation (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GdipGetImageType (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GdipGetImageRawFormat (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GetSystemDefaultLCID (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GetSystemDefaultLCIDW (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GetObject (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GetObjectW (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GetDC (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GdipCreateFontFromLogfontW (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter ND_RI2 (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter ND_RI2_RetAddr (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter ND_RU1 (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter ND_RU1_RetAddr (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GdipGetFontUnit (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GdipGetFontSize (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GdipGetFontStyle (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GdipGetFamily (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter ReleaseDC (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GdipCreateFromHDC (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GdipGetDpiY (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GdipGetFontHeight (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GdipGetEmHeight (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GdipGetLineSpacing (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GdipDeleteGraphics (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GdipCreateFont (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GdipDeleteFont (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter CreateCompatibleDC (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GdipGetLogFontW (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter ND_WU1 (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter ND_WU1_RetAddr (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter CreateFontIndirect (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter CreateFontIndirectW (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter SelectObject (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GetTextMetricsW (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GetTextExtentPoint32W (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter DeleteDC (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GetCursorPos (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter MonitorFromPoint (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GetMonitorInfo (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GetMonitorInfoW (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter CreateDC (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter CreateDCW (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GetDeviceCaps (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GetClassInfo (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GetClassInfoW (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter DefWindowProc (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter SetWindowText (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter SetWindowTextW (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GetSysColor (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GetSysColorW (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter SetLayeredWindowAttributes (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GetStartupInfo (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GetStartupInfoW (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter CreateIconFromResourceEx (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GetSystemMenu (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GetWindowPlacement (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter EnableMenuItem (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter SetWindowPos (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GetWindowTextLength (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GetWindowTextLengthW (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GetWindowText (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GetWindowTextW (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter RedrawWindow (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter ShowWindow (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GetWindow (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter MapWindowPoints (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter SetParent (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter DestroyWindow (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GetCurrentObject (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter SaveDC (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GetNearestColor (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter CreateSolidBrush (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter FillRect (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter DeleteObject (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter RestoreDC (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter InvalidateRect (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter PostMessage (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter PostMessageW (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GdipImageGetFrameDimensionsCount (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GdipImageGetFrameDimensionsList (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter PeekMessage (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter PeekMessageW (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter IsWindowUnicode (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GetMessageW (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter TranslateMessage (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter DispatchMessageW (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter BeginPaint (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GdipCreateHalftonePalette (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter SelectPalette (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter EndPaint (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GetObjectType (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter CreateCompatibleBitmap (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GetDIBits (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter CreateDIBSection (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GdipTranslateWorldTransform (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GdipSetClipRectI (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GdipCreateMatrix (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GdipGetWorldTransform (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GdipIsMatrixIdentity (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GdipGetMatrixElements (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GdipDeleteMatrix (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GdipCreateRegion (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GdipGetClip (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GdipIsInfiniteRegion (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GdipSaveGraphics (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GetThemeAppProperties (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GetThemeAppPropertiesW (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter OpenThemeDataW (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GdipCombineRegionRegion (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GdipGetRegionHRgn (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GdipDeleteRegion (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GdipGetDC (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter CreateRectRgn (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GetClipRgn (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter SelectClipRgn (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter OffsetViewportOrgEx (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GdipReleaseDC (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GdipRestoreGraphics (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GdipGetImageWidth (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GdipGetImageHeight (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GdipDrawImageRectI (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter BitBlt (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter WaitMessage (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter SetFocus (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GetKeyboardLayout (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GetMessageA (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter DispatchMessageA (UID: 00000000-00004956) "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" called "GetProcAddress" with a parameter GetKeyState (UID: 00000000-00004956) "cmd.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004816) "cmd.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004816) "cmd.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004816) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004816) "cmd.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004816) "cmd.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004816) "cmd.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004816) "cmd.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004816) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004816) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004816) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004816) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004816) "cmd.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004816) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004816) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004816) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004816) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004816) "cmd.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004816) "cmd.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004816) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004816) "cmd.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004816) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004816) "cmd.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004816) "cmd.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004816) "cmd.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004816) "cmd.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004816) "cmd.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004816) "cmd.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004816) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004816) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004816) "cmd.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004816) "cmd.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004816) "cmd.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004816) "cmd.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004816) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004816) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004816) "cmd.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004816) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004816) "cmd.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004816) "cmd.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004816) "cmd.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004816) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004816) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004816) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004816) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004816) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00004816) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00004816) "cmd.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003624) "cmd.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003624) "cmd.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003624) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003624) "cmd.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003624) "cmd.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003624) "cmd.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003624) "cmd.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003624) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003624) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003624) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003624) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003624) "cmd.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003624) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003624) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003624) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003624) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003624) "cmd.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003624) "cmd.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003624) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003624) "cmd.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003624) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003624) "cmd.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003624) "cmd.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003624) "cmd.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003624) "cmd.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003624) "cmd.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003624) "cmd.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003624) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003624) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003624) "cmd.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003624) "cmd.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003624) "cmd.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003624) "cmd.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003624) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003624) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003624) "cmd.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003624) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003624) "cmd.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003624) "cmd.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003624) "cmd.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003624) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003624) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003624) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00003624) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003624) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00003624) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00003624) "inject.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004992) "inject.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004992) "inject.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004992) "inject.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004992) "inject.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004992) "inject.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004992) "inject.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004992) "inject.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004992) "inject.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004992) "inject.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004992) "inject.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004992) "inject.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004992) "inject.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004992) "inject.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004992) "inject.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004992) "inject.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004992) "inject.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004992) "inject.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004992) "inject.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004992) "inject.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004992) "inject.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004992) "inject.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004992) "inject.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004992) "inject.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004992) "inject.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004992) "inject.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004992) "inject.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004992) "inject.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004992) "inject.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004992) "inject.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004992) "inject.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004992) "inject.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004992) "inject.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004992) "inject.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004992) "inject.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004992) "inject.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004992) "inject.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004992) "inject.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004992) "inject.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004992) "inject.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004992) "inject.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004992) "inject.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004992) "inject.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004992) "inject.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004992) "inject.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004992) "inject.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00004992) "inject.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00004992) "inject.exe" called "GetProcAddress" with a parameter CiInitialize (UID: 00000000-00004992) "inject.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007536) "inject.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007536) "inject.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007536) "inject.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007536) "inject.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007536) "inject.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007536) "inject.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007536) "inject.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007536) "inject.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007536) "inject.