26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 4e:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4cc,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Ransom.Prometheus.Generic Sample da0812e23452… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample da0812e23452…. Malware family: Ransom.Prometheus.Generic. Threat score 100/100. 18/27 AV engines flagged this file. 12 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c","keywords":["Malicious","Ransom.Prometheus.Generic","malware analysis","sandbox report","threat intelligence","da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c"],"about":{"@type":"SoftwareApplication","name":"bounty-43939206573778426","applicationCategory":["peexe","assembly","executable"],"identifier":"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Ransom.Prometheus.Generic","antivirusDetections":{"malicious":18,"total":27},"behavioralIndicators":{"malicious":12,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T19fd,Found reference to "SHA1Managed" (Indicator: "SHA1Managed"; File: "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c") Found reference to "SHA256Managed" (Indicator: "SHA256Managed"; File: "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; File: "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "Aes"; File: "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "AesCryptoServiceProvider"; File: "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c") Found reference to "System.Security.Cryptography.RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00000364.00000000.169808.04BF0000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00000364.00000000.169808.04BF0000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00000364.00000000.169808.04BF0000.00000004.mdmp") Found reference to "System.Security.Cryptography.RSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "RSACng"; Source: "00000000-00000364.00000000.169808.04BF0000.00000004.mdmp") Found reference to "System.Security.Cryptography.DSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "DSACng"; Source: "00000000-00000364.00000000.169808.04BF0000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00000364.00000000.169808.04BF0000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesManaged"; Source: "00000000-00000364.00000000.169808.04BF0000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellman"; Source: "00000000-00000364.00000000.169808.04BF0000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellmanCng"; Source: "00000000-00000364.00000000.169808.04BF0000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsa"; Source: "00000000-00000364.00000000.169808.04BF0000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsaCng"; Source: "00000000-00