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007536) "inject.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007536) "inject.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007536) "inject.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007536) "inject.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007536) "inject.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007536) "inject.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007536) "inject.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007536) "inject.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007536) "inject.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007536) "inject.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007536) "inject.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007536) "inject.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007536) "inject.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007536) "inject.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007536) "inject.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007536) "inject.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007536) "inject.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007536) "inject.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007536) "inject.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007536) "inject.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007536) "inject.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007536) "inject.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007536) "inject.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007536) "inject.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007536) "inject.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007536) "inject.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007536) "inject.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007536) "inject.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007536) "inject.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007536) "inject.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007536) "inject.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007536) "inject.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007536) "inject.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007536) "inject.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007536) "inject.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007536) "inject.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00007536) "inject.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007536) "inject.exe" called "GetProcAddress" with a parameter CiInitialize (UID: 00000000-00007536) "inject.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007584) "inject.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007584) "inject.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007584) "inject.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007584) "inject.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007584) "inject.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007584) "inject.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007584) "inject.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007584) "inject.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007584) "inject.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007584) "inject.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007584) "inject.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007584) "inject.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007584) "inject.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007584) "inject.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007584) "inject.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007584) "inject.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007584) "inject.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007584) "inject.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007584) "inject.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007584) "inject.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007584) "inject.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007584) "inject.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007584) "inject.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007584) "inject.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007584) "inject.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007584) "inject.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007584) "inject.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007584) "inject.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007584) "inject.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007584) "inject.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007584) "inject.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007584) "inject.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007584) "inject.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007584) "inject.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007584) "inject.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007584) "inject.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007584) "inject.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007584) "inject.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007584) "inject.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007584) "inject.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007584) "inject.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007584) "inject.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007584) "inject.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007584) "inject.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007584) "inject.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00007584) "inject.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007584)35:Ta57,file/memory contains long string with (Indicator: "NtDeviceIoControlFile"; File: "WinD64.dll") file/memory contains long string with (Indicator: "DeviceIoControl"; File: "WinD64.dll") file/memory contains long string with (Indicator: "IoCreateDevice"; File: "WinD64.sys") Found reference to API "NtDeviceIoControlFile" (Indicator: "NtDeviceIoControlFile"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API "NtDeviceIoControlFile" (Indicator: "DeviceIoControl"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API "IoCreateDevice" (Indicator: "IoCreateDevice"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API "IoCreateDevice" (Indicator: "IoCreateDevice"; Source: "00000000-00004956.00000000.129897.05A20000.00000004.mdmp, 00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API "NtDeviceIoControlFile" (Indicator: "NtDeviceIoControlFile"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API "NtDeviceIoControlFile" (Indicator: "DeviceIoControl"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API "IoBuildDeviceIoControlRequest" (Indicator: "DeviceIoControl"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API "IoBuildDeviceIoControlRequest" (Indicator: "IoBuildDeviceIoControlRequest"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API "IofCallDriver" (Indicator: "IofCallDriver"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API "ZwDeviceIoControlFile" (Indicator: "DeviceIoControl"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp")36:Tb743,Found reference to API (Indicator: "CreateCompatibleDC"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API (Indicator: "DeleteDC"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API (Indicator: "DrawIcon"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API (Indicator: "DeleteObject"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API (Indicator: "SelectObject"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API (Indicator: "BitBlt"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API (Indicator: "ShowScrollBar"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API (Indicator: "CmUnRegisterCallback"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API (Indicator: "QueryServiceConfigW"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API (Indicator: "OpenSCManagerW"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API (Indicator: "CloseServiceHandle"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API (Indicator: "SetServiceStatus"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API (Indicator: "RegisterServiceCtrlHandlerW"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API (Indicator: "CreateServiceW"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API (Indicator: "OpenServiceW"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API (Indicator: "EnumServicesStatusExW"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API (Indicator: "StartServiceCtrlDispatcherW"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API (Indicator: "StartServiceW"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API (Indicator: "DeleteService"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API (Indicator: "ReleaseMutex"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API (Indicator: "VirtualQuery"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API (Indicator: "GetModuleHandleA"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API (Indicator: "ExitProcess"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API (Indicator: "GetExitCodeProcess"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API (Indicator: "GetFileSize"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API (Indicator: "ReadFile"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API (Indicator: "LoadLibraryExW"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API (Indicator: "GetSystemDirectoryW"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API (Indicator: "GetLastError"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API (Indicator: "CreateRemoteThread"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API (Indicator: "GetProcAddress"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API (Indicator: "WriteFile"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API (Indicator: "GetCommandLineW"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API (Indicator: "WriteProcessMemory"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API (Indicator: "LoadResource"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API (Indicator: "WaitForSingleObject"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API (Indicator: "SizeofResource"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API (Indicator: "MoveFileExW"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API (Indicator: "FindResourceW"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API (Indicator: "OpenProcess"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API (Indicator: "GetSystemDirectoryA"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API (Indicator: "VirtualAllocEx"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API (Indicator: "GetFullPathNameW"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API (Indicator: "GetCurrentProcess"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API (Indicator: "CreateMutexW"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API (Indicator: "GetModuleFileNameW"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API (Indicator: "DeleteFileW"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API (Indicator: "CreateFileW"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API (Indicator: "LoadLibraryA"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API (Indicator: "CloseHandle"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API (Indicator: "DeleteFileA"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API (Indicator: "LockResource"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API (Indicator: "FreeLibrary"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API (Indicator: "GetConsoleScreenBufferInfo"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API (Indicator: "GetStdHandle"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API (Indicator: "GetSystemMetrics"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API (Indicator: "RtlWriteRegistryValue"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API (Indicator: "NtOpenFile"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API (Indicator: "NtUnloadDriver"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API (Indicator: "NtLoadDriver"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API (Indicator: "RtlAdjustPrivilege"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API (Indicator: "RtlCreateRegistryKey"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API (Indicator: "NtClose"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API (Indicator: "RtlInitUnicodeString"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API (Indicator: "NtQueryInformationProcess"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API (Indicator: "NtDeviceIoControlFile"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API (Indicator: "NtQuerySystemInformation"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API (Indicator: "VirtualProtect"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API (Indicator: "GetModuleHandleW"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API (Indicator: "ObfDereferenceObject"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API (Indicator: "IoDeleteDevice"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API (Indicator: "IofCompleteRequest"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API (Indicator: "IoDeleteSymbolicLink"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API (Indicator: "RtlCompareUnicodeString"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API (Indicator: "IoGetCurrentProcess"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API (Indicator: "IoCreateDevice"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API (Indicator: "RtlCopyUnicodeString"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API (Indicator: "IoCreateSymbolicLink"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API (Indicator: "ZwAllocateVirtualMemory"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API (Indicator: "DbgPrint"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API (Indicator: "MmGetSystemRoutineAddress"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API (Indicator: "ObReferenceObjectByHandle"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API (Indicator: "RtlQueryRegistryValues"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API (Indicator: "KeInitializeMutex"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API (Indicator: "KeReleaseMutex"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API (Indicator: "KeWaitForSingleObject"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API (Indicator: "ZwLoadDriver"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API (Indicator: "RtlCompareMemory"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API (Indicator: "ZwOpenKey"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API (Indicator: "ZwClose"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API (Indicator: "RtlInitUnicodeString"; Source: "00000000-00004956.00000000.129897.05A20000.00000004.mdmp, 00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "RtlCompareUnicodeString"; Source: "00000000-00004956.00000000.129897.05A20000.00000004.mdmp") Found reference to API (Indicator: "DbgPrint"; Source: "00000000-00004956.00000000.129897.05A20000.00000004.mdmp, 00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "IofCompleteRequest"; Source: "00000000-00004956.00000000.129897.05A20000.00000004.mdmp, 00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "IoCreateDevice"; Source: "00000000-00004956.00000000.129897.05A20000.00000004.mdmp, 00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "IoCreateSymbolicLink"; Source: "00000000-00004956.00000000.129897.05A20000.00000004.mdmp") Found reference to API (Indicator: "IoDeleteDevice"; Source: "00000000-00004956.00000000.129897.05A20000.00000004.mdmp, 00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "IoDeleteSymbolicLink"; Source: "00000000-00004956.00000000.129897.05A20000.00000004.mdmp") Found reference to API (Indicator: "IoGetCurrentProcess"; Source: "00000000-00004956.00000000.129897.05A20000.00000004.mdmp, 00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "ObfDereferenceObject"; Source: "00000000-00004956.00000000.129897.05A20000.00000004.mdmp, 00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "ZwAllocateVirtualMemory"; Source: "00000000-00004956.00000000.129897.05A20000.00000004.mdmp") Found reference to API (Indicator: "RtlCopyUnicodeString"; Source: "00000000-00004956.00000000.129897.05A20000.00000004.mdmp") Found reference to API (Indicator: "CmUnRegisterCallback"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "ShellExecuteExA"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "CloseServiceHandle"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "CreateServiceW"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "DeleteService"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "EnumServicesStatusExW"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "OpenSCManagerW"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "OpenServiceW"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "QueryServiceConfigW"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "RegisterServiceCtrlHandlerW"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "SetServiceStatus"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "StartServiceCtrlDispatcherW"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "StartServiceW"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "CreateMutexW"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "CreateRemoteThread"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "FindResourceW"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "GetConsoleScreenBufferInfo"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "GetFullPathNameW"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "MoveFileExW"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "VirtualAllocEx"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "VirtualQuery"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "WriteProcessMemory"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "NtClose"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "NtDeviceIoControlFile"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "NtLoadDriver"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "NtOpenFile"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "NtQueryInformationProcess"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "NtQuerySystemInformation"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "NtUnloadDriver"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "RtlAdjustPrivilege"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "RtlCreateRegistryKey"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "RtlWriteRegistryValue"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "ExAllocatePoolWithTag"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "ExFreePoolWithTag"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "KeInitializeEvent"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "ZwLoadDriver"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "IoGetDeviceObjectPointer"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "ZwUnloadDriver"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "IoBuildDeviceIoControlRequest"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "ObfReferenceObject"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "IofCallDriver"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "KeWaitForSingleObject"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "ExEnterCriticalRegionAndAcquireResourceExclusive"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "ExReleaseResourceAndLeaveCriticalRegion"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "MmSizeOfMdl"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "KeAcquireSpinLockRaiseToDpc"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "KeReleaseSpinLock"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "IoInitializeIrp"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "ProbeForWrite"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "ExIsResourceAcquiredExclusiveLite"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "IoAcquireCancelSpinLock"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "IoReleaseCancelSpinLock"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "MmMapLockedPagesSpecifyCache"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "KeSetEvent"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "PsGetCurrentProcessId"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "ExInitializeResourceLite"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "ExDeleteResourceLite"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "ZwDeviceIoControlFile"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "ObReferenceObjectByHandle"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "RtlLengthRequiredSid"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "RtlSubAuthoritySid"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "RtlInitializeSid"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "RtlEqualSid"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "ExAllocatePoolWithQuotaTag"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "RtlQueryRegistryValues"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "KeClearEvent"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "ExReleaseResourceLite"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "ExAcquireResourceExclusiveLite"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "KeDelayExecutionThread"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "KeWaitForMultipleObjects"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "IoAllocateErrorLogEntry"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "IoWriteErrorLogEntry"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "PsCreateSystemThread"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "ZwQuerySystemInformation"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "ZwClose"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "KeInitializeTimer"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "KeInitializeDpc"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "KeSetTimer"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "KeCancelTimer"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "RtlInitializeGenericTable"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "RtlEnumerateGenericTable"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "RtlDeleteElementGenericTable"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "RtlInsertElementGenericTable"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "RtlLookupElementGenericTable"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "IoStartPacket"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "IoSetStartIoAttributes"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "IoStartNextPacket"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "IoAttachDeviceToDeviceStack"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "ExAcquireFastMutexUnsafe"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "ExReleaseFastMutexUnsafe"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "IoWMIRegistrationControl"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "IoDetachDevice"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "IoInvalidateDeviceState"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "PoStartNextPowerIrp"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "PoCallDriver"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "PoSetPowerState"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "KeReadStateEvent"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "KeBugCheckEx"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "KeInitializeMutex"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "KeReleaseMutex"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "MmGetSystemRoutineAddress"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "RtlCompareMemory"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "ZwOpenKey"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00004956.00000001.131819.03B09000.00000004.mdmp, 00000000-00004956.00000002.133737.03B09000.00000004.mdmp") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00004956.00000001.131819.03B09000.00000004.mdmp, 00000000-00004956.00000002.133737.03B09000.00000004.mdmp")37:T6b9,Found reference to API "LoadResourceFont" (Indicator: "LoadResource"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API "FindResourceW" (Indicator: "FindResource"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API "LockResource" (Indicator: "LockResource"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp")38:T4f0,Found reference to API "StartServiceCtrlDispatcherW" (Indicator: "StartServiceCtrlDispatcher"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API "StartServiceCtrlDispatcherW" (Indicator: "StartService"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API "StartServiceW" (Indicator: "StartService"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API "StartServiceCtrlDispatcherW" (Indicator: "StartServiceCtrlDispatcher"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API "StartServiceCtrlDispatcherW" (Indicator: "StartService"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API "StartServiceW" (Indicator: "StartService"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp")39:T5e1,"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:ffffffffc0000135] "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:ffffffffc0000135] "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:ffffffffc0000135] "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:ffffffffc0000135] "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:ffffffffc0000135] "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:ffffffffc0000135] "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:ffffffffc0000135]3a:Ta62,Observed unmanaged function "WTSOpenServer" in "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8" Observed unmanaged function "WTSCloseServer" in "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8" Observed unmanaged function "WTSEnumerateSessions" in "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8" Observed unmanaged function "WTSFreeMemory" in "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8" Observed unmanaged function "WTSQuerySessionInformation" in "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8" Observed unmanaged function "NtCreateSection" in "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8" Observed unmanaged function "NtOpenSection" in "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8" Observed unmanaged function "NtMapViewOfSection" in "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8" Observed unmanaged function "NtCreateEvent" in "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8" Observed unmanaged function "NtOpenEvent" in "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8" Observed unmanaged function "NtClose" in "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8" Observed unmanaged function "CopyMemory" in "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8" Observed unmanaged function "LoadLibrary" in "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8" Observed unmanaged function "GetProcAddress" in "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8" Observed unmanaged function "FreeLibrary" in "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8" Observed unmanaged function "OpenSCManagerW" in "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8" Observed unmanaged function "CreateService" in "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8" Observed unmanaged function "OpenService" in "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8" Observed unmanaged function "DeleteService" in "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8" Observed unmanaged function "CloseServiceHandle" in "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8" Observed unmanaged function "CloseHandle" in "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8" Observed unmanaged function "CreateFile" in "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8" Observed unmanaged function "DeviceIoControl" in "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8"3b:T2564,"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" loaded module "KERNEL32" at base 77060000 "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 77130000 "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 77130000 "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 77130000 "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 74ef0000 "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 77130000 "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 77130000 "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 77130000 "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" loaded module "ADVAPI32.DLL" at base 74280000 "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 72910000 "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" loaded module "SHLWAPI.DLL" at base 74f20000 "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 741b0000 "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" loaded module "VERSION.DLL" at base 73b50000 "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 72160000 "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" loaded module "USER32.DLL" at base 747a0000 "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 77130000 "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" loaded module "MSCOREE.DLL" at base 72a90000 "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 74fd0000 "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" loaded module "PSAPI.DLL" at base 73e90000 "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" loaded module "RPCRT4.DLL" at base 75a00000 "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" loaded module "KERNEL32.DLL" at base 77060000 "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 6f0e0000 "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" loaded module "OLE32.DLL" at base 75900000 "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 738d0000 "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 74fd0000 "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 77130000 "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 72000000 "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\VERSION.DLL" at base 0 "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 715a0000 "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\V4.0_4.0.0.0__B77A5C561934E089\UXTHEME.DLL" at base 0 "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" loaded module "UXTHEME.DLL" at base 738d0000 "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" loaded module "NTDLL.DLL" at base 77400000 "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 70bc0000 "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 71490000 "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 6e960000 "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" loaded module "SHELL32.DLL" at base 75b90000 "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" loaded module "BCRYPT.DLL" at base 72bf0000 "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 71460000 "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" loaded module "COMCTL32.DLL" at base 73090000 "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 75220000 "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 75900000 "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" loaded module "OLEAUT32.DLL" at base 73ed0000 "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 747a0000 "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 747a0000 "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 74fd0000 "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" loaded module "IMM32.DLL" at base 74ef0000 "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" loaded module "COMCTL32.DLL" at base 70710000 "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" loaded module "GDI32.DLL" at base 757a0000 "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" loaded module "GDIPLUS.DLL" at base 73b60000 "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" loaded module "%WINDIR%\WINSXS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.16299.248_NONE_8E66FBC1026DF8AB\GDIPLUS.DLL" at base 73b60000 "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" loaded module "WINDOWSCODECS.DLL" at base 72f20000 "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 77130000 "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "cmd.exe" loaded module "KERNEL32" at base 77060000 "cmd.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 77130000 "cmd.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 77130000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 77130000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 74ef0000 "cmd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 77130000 "cmd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 77130000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 77130000 "cmd.exe" loaded module "KERNEL32.DLL" at base 77060000 "cmd.exe" loaded module "NTDLL.DLL" at base 77400000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73d70000 "inject.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7fff73e40000 "inject.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7fff73e40000 "inject.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7fff73e40000 "inject.exe" loaded module "KERNEL32" at base 7fff745d0000 "inject.exe" loaded module "%WINDIR%\SYSTEM32\CI.DLL" at base 7fff542b0000 "inject.exe" loaded module "%WINDIR%\SYSTEM32\CI.DLL" at base 7fff5ad10000 "inject.exe" loaded module "RPCRT4.DLL" at base 7fff76dc0000 "inject.exe" loaded module "KERNEL32.DLL" at base 7fff745d00003c:Tc5e,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00004956-00000C2A-1029936107] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00004956-00000C2A-1030242334] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00004956-00000C2A-1030350016] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00004956-00000C2A-1030412635] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00004956-00000C2A-1030569810] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00004956-00000C2A-1030598593] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00004956-00000C2A-1030654438] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00004956-00000C2A-1030736096] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" [Source: 00000000-00004956-00000C2A-1030775874] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00004956-00000C2A-1030855316] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" [Source: 00000000-00004956-00000C2A-1030964103] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00004956-00000C2A-1031153284] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" [Source: 00000000-00004956-00000C2A-1031179952] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00004956-00000C2A-1031228482] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00004956-00000C2A-1031431665] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00004956-00000C2A-1032519992] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00004956-00000C2A-1032547701] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll" [Source: 00000000-00004956-00000C2A-1032574360] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00004956-00000C2A-1054519573] Observed system executable string:"%WINDIR%\system32\CI.DLL" [Source: 00000000-00004992-00000C2A-1033739443]3d:T7ae,"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "")3e:Te67,"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "D678623C64C737FD9C8372C8E67B9FCC536845C358626065FA92E40F5FE6C6C8.EXE"; Value: "") "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "")3f:T47f,"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\config\machine.config" "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll.aux" "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\2c3c912ea8f058f9d04c4650128feb3f\system.ni.dll.aux" "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.configuration\96f7edb07b12303f0ec2595c7f3778c7\system.configuration.ni.dll.aux" "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.core\31fae3290fad30c31c98651462d22724\system.core.ni.dll.aux" "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.xml\15af16d373cf0528cb74fc73d365fdbf\system.xml.ni.dll.aux"40:T49c,"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" trying to touch file "C:\Windows\System32\WOW64LOG.DLL" "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" trying to touch file "C:\Windows\SysWOW64\mscoree.dll" "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" trying to touch file "C:\Windows\SysWOW64\apphelp.dll" "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" trying to touch file "C:\d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" trying to touch file "C:\Windows\SysWOW64\ntdll.dll" "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" trying to touch file "C:\Windows\SysWOW64\kernel32.dll" "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" trying to touch file "C:\Windows\SysWOW64\KernelBase.dll" "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll"41:Tdf4,"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" trying to access non-existent file "C:\FLTLIB.DLL" "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\CLR.DLL" "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\MSCORWKS.DLL" "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\CLR.DLL" "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\MSCORWKS.DLL" "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CLR.DLL" "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.DLL" "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.dll" "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\UCRTBASE_CLR0400.DLL" "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ucrtbase_clr0400.dll" "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSCOREE.DLL" "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\OLE32.DLL" "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ole32.dll" "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VERSION.DLL" "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VERSION.dll"42:Td18,"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" trying to access non-existent file "C:\Windows\SysWOW64\MSCOREE.DLL.LOCAL" "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\MSCOREE.DLL.local" "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" trying to access non-existent file "C:\D678623C64C737FD9C8372C8E67B9FCC536845C358626065FA92E40F5FE6C6C8.EXE.CONFIG" "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC" "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\D678623C64C737FD9C8372C8E67B9FCC536845C358626065FA92E40F5FE6C6C8.EXE.LOG" "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" trying to access non-existent file "C:\d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe.config" "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\PORNHUB" "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" trying to access non-existent file "C:\D678623C64C737FD9C8372C8E67B9FCC536845C358626065FA92E40F5FE6C6C8.INI" "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" trying to access non-existent file "C:\d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.INI" "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\SYSTEM.WINDOWS.FORMS" "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.WINDOWS.FORMS.INI" "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.INI" "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\SYSTEM.DRAWING" "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\SYSTEM.DRAWING.INI" "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.INI" "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\SYSTEM.SERV759BFB78#"43:T1455,Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004956.00000000.129897.03A30000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryfile:http:\\?\globalrootc:\d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe.configfile:///c:/d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exec:/d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exec:\d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exehttphttpsfilegophernntpnewsmailtouuidtelnetldapnet.tcpnet.pipevsmacrostargetframeworkmoniker.netportablesilverlightwindowsphone71windowsphone8.netframeworkversion=v4.7.2versionv4.7.24.7.20123456789abcdefsystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userconfigmachine.configc:\windows\microsoft.net\framework\v4.0.30319\c:\windows\microsoft.net\framework\v4.0.30319\configc:\windows\microsoft.net\framework\v4.0.30319\config\machine.configmachine.config\\.\modeaccessrightsshareconfig_base_unrecognized_elementsystem.security.cryptography.randomnumbergeneratorcryptonamemappingoidmapmscorlibmachine.configconfigurationcryptographysettingsc:\windows\microsoft.net\framework\v4.0.30319\config\c:\users\hapubws\appdata\roaming\microsoft\clr" - Source: "00000000-00004956.00000000.129897.05A20000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00004956.00000000.129897.05A20000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00004956.00000000.129897.05A20000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0xl0j0h" (Indicator: "GetDC"; Source: "00000000-00004956.00000000.129897.03A30000.00000004.mdmp, 00000000-00004956.00000001.131819.03A30000.00000004.mdmp, 00000000-00004956.00000002.133737.03A30000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00004956.00000000.129897.03A30000.00000004.mdmp, 00000000-00004956.00000001.131819.03A30000.00000004.mdmp, 00000000-00004956.00000002.133737.03A30000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00004956.00000000.129897.03A30000.00000004.mdmp, 00000000-00004956.00000001.131819.03A30000.00000004.mdmp, 00000000-00004956.00000002.133737.03A30000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00004956.00000000.129897.03A30000.00000004.mdmp, 00000000-00004956.00000001.131819.03A30000.00000004.mdmp, 00000000-00004956.00000002.133737.03A30000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00004956.00000000.129897.03A30000.00000004.mdmp, 00000000-00004956.00000001.131819.03A30000.00000004.mdmp, 00000000-00004956.00000002.133737.03A30000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00004956.00000000.129897.03A30000.00000004.mdmp, 00000000-00004956.00000001.131819.03A30000.00000004.mdmp, 00000000-00004956.00000002.133737.03A30000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00004956.00000000.129897.03A30000.00000004.mdmp, 00000000-00004956.00000001.131819.03A30000.00000004.mdmp, 00000000-00004956.00000002.133737.03A30000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00004956.00000000.129897.03A30000.00000004.mdmp, 00000000-00004956.00000001.131819.03A30000.00000004.mdmp, 00000000-00004956.00000002.133737.03A30000.00000004.mdmp")47:Tc1a,file/memory contains long string with (Indicator: "GetModuleHandle"; File: "WinD64.dll") file/memory contains long string with (Indicator: "PsLookupProcessByProcessId"; File: "WinD64.sys") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API "PsLookupProcessByProcessId" (Indicator: "PsLookupProcessByProcessId"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API "IoGetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API "IoGetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00004956.00000000.129897.05A20000.00000004.mdmp, 00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API "PsLookupProcessByProcessId" (Indicator: "PsLookupProcessByProcessId"; Source: "00000000-00004956.00000000.129897.05A20000.00000004.mdmp, 00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API "PsGetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp")48:T4c6,Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp")49:Te45,Found string ".\Device\WinD" (Indicator: "\Device\"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found string "\drivers\WinD64.sys" (Indicator: "\drivers\"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found string "\drivers\WinD64loader.sys" (Indicator: "\drivers\"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found string "\Device\" (Indicator: "\Device\"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found string "\Device\RDP_CONSOLE0" (Indicator: "\Device\"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found string "\Device\RDP_CONSOLE1" (Indicator: "\Device\"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found string "\Device\Termdd" (Indicator: "\Device\"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found string "\Device\RemoteVideo" (Indicator: "\Device\"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found string "\Device\WinD" (Indicator: "\Device\"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found string ":..\drivers\Win64e\iqvw64e.SY" (Indicator: "\drivers\"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found string "C:\Windows\System32\drivers\wmiacpi.sys" (Indicator: "\drivers\"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found string "C:\Windows\System32\drivers\wmiacpi.sys" (Indicator: "system32\drivers"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found string "C:\\Windows\\System32\\drivers\\wmiacpi.sys" (Indicator: "\drivers\"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found string "\??\%WINDIR%\system32\drivers\WinD64.sys" (Indicator: "\drivers\"; Source: "00000000-00004992-00000BC1-1033736220") Found string "\??\%WINDIR%\system32\drivers\WinD64.sys" (Indicator: "system32\drivers"; Source: "00000000-00004992-00000BC1-1033736220") Found string "\??\%WINDIR%\system32\drivers\WinD64loader.sys" (Indicator: "\drivers\"; Source: "00000000-00004992-00000BC1-1033736703") Found string "\??\%WINDIR%\system32\drivers\WinD64loader.sys" (Indicator: "system32\drivers"; Source: "00000000-00004992-00000BC1-1033736703") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00004956.00000000.129897.03A30000.00000004.mdmp, 00000000-00004956.00000001.131819.03A30000.00000004.mdmp, 00000000-00004956.00000002.133737.03A30000.00000004.mdmp") Found string "C:\Windows\System32\drivers\wmiacpi.sys" (Indicator: "\drivers\"; Source: "00000000-00004956.00000000.129897.05A20000.00000004.mdmp") Found string "C:\Windows\System32\drivers\wmiacpi.sys" (Indicator: "system32\drivers"; Source: "00000000-00004956.00000000.129897.05A20000.00000004.mdmp") Found string "\Device\WinD" (Indicator: "\Device\"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found string "\drivers\WinD64.sys" (Indicator: "\drivers\"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found string "\drivers\WinD64loader.sys" (Indicator: "\drivers\"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp")4a:T8d7,"inject.exe" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WIND64") "inject.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WIND64"; Key: "IMAGEPATH"; Value: "%WINDIR%\system32\drivers\WinD64.sys") "inject.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WIND64"; Key: "TYPE"; Value: "01000000") "inject.exe" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WIND64LOADER") "inject.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WIND64LOADER"; Key: "IMAGEPATH"; Value: "%WINDIR%\system32\drivers\WinD64loader.sys") "inject.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WIND64LOADER"; Key: "TYPE"; Value: "01000000") "inject.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WIND64LOADER"; Key: "FLOWCONTROLDISABLE"; Value: "78000000") "inject.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WIND64"; Key: "CFG"; Value: "10CDFC0000F8FFFFFCCFFC0000F8FFFF000000000000000000000000000000000000000000000000") "inject.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WIND64LOADER"; Key: "FLOWCONTROLDISPLAYBANDWIDTH"; Value: "000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000006F10FB0000F8FFFFFCCFFC0000F8FFFF040000000000000010CDFC0000F8FFFF0100000000000000000000000000000020000000000000006F10FB0000F8FFFF10CDFC0000F8FFFF04000000000000007110FB0000F8FFFF0100000000000000") "inject.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WIND64LOADER"; Key: "FLOWCONTROLDISPLAYBANDWIDTH"; Value: "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000006F10FB0000F8FFFFFCCFFC0000F8FFFF040000000000000010CDFC0000F8FFFF0100000000000000000000000000000020000000000000006F10FB0000F8FFFF10CDFC0000F8FFFF04000000000000007110FB0000F8FFFF0100000000000000")4b:T4ef,file/memory contains long string with (Indicator: "ReleaseMutex"; File: "WinD64.sys") Found reference to API "ReleaseMutex" (Indicator: "ReleaseMutex"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API "CreateMutexW" (Indicator: "CreateMutex"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API "KeReleaseMutex" (Indicator: "ReleaseMutex"; File: "d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8") Found reference to API "CreateMutexW" (Indicator: "CreateMutex"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API "ReleaseMutex" (Indicator: "ReleaseMutex"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp") Found reference to API "KeReleaseMutex" (Indicator: "ReleaseMutex"; Source: "00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp")1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790949776182,"unified_at":"2026-10-02T14:02:56.182Z","metadata":{"hashes":{"sha256":"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8","sha1":"5e10b13a75ff2a5733ca508ca9dfc99b43e81f50","md5":"d103ced7d8157bad7ef2d38f9c477f7b","sha512":"b2eb1b53743b6955b862f0d1c02281966fd5b1a30e4a2948e59e2236d3ba3e3b43e98b8c58b22faf7540d705d0e651a152b1d6182a411d42a3240183d8839446","ssdeep":"98304:e2bHRvhbxf+dm0Umts8T8rek3RBzjYz067yqu/mnFQOi33nFbO4KSgPTPgS8NAva:e21V9h2PRW2gNvNS","ssdeep_chunks":["98304:e2bHRvh","98304:2bHRvhb","98304:bHRvhbx","98304:HRvhbxf","98304:Rvhbxf+","98304:vhbxf+d","98304:hbxf+dm","98304:bxf+dm0","98304:xf+dm0U","98304:f+dm0Um","98304:+dm0Umt","98304:dm0Umts","98304:m0Umts8","98304:0Umts8T","98304:Umts8T8","98304:mts8T8r","98304:ts8T8re","98304:s8T8rek","98304:8T8rek3","98304:T8rek3R","98304:8rek3RB","98304:rek3RBz","98304:ek3RBzj","98304:k3RBzjY","98304:3RBzjYz","98304:RBzjYz0","98304:BzjYz06","98304:zjYz067","98304:jYz067y","98304:Yz067yq","98304:z067yqu","98304:067yqu/","98304:67yqu/m","98304:7yqu/mn","98304:yqu/mnF","98304:qu/mnFQ","98304:u/mnFQO","98304:/mnFQOi","98304:mnFQOi3","98304:nFQOi33","98304:FQOi33n","98304:QOi33nF","98304:Oi33nFb","98304:i33nFbO","98304:33nFbO4","98304:3nFbO4K","98304:nFbO4KS","98304:FbO4KSg","98304:bO4KSgP","98304:O4KSgPT","98304:4KSgPTP","98304:KSgPTPg","98304:SgPTPgS","98304:gPTPgS8","98304:PTPgS8N","98304:TPgS8NA","98304:PgS8NAv","98304:gS8NAva","196608:e2bHRvh","196608:2bHRvhb","196608:bHRvhbx","196608:HRvhbxf","196608:Rvhbxf+","196608:vhbxf+d","196608:hbxf+dm","196608:bxf+dm0","196608:xf+dm0U","196608:f+dm0Um","196608:+dm0Umt","196608:dm0Umts","196608:m0Umts8","196608:0Umts8T","196608:Umts8T8","196608:mts8T8r","196608:ts8T8re","196608:s8T8rek","196608:8T8rek3","196608:T8rek3R","196608:8rek3RB","196608:rek3RBz","196608:ek3RBzj","196608:k3RBzjY","196608:3RBzjYz","196608:RBzjYz0","196608:BzjYz06","196608:zjYz067","196608:jYz067y","196608:Yz067yq","196608:z067yqu","196608:067yqu/","196608:67yqu/m","196608:7yqu/mn","196608:yqu/mnF","196608:qu/mnFQ","196608:u/mnFQO","196608:/mnFQOi","196608:mnFQOi3","196608:nFQOi33","196608:FQOi33n","196608:QOi33nF","196608:Oi33nFb","196608:i33nFbO","196608:33nFbO4","196608:3nFbO4K","196608:nFbO4KS","196608:FbO4KSg","196608:bO4KSgP","196608:O4KSgPT","196608:4KSgPTP","196608:KSgPTPg","196608:SgPTPgS","196608:gPTPgS8","196608:PTPgS8N","196608:TPgS8NA","196608:PgS8NAv","196608:gS8NAva","98304:e21V9h2","98304:21V9h2P","98304:1V9h2PR","98304:V9h2PRW","98304:9h2PRW2","98304:h2PRW2g","98304:2PRW2gN","98304:PRW2gNv","98304:RW2gNvN","98304:W2gNvNS"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"cw.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":9928704,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1664244437000,"last_seen":1755688575000,"last_multi_scan":1755688575000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["agenttesla","gamehack","trojan","wacapew","wacatac","ymacco","evasive","wind","windows-server-utility"]},"stats":{"av":{"malicious_count":14,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":71},"sandbox_signatures":{"informative_count":186,"suspicious_count":34,"malicious_count":13,"total":233},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Staser","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1360845","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Application.MSILHeracles.32887","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"malicious","threat_name":"Malware_-6","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Generik.EBEBEQL trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Trojan/Generic!2E19E34919C7208F","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005958bd1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Staser.jydicl","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Mamut.A.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.MSIL.GRQ","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TScope.Trojan.MSIL","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Staser.Win32.12882","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan/Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"},{"type":"informative","value":"Contains reference to multiple windows system processes"},{"type":"informative","value":"Contains ability to control system service controller"},{"type":"suspicious","value":"Contains ability to open/control a service"}],"sources":[{"report_type":"sandbox","report_id":"63325ad359eaf57c0d4c8ee7"},{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"suspicious","value":"Contains ability to dynamically determine API calls"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to start a process (Dotnet)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Able to execute application (.NET)"},{"type":"informative","value":"Found Native API in Dotnet file"}],"sources":[{"report_type":"sandbox","report_id":"63325ad359eaf57c0d4c8ee7"},{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Found a reference to a WMI query string known to be used for VM detection"},{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"informative","value":"Contains ability to execute WMI queries (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"63325ad359eaf57c0d4c8ee7"},{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1547.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/006","identifiers":[{"type":"malicious","value":"Contains ability to start/interact with device drivers"},{"type":"malicious","value":"References suspicious system modules"}],"sources":[{"report_type":"sandbox","report_id":"63325ad359eaf57c0d4c8ee7"},{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"suspicious","value":"Calls an API typically used to enable or disable privileges in the specified access token"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"63325ad359eaf57c0d4c8ee7"},{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"63325ad359eaf57c0d4c8ee7"},{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Dotnet file contains encryption/decryption functions"},{"type":"informative","value":"PE file contains zero-sized sections"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"suspicious","value":"YARA signature match - RSA algorithm (keys)"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Dotnet file resource with suspicious entropy"},{"type":"informative","value":"Contains ability to perform crypto operations"},{"type":"informative","value":"YARA signature match - RC4 Encryption"},{"type":"malicious","value":"PE file contains executable resources"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains ability to perform symmetric encryption (Dotnet)"},{"type":"informative","value":"Contains ability to load manifest resource from assembly (Dotnet)"},{"type":"informative","value":"Contains ability to load content from resource"}],"sources":[{"report_type":"sandbox","report_id":"63325ad359eaf57c0d4c8ee7"},{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"63325ad359eaf57c0d4c8ee7"},{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Able to identify sandbox environment running process"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"The input sample contains the RDTSCP instruction"},{"type":"informative","value":"The input sample possibly contains the RDTSCP instruction"},{"type":"malicious","value":"The input sample contains a known anti-VM trick"}],"sources":[{"report_type":"sandbox","report_id":"63325ad359eaf57c0d4c8ee7"},{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"63325ad359eaf57c0d4c8ee7"},{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"63325ad359eaf57c0d4c8ee7"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Contains ability to retrieve list of files and subdirectories"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Contains references to file movement (imports API)"},{"type":"suspicious","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"}],"sources":[{"report_type":"sandbox","report_id":"63325ad359eaf57c0d4c8ee7"},{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"suspicious","value":"Reads information about supported languages"},{"type":"suspicious","value":"Reads the active computer name"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Able to query registry keys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"63325ad359eaf57c0d4c8ee7"},{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"suspicious","value":"Contains ability to enumerate processes/modules/threads"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Contains ability to gather process details (Dotnet)"},{"type":"suspicious","value":"Queries process information"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Process launched with changed environment"},{"type":"malicious","value":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"63325ad359eaf57c0d4c8ee7"},{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"Possibly checks for known debuggers/analysis tools"},{"type":"informative","value":"Possibly checks for the presence of an Antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"63325ad359eaf57c0d4c8ee7"},{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/techniques/T1120","identifiers":[{"type":"informative","value":"Queries volume information"}],"sources":[{"report_type":"sandbox","report_id":"63325ad359eaf57c0d4c8ee7"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"suspicious","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Able to gather system file/directory information (.NET)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads system-defined device setup information from registry"},{"type":"informative","value":"Contains ability to gather system information (Dotnet)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"suspicious","value":"Found system commands related strings"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads the cryptographic machine GUID"}],"sources":[{"report_type":"sandbox","report_id":"63325ad359eaf57c0d4c8ee7"},{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"suspicious","value":"Contains ability to open a port and listen for incoming connection"}],"sources":[{"report_type":"sandbox","report_id":"63325ad359eaf57c0d4c8ee7"},{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"63325ad359eaf57c0d4c8ee7"},{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to create a service (API string)"},{"type":"informative","value":"Creates or modifies windows services"},{"type":"malicious","value":"Unloads system drivers using native API calls"},{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to start a service (API string)"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"tactic":"Persistence","technique":"LSASS Driver","attack_id":"T1547.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/008","identifiers":[{"type":"malicious","value":"Loads a device driver"}],"sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"tactic":"Persistence","technique":"DLL","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","identifiers":[{"type":"informative","value":"Potential hijacking of DLL execution flow detected"}],"sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Imports system security related APIs"}],"sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"},{"type":"informative","value":"Contains ability to create a remote thread (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"},{"type":"informative","value":"Contains ability to modify process memory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to manipulate address space of the process (API string)"},{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"tactic":"Privilege Escalation","technique":"Portable Executable Injection","attack_id":"T1055.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/002","identifiers":[{"type":"informative","value":"Attempts remote code execution into another process memory space"}],"sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"tactic":"Defense Evasion","technique":"Code Signing Policy Modification","attack_id":"T1553.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/006","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains ability to delete device driver (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Contains ability to perform symmetric decryption (Dotnet)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"},{"type":"informative","value":"Contains ability to generate intermediate language instructions (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"malicious","value":"PE file contains executable resources"},{"type":"suspicious","value":"Section contains high entropy"},{"type":"informative","value":"YARA signature match – Embedded PE executable"},{"type":"informative","value":"YARA signature match - PE executable embedded in .rsrc section"}],"sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"malicious","value":"Drops executable files to the Windows system directory"}],"sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – Anomalous PE file structure"},{"type":"informative","value":"YARA signature match - Medium entropy File"}],"sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"suspicious","value":"Calls an API typically used for keylogging"}],"sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"suspicious","value":"Contains ability to enumerate services"},{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Able to query service configuration on system (API string)"},{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API typically used to get handle of currently active window"},{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Contains ability to get active window titles (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Contains ability to retrieve remote session information"}],"sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"},{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1021.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1021/001","identifiers":[{"type":"informative","value":"Contains ability to perform remote desktop activity"}],"sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"suspicious","value":"Calls an API possibly used to take screenshots"},{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Able to perform SQL operations"}],"sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Creates directory on disk"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Contains ability to upload data with network (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"malicious","value":"Drops system driver"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Contains ability to download files with network (Dotnet)"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains ability to provide interface for network protocols (Dotnet)"},{"type":"informative","value":"Contains ability to communicate with network (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Contains ability to perform symmetric crypto operations"},{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Calls APIs used for Remove Service"},{"type":"informative","value":"Calls an API used to open a process handle"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"},{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains ability to perform encryption (API string)"},{"type":"informative","value":"Able to access crypto-related API (String)"},{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]}],"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"cw.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"cw.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"63325ad359eaf57c0d4c8ee7"},{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"cw.exe\" queries volume information of \"C:\\cw.exe\" at 00000000-00003444-0000010C-16562239","origin":"API Call","mitre_attack_id":"T1120","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"63325ad359eaf57c0d4c8ee7"},{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"C:\\projects\\fontawesome-sharp\\FontAwesome.Sharp\\obj\\Release\\net472\\FontAwesome.Sharp.pdb\"\n \"/_/artifacts/obj/System.Security.Principal.Windows/net461-Windows_NT-Release/System.Security.Principal.Windows.pdb\"\n \"/_/artifacts/obj/System.ServiceProcess.ServiceController/net461-Windows_NT-Release/System.ServiceProcess.ServiceController.pdb\"\n \"/_/artifacts/obj/System.Diagnostics.EventLog/net461-Release/System.Diagnostics.EventLog.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"63325ad359eaf57c0d4c8ee7"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"\\Registry\\Machine\\System\\CurrentControlSet\\Services\\WinD64\"\n \"\\Registry\\Machine\\System\\CurrentControlSet\\Services\\\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"63325ad359eaf57c0d4c8ee7"},{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex\"\n \"DBWinMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"63325ad359eaf57c0d4c8ee7"},{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"General","name":"Found API related strings","description":"$25","origin":"File/Memory","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"63325ad359eaf57c0d4c8ee7"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"cw.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 670C0000","origin":"Loaded Module","id":"module-3","sources":[{"report_type":"sandbox","report_id":"63325ad359eaf57c0d4c8ee7"},{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.bin\" has an executable section named \".text\"\n \"inject.exe\" has an executable section named \".text\"\n \"Driver.sys\" has an executable section named \".text\"\n \"Driver.sys\" has an executable section named \"INIT\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"63325ad359eaf57c0d4c8ee7"},{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"inject.exe\" has an writable section named \".idata\"\n \"inject.exe\" has an writable section named \".rsrc\"\n \"Driver.sys\" has an writable section named \".data\"","origin":"Static Parser","relevance":1,"id":"static-95","sources":[{"report_type":"sandbox","report_id":"63325ad359eaf57c0d4c8ee7"},{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$26","origin":"Static Parser","relevance":1,"id":"static-96","sources":[{"report_type":"sandbox","report_id":"63325ad359eaf57c0d4c8ee7"},{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"cmd.exe\" (UID: 00000000-00003580)\n Spawned process \"cmd.exe\" (UID: 00000000-00003732)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"63325ad359eaf57c0d4c8ee7"},{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"cmd.exe\" (UID: 00000000-00003580)\n Spawned process \"cmd.exe\" (UID: 00000000-00003732)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"63325ad359eaf57c0d4c8ee7"},{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"General","name":"The input sample possibly contains the RDTSCP instruction","description":"Found VM detection artifact \"RDTSCP trick\" in \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.bin\" (Offset: 4838707)","origin":"Binary File","mitre_attack_id":"T1497","relevance":5,"id":"binary-26","sources":[{"report_type":"sandbox","report_id":"63325ad359eaf57c0d4c8ee7"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"cw.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"63325ad359eaf57c0d4c8ee7"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"inject.exe\" has type \"PE32+ executable (console) x86-64 (stripped to external PDB) for MS Windows\"- Location: [C:\\$Recycle.bin\\inject.exe]- [targetUID: 00000000-00003732]\n \"Driver.sys\" has type \"PE32+ executable (native) x86-64 for MS Windows\"- Location: [C:\\$Recycle.bin\\Driver.sys]- [targetUID: 00000000-00003444]","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"63325ad359eaf57c0d4c8ee7"},{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"cw.exe\" touched file \"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll\"\n \"cw.exe\" touched file \"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll\"\n \"cw.exe\" touched file \"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll\"\n \"cw.exe\" touched file \"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll\"\n \"cw.exe\" touched file \"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"63325ad359eaf57c0d4c8ee7"},{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$27","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"63325ad359eaf57c0d4c8ee7"},{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"\"https://fontawesome.com\" (Indicator: \"https://\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"63325ad359eaf57c0d4c8ee7"},{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found a reference to a known community page","description":"\"YoutubeSquare\" (Indicator: \"youtube\")\n \"TwitterSquare\" (Indicator: \"twitter\")\n \"twitter-square\" (Indicator: \"twitter\")\n \"paypal\ngoogle-wallet\" (Indicator: \"paypal\")\n \"cc-amexcc-paypalcc-stripe\" (Indicator: \"paypal\")\n \"youtube-squareflipboard\" (Indicator: \"youtube\")\n \"resources/twitter.png\" (Indicator: \"twitter\")","origin":"File/Memory","relevance":7,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"63325ad359eaf57c0d4c8ee7"},{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"cw.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"63325ad359eaf57c0d4c8ee7"},{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.bin\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"63325ad359eaf57c0d4c8ee7"},{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Contains ability to open/control a service","description":"ns0.Class17::OpenService at d103ced7d8157bad7ef2d38f9c477f7b-6000162-Class16~smethod_1","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1569.002","relevance":8,"id":"stream-14","sources":[{"report_type":"sandbox","report_id":"63325ad359eaf57c0d4c8ee7"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"cw.exe\" at 00000000-00003444-00000105-17243681","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"63325ad359eaf57c0d4c8ee7"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"$28","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"63325ad359eaf57c0d4c8ee7"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"cw.exe\" is allocating memory with PAGE_GUARD access rights","origin":"API Call","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"63325ad359eaf57c0d4c8ee7"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"\"ollydbg\" (Indicator: \"ollydbg\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":2,"id":"string-5","sources":[{"report_type":"sandbox","report_id":"63325ad359eaf57c0d4c8ee7"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a reference to a WMI query string known to be used for VM detection","description":"\"Win32_BaseBoard\" (Indicator: \"win32_baseboard\"; File: \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.bin\")\n \"Win32_VideoController\" (Indicator: \"win32_videocontroller\"; File: \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.bin\")\n \"Win32_CDROMDrive\" (Indicator: \"win32_cdromdrive\"; File: \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.bin\")\n \"Win32_Processor\" (Indicator: \"win32_process\"; File: \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.bin\")\n \"Win32_DiskDrive\" (Indicator: \"win32_diskdrive\"; File: \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.bin\")\n \"Win32_BIOS\" (Indicator: \"win32_bios\"; File: \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.bin\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-55","sources":[{"report_type":"sandbox","report_id":"63325ad359eaf57c0d4c8ee7"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"cw.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"63325ad359eaf57c0d4c8ee7"},{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"cw.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"63325ad359eaf57c0d4c8ee7"},{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"52/69 Antivirus vendors marked sample as malicious (75% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"63325ad359eaf57c0d4c8ee7"},{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"suspicious","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: inject.exe)","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"63325ad359eaf57c0d4c8ee7"},{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"suspicious","category":"General","name":"PE file has a high image base","description":"\"Driver.sys\" has high imagebase \"0x140000000\"","origin":"Static Parser","relevance":5,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"63325ad359eaf57c0d4c8ee7"},{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"inject.exe\" has type \"PE32+ executable (console) x86-64 (stripped to external PDB) for MS Windows\"- Location: [C:\\$Recycle.bin\\inject.exe]- [targetUID: 00000000-00003732]\n \"Driver.sys\" has type \"PE32+ executable (native) x86-64 for MS Windows\"- Location: [C:\\$Recycle.bin\\Driver.sys]- [targetUID: 00000000-00003444]","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"63325ad359eaf57c0d4c8ee7"},{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"\"cw.exe\" wrote 26624 bytes starting with PE header signature to file \"C:\\$Recycle.bin\\inject.exe\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...","origin":"API Call","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"63325ad359eaf57c0d4c8ee7"},{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection","description":"System.Windows.Forms.Control::set_TabIndex at d103ced7d8157bad7ef2d38f9c477f7b-600004e-Form1~InitializeComponent\n System.Windows.Forms.PictureBox::set_TabIndex at d103ced7d8157bad7ef2d38f9c477f7b-6000055-LoadingPage~InitializeComponent","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1571","relevance":5,"id":"stream-85","sources":[{"report_type":"sandbox","report_id":"63325ad359eaf57c0d4c8ee7"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Potential IP \"3.7.8.4\" found in string \"3.7.8.4+e75d63b38a33bd71c77e83b76b248d8b5e117289\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"63325ad359eaf57c0d4c8ee7"},{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"\"cw.exe\" called \"FindNextFileW\" (UID: 00000000-00003444)\n \"cw.exe\" called \"FindFirstFileW\" (UID: 00000000-00003444)","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"63325ad359eaf57c0d4c8ee7"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"cw.exe\" marked \"C:\\$Recycle.bin\\inject.exe\" for deletion\n \"cmd.exe\" marked \"C:\\$Recycle.Bin\\S-1-5-21-2092356043-4041700817-663127204-1001\\desktop.ini\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"63325ad359eaf57c0d4c8ee7"},{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"cw.exe\" opened \"C:\\$Recycle.bin\\inject.exe\" with delete access\n \"cmd.exe\" opened \"C:\\$Recycle.Bin\\S-1-5-21-2092356043-4041700817-663127204-1001\\desktop.ini\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"63325ad359eaf57c0d4c8ee7"},{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"suspicious","category":"System Security","name":"Adjusts debug privileges","description":"\"cw.exe\" adjusted SE_DEBUG_PRIVILEGE","origin":"API Call","relevance":3,"id":"api-28","sources":[{"report_type":"sandbox","report_id":"63325ad359eaf57c0d4c8ee7"}]},{"level":"suspicious","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"cw.exe\" called \"AdjustTokenPrivileges\" (UID: 00000000-00003444)","origin":"API Call","mitre_attack_id":"T1134","relevance":5,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"63325ad359eaf57c0d4c8ee7"},{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"inject.exe\" claimed CRC 153765 while the actual is CRC 9982744\n \"Driver.sys\" claimed CRC 24098 while the actual is CRC 131710","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"63325ad359eaf57c0d4c8ee7"},{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"StartServiceW\n StartServiceCtrlDispatcherW\n CreateServiceW\n WriteProcessMemory\n VirtualAllocEx\n GetModuleFileNameW\n LoadLibraryA\n GetCommandLineW\n CreateRemoteThread\n GetFileSize\n OpenProcess\n LockResource\n DeleteFileA\n LoadLibraryExW\n DeleteFileW\n GetProcAddress\n GetModuleHandleA\n GetSystemDirectoryW\n WriteFile\n GetSystemDirectoryA\n FindResourceW\n CreateFileW\n NtQueryInformationProcess","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"63325ad359eaf57c0d4c8ee7"},{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"cw.exe\" wrote bytes \"c04e117720541277e0651277b53813770000000000d0d57500000000c5ead5750000000088ead57500000000e968157582281377ee29137700000000d2691575000000007dbbd5750000000009be157500000000ba18d57500000000\" to virtual address \"0x75351000\" (part of module \"NSI.DLL\")\n \"cw.exe\" wrote bytes \"ecf3832f\" to virtual address \"0x684DF798\" (part of module \"CLR.DLL\")\n \"cw.exe\" wrote bytes \"db4df66c00000000\" to virtual address \"0x00082000\" (part of module \"CW.EXE\")\n \"cmd.exe\" wrote bytes \"c04e117720541277e0651277b53813770000000000d0d57500000000c5ead5750000000088ead57500000000e968157582281377ee29137700000000d2691575000000007dbbd5750000000009be157500000000ba18d57500000000\" to virtual address \"0x75351000\" (part of module \"NSI.DLL\")","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"63325ad359eaf57c0d4c8ee7"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"cw.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"cw.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"cw.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"cw.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")\n \"cw.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"63325ad359eaf57c0d4c8ee7"},{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.bin\" claims program is from Mon Jan 11 03:53:30 2106\n \"inject.exe\" claims program is from Thu Jan 1 18:12:16 1970","origin":"Static Parser","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"63325ad359eaf57c0d4c8ee7"},{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"PE file contains executable resources","description":"inject.exe has PE file in resource with name: \"RT_RCDATA\" and filetype:PE32+ executable (DLL) (native) x86-64\n for MS Windows\n inject.exe has PE file in resource with name: \"RT_RCDATA\" and filetype:PE32+ executable (DLL) (native) x86-64 (stripped to external PDB)\n for MS Windows\n inject.exe has PE file in resource with name: \"RT_RCDATA\" and filetype:PE32+ executable (DLL) (console) x86-64 (stripped to external PDB)\n for MS Windows","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-97","sources":[{"report_type":"sandbox","report_id":"63325ad359eaf57c0d4c8ee7"},{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"malicious","category":"Environment Awareness","name":"The input sample contains a known anti-VM trick","description":"Found VM detection artifact \"CPUID trick\" in \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.bin\" (Offset: 9223297)","origin":"Binary File","mitre_attack_id":"T1497","relevance":5,"id":"binary-8","sources":[{"report_type":"sandbox","report_id":"63325ad359eaf57c0d4c8ee7"},{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"63325ad359eaf57c0d4c8ee7"},{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"52/69 Antivirus vendors marked sample as malicious (75% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"63325ad359eaf57c0d4c8ee7"},{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"63325ad359eaf57c0d4c8ee7"},{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"malicious","category":"General","name":"Contains ability to start/interact with device drivers","description":"ns0.Class27::DeviceIoControl at d103ced7d8157bad7ef2d38f9c477f7b-600025d-Class27~method_2T_U\n ns0.Class27::DeviceIoControl at d103ced7d8157bad7ef2d38f9c477f7b-6000260-Class27~smethod_0","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-21","sources":[{"report_type":"sandbox","report_id":"63325ad359eaf57c0d4c8ee7"},{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"46/69 Antivirus vendors marked dropped file \"inject.exe\" as malicious (classified as \"Trojan.Generic\" with 66% detection rate)\n 1/69 Antivirus vendors marked dropped file \"Driver.sys\" as malicious (classified as \"Malware.Generic\" with 1% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"63325ad359eaf57c0d4c8ee7"}]},{"level":"malicious","category":"Installation/Persistence","name":"Drops system driver","description":"\"Driver.sys\" has type \"PE32+ executable (native) x86-64 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-2","sources":[{"report_type":"sandbox","report_id":"63325ad359eaf57c0d4c8ee7"},{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"malicious","category":"Unusual Characteristics","name":"References suspicious system modules","description":"\"lsass\"","origin":"File/Memory","mitre_attack_id":"T1547.006","relevance":5,"id":"string-24","sources":[{"report_type":"sandbox","report_id":"63325ad359eaf57c0d4c8ee7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"inject.exe\" called \"FindResourceW\" with parameter \"30\" - (UID: 00000000-00004992)\n \"inject.exe\" called \"FindResourceW\" with parameter \"20\" - (UID: 00000000-00004992)\n \"inject.exe\" called \"FindResourceW\" with parameter \"10\" - (UID: 00000000-00004992)\n \"inject.exe\" called \"FindResourceW\" with parameter \"30\" - (UID: 00000000-00007536)\n \"inject.exe\" called \"FindResourceW\" with parameter \"20\" - (UID: 00000000-00007536)\n \"inject.exe\" called \"FindResourceW\" with parameter \"10\" - (UID: 00000000-00007536)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"inject.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '4215008'}\" (UID: 00000000-00004992)\n \"inject.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '4214992'}\" (UID: 00000000-00004992)\n \"inject.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '4214976'}\" (UID: 00000000-00004992)\n \"inject.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '4215008'}\" (UID: 00000000-00007536)\n \"inject.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '4214992'}\" (UID: 00000000-00007536)\n \"inject.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '4214976'}\" (UID: 00000000-00007536)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to create a remote thread (API string)","description":"Found reference to API \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; File: \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8\")\n Found reference to API \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; Source: \"00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-79","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to generate intermediate language instructions (Dotnet)","description":"Observed namespace \"System.Reflection.Emit.DynamicMethod\" and TypeReference \"GetILGenerator\" in \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8\"\n Observed namespace \"System.Reflection.Emit.ILGenerator\" and TypeReference \"Emit\" in \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8\"\n Observed namespace \"System.Reflection.Emit.ILGenerator\" and TypeReference \"EmitCall\" in \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8\"","origin":"Static Parser","mitre_attack_id":"T1620","relevance":1,"id":"static-171","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load content from resource","description":"Observed function \"ResourceManager.GetObject\" in \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-112","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load manifest resource from assembly (Dotnet)","description":"Observed namespace \"System.Reflection.Assembly\" and TypeReference \"GetManifestResourceStream\" in \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-173","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify process memory (API string)","description":"Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; File: \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8\")\n Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":1,"id":"string-439","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; File: \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8\")\n Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; Source: \"00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00004956.00000000.129897.03A30000.00000004.mdmp, 00000000-00004956.00000001.131819.03A30000.00000004.mdmp, 00000000-00004956.00000002.133737.03A30000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file contains encryption/decryption functions","description":"Observed namespace \"System.Security.Cryptography\" and MemberReference \"CreateDecryptor\" in \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-134","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file resource with suspicious entropy","description":"$2d","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-129","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00004956.00000000.129897.05A20000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00004956.00000000.129897.06A20000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00004956.00000001.131819.06A20000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00004956.00000002.133737.06A20000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - set obj=GetObject(\"winmgmts:\\\\.\\root\\default:Systemrestore\"); Source: \"00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"NtQueryInformationProcess\" (Indicator: \"NtQueryInformationProcess\"; File: \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-sized sections","description":"Raw size of \".bss\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00004956.00000000.129897.05A20000.00000004.mdmp\")\n Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00004956.00000000.129897.05A20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform crypto operations","description":"Observed namespace \"System.Security.Cryptography\" in [Source: \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8\"]","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-118","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00004956.00000001.131819.03B09000.00000004.mdmp, 00000000-00004956.00000002.133737.03B09000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00004956.00000000.129897.05A20000.00000004.mdmp\")\n Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00004956.00000000.129897.05A20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform symmetric crypto operations","description":"Observed namespace \"System.Security.Cryptography.RijndaelManaged\" and TypeReference \".ctor\" in \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8\"","origin":"Static Parser","mitre_attack_id":"T1573.001","relevance":1,"id":"static-140","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform symmetric decryption (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateDecryptor\" in \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-168","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform symmetric encryption (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateEncryptor\" in \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-165","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"http://www.w3.org/2001/04/xmlenc# EncryptedKey\" (Indicator: \"encryptedkey\"; Source: \"00000000-00004956.00000000.129897.05A20000.00000004.mdmp\")\n Found string \"System.Security.Cryptography.Xml.KeyInfoEncryptedKey, System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\" (Indicator: \"encryptedkey\"; Source: \"00000000-00004956.00000000.129897.05A20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: YARA signature match - RC4 Encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$2e","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - RC4 Encryption","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2f","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"$30","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system file/directory information (.NET)","description":"Observed dotnet function \"GetFiles\" in \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":3,"id":"static-200","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify sandbox environment running process","description":"Found string \"VGAuthService.exe\" (Indicator: \"VGAuthService.exe\"; Source: \"00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp\")\n Found string \"vmtoolsd.exe\" (Indicator: \"vmtoolsd.exe\"; Source: \"00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-666","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"file/memory contains long string with (Indicator: \"NtQuerySystemInformation\"; File: \"WinD64.exe\")\n Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; File: \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8\")\n Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004956-00000C2B-1054569585\")\n Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"WinD64.exe\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8\")\n Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; Source: \"00000000-00004956-00000C2B-1053285609\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00004956-00000C2B-1052880656\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00004956-00000C2B-1030411400\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00004956-00000C2B-1030411920\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query service configuration on system (API string)","description":"Found string \"QueryServiceConfigW\" (File: \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8\")\n Found string \"EnumServicesStatusExW\" (File: \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8\")\n Found string \"EnumServicesStatusExW\" (Source: \"00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp\")\n Found string \"QueryServiceConfigW\" (Source: \"00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-910","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"NtQuerySystemInformation\" in file \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8\"\n Found system information discovery API: \"NtQuerySystemInformation\" in \"00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp\"\n Found system information discovery API: \"ZwQuerySystemInformation\" in \"00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00004956)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00004956)\n \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00004956)\n \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe\" called \"GlobalMemoryStatusEx\" with parameters (UID: 00000000-00004956)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00004956)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe\" called \"IsWow64Process\" with parameter \"4956\" - (UID: 00000000-00004956)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe\" called \"GetWindowTextW\" with parameter \"4f004b00\" - (UID: 00000000-00004956)\n \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe\" called \"GetWindowTextW\" with parameter \"Driver Failed To Load At Injection Phase.\" - (UID: 00000000-00004956)\n \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe\" called \"GetWindowTextW\" with parameter \"LoadingPage\" - (UID: 00000000-00004956)\n \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe\" called \"GetWindowTextW\" (UID: 00000000-00004956)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get handle of currently active window","description":"\"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe\" called \"GetActiveWindow\" (UID: 00000000-00004956)","origin":"API Call","mitre_attack_id":"T1010","relevance":5,"id":"api-150","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00004956)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$32","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe\" called \"GetVersionExA\" with parameter 940000000600000002000000f0230000020000000035313265656435303138333563663733353132656564353031303030303030303033306463303830306430646161393732313861316161373236643030373330303633303036663030373230303635303036353030363930303265303036343030366330303663303030303030303030303030303030303030303030303030 (UID: 00000000-00004956)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00004956)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute WMI queries (Dotnet)","description":"Observed namespace \"System.Management.ManagementObjectSearcher\" in \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8\"","origin":"Static Parser","mitre_attack_id":"T1047","relevance":1,"id":"static-114","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to gather system information (Dotnet)","description":"Observed function \"get_MachineName\" in \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":1,"id":"static-120","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to get active window titles (Dotnet)","description":"Observed Namespace \"System.Diagnostics.Process\" and MemberReference \"get_MainWindowTitle\" in \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8\"","origin":"Static Parser","mitre_attack_id":"T1010","relevance":1,"id":"static-148","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"Found string \"Set JArray values with invalid key value: {0}. Int32 array index expected.\" (Indicator: \"set \"; File: \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8\")\n Found string \"Set JConstructor values with invalid key value: {0}. Argument position index expected.\" (Indicator: \"set \"; File: \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8\")\n Found string \"Set JObject values with invalid key value: {0}. Object property name expected.\" (Indicator: \"set \"; File: \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8\")\n Found string \"Set Location\" (Indicator: \"set \"; File: \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8\")\n Found string \"Set Quick DA Settings\" (Indicator: \"set \"; File: \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"cmd.exe\" queries volume information of \"C:\\\" at 00000000-00003624-00000C17-1033154109","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; File: \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8\")\n Found reference to API \"EnumServicesStatusExW\" (Indicator: \"EnumServicesStatus\"; File: \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8\")\n Found reference to API \"EnumServicesStatusExW\" (Indicator: \"EnumServicesStatus\"; Source: \"00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp\")\n Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"General","name":"Able to execute application (.NET)","description":"Observed function \"System.Diagnostics.ProcessStartInfo.UseShellExecute\" in \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":3,"id":"static-108","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"file/memory contains long string with (Indicator: \"MoveFileExW\"; File: \"WinD64.exe\")\n Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; File: \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8\")\n Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; Source: \"00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe\" called \"CreateDirectoryW\" with parameter C:\\$Recycle.bin (UID: 00000000-00004956)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe\" called \"CreateProcessW\" with parameter \"\"cmd.exe\"\" - (UID: 00000000-00004956)\n \"cmd.exe\" called \"CreateProcessW\" with parameter \"inject.exe /i\" - (UID: 00000000-00003624)\n \"cmd.exe\" called \"CreateProcessW\" with parameter \"inject.exe /l C:\\$Recycle.Bin\\Driver.sys\" - (UID: 00000000-00003624)\n \"cmd.exe\" called \"CreateProcessW\" with parameter \"inject.exe /u\" - (UID: 00000000-00003624)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\" - (UID: 00000000-00004956)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$33","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$34","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; File: \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8\")\n Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"8358439490,6892,3142,,CreateProcessW,kernel32.dll,\"00:33:48.140\",RX=0,PX=0\" (Indicator: \"CreateProcess\"; Source: \"00000000-00004956.00000000.129897.03A30000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"file/memory contains long string with (Indicator: \"NtOpenFile\"; File: \"WinD64.dll\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8\")\n Found reference to API \"NtOpenFile\" (Indicator: \"NtOpenFile\"; File: \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp\")\n Found reference to API \"NtOpenFile\" (Indicator: \"NtOpenFile\"; Source: \"00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"General","name":"Contains ability to download files with network (Dotnet)","description":"Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadString\" in \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadData\" in \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8\"","origin":"Static Parser","mitre_attack_id":"T1105","relevance":1,"id":"static-99","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$36","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteExA\" (Indicator: \"ShellExecute\"; Source: \"00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; File: \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8\")\n Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; Source: \"00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"IcaCreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"General","name":"Contains ability to start a process (Dotnet)","description":"Observed function \"Process.Start\" in \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8\"\n Observed function \"Process.get_StartTime\" in \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8\"\n Observed function \"Process.get_StartInfo\" in \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-111","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"\"WinD64.dll\" contains export function called \"_dll_main\" at ordinal 1\n \"WinD64.sys\" contains export function called \"_driver_entry\" at ordinal 1","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"General","name":"Contains references to file movement (imports API)","description":"Found MoveFileExW in import section (Source: WinD64.exe)","origin":"Static Parser","mitre_attack_id":"T1083","relevance":1,"id":"static-205","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"General","name":"Creates directory on disk","description":"\"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe\" with parameter C:\\$Recycle.bin (UID: 00000000-00004956)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-318","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$39","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"Driver.sys\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_GUARD_CF","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"General","name":"Found Native API in Dotnet file","description":"$3a","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-101","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$3b","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 74F70000\n \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 72BF0000\n \"cmd.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 74F70000\n \"inject.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 74280000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 72160000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75A00000\n \"cmd.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75A00000\n \"inject.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 76DC0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8\" was detected as \".NET\" and name: \"Library\"\n \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"WinD64.exe\" was detected as \".NET\" and name: \"Library\"\n \"WinD64.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"WinD64.dll\" was detected as \".NET\" and name: \"Library\"\n \"WinD64.dll\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"Driver.sys\" was detected as \".NET\" and name: \"Library\"\n \"Driver.sys\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"WinD64.sys\" was detected as \".NET\" and name: \"Library\"\n \"WinD64.sys\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","relevance":1,"id":"static-144","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"Driver.sys\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x977600\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x977524\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"General","name":"Possibly checks for the presence of an Antivirus engine","description":"\"TencentWeibo\" (Indicator: \"tencent\") in Source: d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":2,"id":"string-8","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\SysWOW64\\cmd.exe\" [Source: 00000000-00004956-00000BC0-1031641877]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"cmd.exe\" (UID: 00000000-00004816) was launched with new environment variables: \"USERDNSDOMAIN=\"DESKTOP-FVVF82A\", PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"cmd.exe\" (UID: 00000000-00004816) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS\"\n Process \"inject.exe\" (UID: 00000000-00004992) was launched with new environment variables: \"PROMPT=\"$P$G\"\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"General","name":"The input sample contains the RDTSCP instruction","description":"Found VM detection artifact \"RDTSCP trick\" in \"sample.bin\" (Offset: 4838707)","origin":"Binary File","mitre_attack_id":"T1497","relevance":5,"id":"binary-26","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Installation/Persistence","name":"Attempts remote code execution into another process memory space","description":"\"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe\" called \"NtWriteVirtualMemory\" with parameters {\"ProcessHandle\": \"1008\"\n \"BaseAddress\": \"00C121E8\"\n \"Buffer\": \"016FE8A0\"\n \"NumberOfBytesToWrite\": \"00000004\"\n \"$name\": \"C:\\\\Windows\\\\SysWOW64\\\\cmd.exe\"}\n \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe\" called \"NtWriteVirtualMemory\" with parameters {\"ProcessHandle\": \"1084\"\n \"BaseAddress\": \"0028D1E8\"\n \"Buffer\": \"016FE8A0\"\n \"NumberOfBytesToWrite\": \"00000004\"\n \"$name\": \"C:\\\\Windows\\\\SysWOW64\\\\cmd.exe\"}","origin":"API Call","mitre_attack_id":"T1055.002","relevance":1,"id":"api-315","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create a service (API string)","description":"Found reference to API \"RegisterServiceCtrlHandlerW\" (Indicator: \"RegisterServiceCtrlHandler\"; File: \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8\")\n Found reference to API \"CreateServiceW\" (Indicator: \"CreateService\"; File: \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8\")\n Found reference to API \"CreateServiceW\" (Indicator: \"CreateService\"; Source: \"00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp\")\n Found reference to API \"RegisterServiceCtrlHandlerW\" (Indicator: \"RegisterServiceCtrlHandler\"; Source: \"00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-199","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$3d","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Installation/Persistence","name":"Potential hijacking of DLL execution flow detected","description":"\"WinD64.dll\" has type \"PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows 5 sections\"- Location: [%WINDIR%\\System32\\WinD64.dll]- [targetUID: 00000000-00007536]\n \"WinD64.sys\" has type \"PE32+ executable (DLL) (native) x86-64 (stripped to external PDB) for MS Windows 6 sections\"- Location: [%WINDIR%\\System32\\drivers\\WinD64.sys]- [targetUID: 00000000-00007536]","origin":"Binary File","mitre_attack_id":"T1574.001","relevance":5,"id":"binary-91","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe\" queries basic process information of the \"C:\\d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe\" (UID: 4956)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$3e","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$3f","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify sandbox environment running process\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)\n Matched sigs: Able to perform sandbox evasion using APIs\n Matched sigs: The input sample contains the RDTSCP instruction\n Matched sigs: The input sample contains a known anti-VM trick","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$40","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$41","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$42","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe\" writes file \"\\device\\namedpipe\"\n \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe\" writes file \"c:\\$recycle.bin\\driver.sys\"\n \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe\" writes file \"c:\\$recycle.bin\\inject.exe\"\n \"cmd.exe\" writes file \"\\device\\namedpipe\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (Dotnet)","description":"Observed Namespace \"System.Net.WebClient\" and MemberReference \".ctor\" in \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadString\" in \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"UploadValues\" in \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadData\" in \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8\"","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-158","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Network Related","name":"Contains ability to provide interface for network protocols (Dotnet)","description":"Observed namespace \"System.Net\" in \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8\"","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-110","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Network Related","name":"Contains ability to upload data with network (Dotnet)","description":"Observed Namespace \"System.Net.WebClient\" and MemberReference \"UploadValues\" in \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8\"","origin":"Static Parser","mitre_attack_id":"T1005","relevance":1,"id":"static-142","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"ote: There is some performance penalty associated with assembly bind failure logging.\" (Indicator: \" bind \"; Source: \"00000000-00004956.00000000.129897.03A30000.00000004.mdmp, 00000000-00004956.00000001.131819.03A30000.00000004.mdmp, 00000000-00004956.00000002.133737.03A30000.00000004.mdmp\")\n Found reference to API \"o enable assembly bind failure logging, set the registry value [HKLM\\Software\\Microsoft\\Fusion!EnableLog] (DWORD) to 1.\" (Indicator: \" bind \"; Source: \"00000000-00004956.00000000.129897.03A30000.00000004.mdmp, 00000000-00004956.00000001.131819.03A30000.00000004.mdmp, 00000000-00004956.00000002.133737.03A30000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$43","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Medium entropy File","description":"YARA signature to detect medium entropy file file \"sample.bin\"\n YARA signature to detect medium entropy file process \"00000000-00004956\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":5,"id":"yara-606","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - PE executable embedded in .rsrc section","description":"YARA signature for embedded PE executable in .rsrc section matched on file \"inject.exe\"\n YARA signature for embedded PE executable in .rsrc section matched on file \"WinD64.exe\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":5,"id":"yara-26","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RC4 Encryption","description":"YARA signature for RC4 encryption matched on file \"sample.bin\"\n YARA signature for RC4 encryption matched on process \"00000000-00004956\"","origin":"YARA Signature","mitre_attack_id":"T1027","id":"yara-104","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Embedded PE executable","description":"YARA signature matched on embedded PE in file \"sample.bin\"\n YARA signature matched on embedded PE in file \"inject.exe\"\n YARA signature matched on embedded PE in file \"WinD64.exe\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":2,"id":"yara-140","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to perform remote desktop activity","description":"ns0.Class14::WTSOpenServer(System.String) at d103ced7d8157bad7ef2d38f9c477f7b-600015a-Class14~smethod_0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1021.001","relevance":5,"id":"stream-137","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to retrieve remote session information","description":"ns0.Class14::WTSEnumerateSessions(System.IntPtr,System.Int32,System.Int32,System.IntPtr&,System.Int32&) at d103ced7d8157bad7ef2d38f9c477f7b-600015a-Class14~smethod_0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1018","relevance":5,"id":"stream-138","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLEC8732AD23DD5E573198456F4F1B6]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00004956.00000000.129897.03A30000.00000004.mdmp, 00000000-00004956.00000001.131819.03A30000.00000004.mdmp, 00000000-00004956.00000002.133737.03A30000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00004956.00000000.129897.03A30000.00000004.mdmp, 00000000-00004956.00000001.131819.03A30000.00000004.mdmp, 00000000-00004956.00000002.133737.03A30000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to perform SQL operations","description":"Found string \"System.Data.SqlClient\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00004956.00000000.129897.05A20000.00000004.mdmp\")\n Found string \"\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00004956.00000000.129897.05A20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"QueryRegistryValues (in long string)\" in file \"WinD64.sys\"\n Found registry query API: \"RtlQueryRegistryValues\" in file \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8\"\n Found registry query API: \"RtlQueryRegistryValues\" in \"00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$44","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"cmd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"inject.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$45","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$46","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$47","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to gather process details (Dotnet)","description":"Observed function \"GetProcessesByName\" in \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8\"\n Observed function \"get_ProcessName\" in \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8\"","origin":"Static Parser","mitre_attack_id":"T1057","relevance":1,"id":"static-100","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"file/memory contains long string with (Indicator: \"GetModuleHandle\"; File: \"WinD64.dll\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$48","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve list of files and subdirectories","description":"Found string \"DIr\" (Indicator: \"dir\"; Source: \"00000000-00004956.00000000.129897.03A30000.00000004.mdmp, 00000000-00004956.00000001.131819.03A30000.00000004.mdmp, 00000000-00004956.00000002.133737.03A30000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-328","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"NtQueryInformationProcess\" (Indicator: \"NtQueryInformationProcess\"; File: \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; File: \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8\")\n Found reference to API \"NtQueryInformationProcess\" (Indicator: \"NtQueryInformationProcess\"; Source: \"00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"passwordFormat\" (Indicator: \"password\"; Source: \"00000000-00004956.00000000.129897.05A20000.00000004.mdmp\")\n Found string \"passwordAttemptWindow\" (Indicator: \"password\"; Source: \"00000000-00004956.00000000.129897.05A20000.00000004.mdmp\")\n Found string \"passwordStrengthRegularExpression\" (Indicator: \"password\"; Source: \"00000000-00004956.00000000.129897.05A20000.00000004.mdmp\")\n Found string \"passwordFormat=\"Hashed\"\" (Indicator: \"password\"; Source: \"00000000-00004956.00000000.129897.05A20000.00000004.mdmp\")\n Found string \"passwordAttemptWindow=\"10\"\" (Indicator: \"password\"; Source: \"00000000-00004956.00000000.129897.05A20000.00000004.mdmp\")\n Found string \"passwordStrengthRegularExpression=\"\" />\" (Indicator: \"password\"; Source: \"00000000-00004956.00000000.129897.05A20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"System Security","name":"Able to manipulate address space of the process (API string)","description":"Found string \"KeUnstackDetachProcess\" (File: \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8\")\n Found string \"KeStackAttachProcess\" (File: \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8\")\n Found string \"KeStackAttachProcess\" (Source: \"00000000-00004956.00000000.129897.05A20000.00000004.mdmp\")\n Found string \"KeUnstackDetachProcess\" (Source: \"00000000-00004956.00000000.129897.05A20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-912","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"file/memory contains long string with (Indicator: \"OpenProcess\"; File: \"WinD64.exe\")\n Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8\")\n Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00004956-00000C2B-1030024414\")\n Found string \"OpenProcessTokenW\" (Indicator: \"OpenProcess\"; Source: \"00000000-00004956-00000C2B-1031257230\")\n Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"System Security","name":"Calls APIs used for Remove Service","description":"Observed import api \"DeleteService\" which can \"Deregister service in Service Control Manager database\" [Source: WinD64.exe]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-188","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: WinD64.exe]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$49","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"System Security","name":"Contains ability to control system service controller","description":"Observed function \"ServiceController\" in \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8\"","origin":"Static Parser","mitre_attack_id":"T1569.002","relevance":1,"id":"static-117","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete device driver (API string)","description":"file/memory contains long string with (Indicator: \"IoDeleteDevice\"; File: \"WinD64.sys\")\n Found reference to API \"IoDeleteDevice\" (Indicator: \"IoDeleteDevice\"; File: \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8\")\n Found reference to API \"IoDeleteDevice\" (Indicator: \"IoDeleteDevice\"; Source: \"00000000-00004956.00000000.129897.05A20000.00000004.mdmp, 00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-463","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8\")\n Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; File: \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8\")\n Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; Source: \"00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"SeDebugPrivilegeT\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00004956.00000001.131819.03A30000.00000004.mdmp, 00000000-00004956.00000002.133737.03A30000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"file/memory contains long string with (Indicator: \"PrivilegeCheck\"; File: \"WinD64.sys\")\n Found reference to API \"SeSinglePrivilegeCheck\" (Indicator: \"PrivilegeCheck\"; File: \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8\")\n Found reference to API \"RtlInitializeSid\" (Indicator: \"InitializeSid\"; Source: \"00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp\")\n Found reference to API \"RtlEqualSid\" (Indicator: \"EqualSid\"; Source: \"00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp\")\n Found reference to API \"SeSinglePrivilegeCheck\" (Indicator: \"PrivilegeCheck\"; Source: \"00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"$4a","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"Observed import api \"PrivilegeCheck\" which can \"determine whether a specified set of privileges are enabled in an access token\" [Source: WinD64.sys]","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"\"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSWOW64\\CMD.EXE\"; Value: \"\")\n \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\FONTCACHE\\PARAMETERS\"; Key: \"CLIENTCACHESIZE\"; Value: \"\")\n \"cmd.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CONHOST.EXE\"; Value: \"\")\n \"cmd.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\$RECYCLE.BIN\\INJECT.EXE\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to multiple windows system processes","description":"Found strings \"smss.exe,csrss.exe,wininit.exe,winlogon.exe,services.exe\" (Source: \"00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":3,"id":"string-455","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"\"RuntimeBroker.exe\" (Indicator: \"runtimebroker.exe\")\n \"backgroundTaskHost.exe\" (Indicator: \"backgroundtaskhost.exe\")","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8\" has section name .text with entropy \"6.894448807012892\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to enumerate services","description":"ns0.Class17::OpenSCManagerW(System.String,System.String,System.UInt32) at d103ced7d8157bad7ef2d38f9c477f7b-6000161-Class16~smethod_0\n ns0.Class17::OpenSCManagerW(System.String,System.String,System.UInt32) at d103ced7d8157bad7ef2d38f9c477f7b-6000162-Class16~smethod_1","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1007","relevance":7,"id":"stream-27","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - RSA algorithm (keys)","description":"YARA signature for RSA public and private key matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-62","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – Anomalous PE file structure","description":"YARA signature for invalid Timestamp of PE file \"WinD64.dll\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":1,"id":"yara-153","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"set obj=GetObject(\"winmgmts:\\\\.\\root\\default:Systemrestore\")\" (Indicator: \"winmgmts:\"; in Source: \"00000000-00004956.00000000.129897.06A20000.00000004.mdmp, 00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp\")\n Found string \"WmiPrvSE.exe\" (Indicator: \"wmiprvse.exe\"; in Source: \"00000000-00004956.00000001.131819.06A20000.00000004.mdmp, 00000000-00004956.00000002.133737.06A20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"601087f\"\n \"cx\": \"1\"\n \"cy\": \"1\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":5,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used for keylogging","description":"\"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"18\"}\n \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"17\"}\n \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"16\"}\n \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"91\"}\n \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"92\"}","origin":"API Call","mitre_attack_id":"T1056.001","relevance":10,"id":"api-40","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"System.Diagnostics.Process::GetProcessesByName(System.String) at d103ced7d8157bad7ef2d38f9c477f7b-6000053-LoadingPage~timer_0_Tick\n System.Diagnostics.Process::GetProcessesByName(System.String) at d103ced7d8157bad7ef2d38f9c477f7b-6000062-Class0~method_9\n System.Diagnostics.Process::GetProcessesByName(System.String) at d103ced7d8157bad7ef2d38f9c477f7b-6000196-Class18~method_9\n System.Diagnostics.Process::GetProcessesByName(System.String) at d103ced7d8157bad7ef2d38f9c477f7b-6000197-Class18~method_10\n System.Diagnostics.Process::GetProcessesByName(System.String) at d103ced7d8157bad7ef2d38f9c477f7b-6000199-Class18~method_12","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found system commands related strings","description":"Found string \"Route\" (Indicator: \"route\"; File: \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"malicious","category":"Installation/Persistence","name":"Drops executable files to the Windows system directory","description":"File type \"PE32+ executable (console) x86-64 (stripped to external PDB) for MS Windows 4 sections\" was dropped at \"%WINDIR%\\System32\\WinD64.exe\"\n File type \"PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows 5 sections\" was dropped at \"%WINDIR%\\System32\\WinD64.dll\"\n File type \"PE32+ executable (DLL) (native) x86-64 (stripped to external PDB) for MS Windows 6 sections\" was dropped at \"%WINDIR%\\System32\\drivers\\WinD64.sys\"","origin":"Binary File","mitre_attack_id":"T1036","relevance":7,"id":"binary-7","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"malicious","category":"Installation/Persistence","name":"Loads a device driver","description":"\"inject.exe\" loaded driver \"NtLoadDriver\"","origin":"API Call","mitre_attack_id":"T1547.008","relevance":10,"id":"api-41","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"malicious","category":"System Security","name":"Unloads system drivers using native API calls","description":"\"inject.exe\" called \"NtUnloadDriver\" with parameters {\"DriverServiceName\": \"74007600000000007830400000000000\"\n \"$name\": \"\\\\Registry\\\\Machine\\\\System\\\\CurrentControlSet\\\\Services\\\\WinD64\"\n \"$status\": \"ffffffffc0000034\"}\n \"inject.exe\" called \"NtUnloadDriver\" with parameters {\"DriverServiceName\": \"80008200ff7f0000a0f29f0000000000\"\n \"$name\": \"\\\\Registry\\\\Machine\\\\System\\\\CurrentControlSet\\\\Services\\\\WinD64loader\"\n \"$status\": \"ffffffffc0000034\"}\n \"inject.exe\" called \"NtUnloadDriver\" with parameters {\"DriverServiceName\": \"80008200ff7f0000d0ec610000000000\"\n \"$name\": \"\\\\Registry\\\\Machine\\\\System\\\\CurrentControlSet\\\\Services\\\\WinD64loader\"\n \"$status\": \"ffffffffc0000034\"}","origin":"API Call","mitre_attack_id":"T1543.003","relevance":10,"id":"api-319","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe\" (UID: 00000000-00004956)\n Spawned process \"cmd.exe\" (UID: 00000000-00004816)\n Spawned process \"cmd.exe\" (UID: 00000000-00003624)\n Spawned process \"inject.exe\" with commandline \"/i\" (UID: 00000000-00004992)\n Spawned process \"inject.exe\" with commandline \"/l C:\\\\$Recycle.Bin\\\\Driver.sys\" (UID: 00000000-00007536)\n Spawned process \"inject.exe\" with commandline \"/u\" (UID: 00000000-00007584)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"63325ad359eaf57c0d4c8ee7"},{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"63325ad359eaf57c0d4c8ee7"},{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"name":"Fingerprint","details_count":4,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"63325ad359eaf57c0d4c8ee7"},{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"name":"Evasive","details_count":4,"details":[{"detail":"Marks file for deletion"},{"detail":"The input sample contains a known anti-VM trick"},{"detail":"Found a reference to a WMI query string known to be used for VM detection"},{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"63325ad359eaf57c0d4c8ee7"},{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]}]},"activity":{"stats":{"process_count":6,"spawned_processes_count":6,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":13,"imported_dlls_count":85,"dropped_files_count":0,"extracted_files_count":5,"files_written_count":9,"files_deleted_count":0,"registry_keys_created_count":4,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":4,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["agenttesla","gamehack","trojan","wacapew","wacatac","ymacco","evasive","wind","windows-server-utility"],"sample_flags":["Extracted Files","Multi-Process","TOR analysis"],"sandbox_reports":[{"id":"68a5ae74c3b05f9eb807dae9","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"submit_name":"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8","analysis_start_time":"2025-08-20T11:16:16+00:00","indicators_count":{"informative":189,"suspicious":54,"malicious":11},"tags":["Multi-Process","Extracted Files","TOR analysis"],"is_in_unified_schema":true},{"id":"63325ad359eaf57c0d4c8ee7","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Staser","submit_name":"cw.exe","analysis_start_time":"2022-09-27T02:07:18+00:00","indicators_count":{"informative":21,"suspicious":29,"malicious":9},"tags":["Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}],"processes":[{"pid":4956,"ppid":0,"name":"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe","command_line":"","sha256":"d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8","normalized_path":"C:\\d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8.exe","uid":"00000000-00004956","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":4816,"ppid":4956,"name":"cmd.exe","command_line":"","sha256":"4c3ea4c44aab74350355c419826b8c9e6172c3bd8f0bb5817ecf7be50b629051","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00004956","uid":"00000000-00004816"},{"pid":3624,"ppid":4956,"name":"cmd.exe","command_line":"","sha256":"4c3ea4c44aab74350355c419826b8c9e6172c3bd8f0bb5817ecf7be50b629051","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00004956","uid":"00000000-00003624"},{"pid":4992,"ppid":3624,"name":"inject.exe","command_line":"/i","sha256":"7105fd467a7965e32eef4c0a8ae113fb57f32d9334e83f2b1887d4eb65960a31","normalized_path":"C:\\$Recycle.bin\\inject.exe","parent_uid":"00000000-00003624","uid":"00000000-00004992"},{"pid":7536,"ppid":3624,"name":"inject.exe","command_line":"/l C:\\$Recycle.Bin\\Driver.sys","sha256":"7105fd467a7965e32eef4c0a8ae113fb57f32d9334e83f2b1887d4eb65960a31","normalized_path":"C:\\$Recycle.bin\\inject.exe","parent_uid":"00000000-00003624","uid":"00000000-00007536"},{"pid":7584,"ppid":3624,"name":"inject.exe","command_line":"/u","sha256":"7105fd467a7965e32eef4c0a8ae113fb57f32d9334e83f2b1887d4eb65960a31","normalized_path":"C:\\$Recycle.bin\\inject.exe","parent_uid":"00000000-00003624","uid":"00000000-00007584"}],"all_imported_dlls":["ntdll.dll","rpcrt4.dll","System.Windows.Forms.ni.dll","comctl32.dll","winbrand.dll","nlssorting.dll","System.Configuration.ni.dll","mscorrc.dll","version.dll","System.ni.dll","dwmapi.dll","profapi.dll","RpcRtRemote.dll","basebrd.dll","sechost.dll","usp10.dll","msctf.dll","shlwapi.dll","cryptsp.dll","advapi32.dll","mscoreei.dll","fltLib.dll","clr.dll","ucrtbase_clr0400.dll","mscorlib.ni.dll","user32.dll","clrjit.dll","System.Xml.ni.dll","lpk.dll","oleaut32.dll","mscoree.dll","api-ms-win-core-xstate-l2-1-0.dll","kernel32.dll","api-ms-win-core-synch-l1-2-0.dll","psapi.dll","System.Core.ni.dll","GdiPlus.dll","System.ServiceProcess.ni.dll","nsi.dll","shell32.dll","clbcatq.dll","msvcrt.dll","ole32.dll","KernelBase.dll","System.Drawing.ni.dll","rsaenh.dll","cryptbase.dll","uxtheme.dll","apphelp.dll","gdi32.dll","rpcss.dll","imm32.dll","bcrypt.dll","System.Windows.Forms.dll","ws2_32.dll","vcruntime140_clr0400.dll","WindowsCodecs.dll","wow64.dll","DWrite.dll","wow64win.dll","ucrtbase.dll","wow64cpu.dll","sspicli.dll","ci.dll","VxSSL32.dll","msvcp_win.dll","bcryptprimitives.dll","cfgmgr32.dll","VxSSL64.dll","combase.dll","kernel.appcore.dll","System.Drawing.dll","SHCore.dll","CoreUIComponents.dll","WinTypes.dll","CoreMessaging.dll","System.ServiceProcess.dll","TextInputFramework.dll","Accessibility.dll","powrprof.dll","ntmarta.dll","cmdext.dll","windows.storage.dll","win32u.dll","gdi32full.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"Driver.sys","sha256":"cc639e1f8d05458d57e56d6b2d4d3fdaeb7b15c4a701cb529c8127c5682005e7","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"63325ad359eaf57c0d4c8ee7"},{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"name":"inject.exe","sha256":"7105fd467a7965e32eef4c0a8ae113fb57f32d9334e83f2b1887d4eb65960a31","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"63325ad359eaf57c0d4c8ee7"},{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"name":"WinD64.dll","sha256":"6a0115a5dfb2a7eca6465a72d611992d9f98c22967f0ac6695e64d443b803289","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"name":"WinD64.exe","sha256":"7105fd467a7965e32eef4c0a8ae113fb57f32d9334e83f2b1887d4eb65960a31","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"name":"WinD64.sys","sha256":"7322b65170e50f08d6f34062bdd8f78fd9bb5b5c11085660e40e0dae567c6891","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]}],"files_written":[{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"63325ad359eaf57c0d4c8ee7"},{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"63325ad359eaf57c0d4c8ee7"},{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"path":"C:\\$Recycle.bin\\Driver.sys","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"path":"C:\\$Recycle.bin\\inject.exe","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"path":"%WINDIR%\\System32\\WinD64.exe","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"path":"%WINDIR%\\System32\\WinD64.dll","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"path":"%WINDIR%\\System32\\drivers\\WinD64.sys","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"path":"%WINDIR%\\System32\\drivers\\WinD64loader.sys","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"63325ad359eaf57c0d4c8ee7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\GDIPLUS\\","sources":[{"report_type":"sandbox","report_id":"63325ad359eaf57c0d4c8ee7"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WIND64\\","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WIND64LOADER\\","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"63325ad359eaf57c0d4c8ee7"}]},{"name":"DBWinMutex","sources":[{"report_type":"sandbox","report_id":"63325ad359eaf57c0d4c8ee7"}]},{"name":"\\BaseNamedObjects\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4956:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4956:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4956:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SessionImmersiveColorMutex","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"name":"Local\\SM0:4956:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"name":"SM0:4956:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"name":"Local\\SessionImmersiveColorMutex","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"name":"SM0:4956:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\mutexWinD64","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]},{"name":"mutexWinD64","sources":[{"report_type":"sandbox","report_id":"68a5ae74c3b05f9eb807dae9"}]}]}},"report_ids":{"sandbox_job_ids":["68a5ae74c3b05f9eb807dae9","63325ad359eaf57c0d4c8ee7"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan/Generic Sample d678623c64c7… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample d678623c64c7…. Malware family: Trojan/Generic. Threat score 100/100. 14/27 AV engines flagged this file. 13 malicious and 34 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan/Generic Sample d678623c64c7… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample d678623c64c7…. Malware family: Trojan/Generic. Threat score 100/100. 14/27 AV engines flagged this file. 13 malicious and 34 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/d678623c64c737fd9c8372c8e67b9fcc536845c358626065fa92e40f5fe6c6c8"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan/Generic Sample d678623c64c7… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample d678623c64c7…. Malware family: Trojan/Generic. Threat score 100/100. 14/27 AV engines flagged this file. 13 malicious and 34 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L4c","11",{}]]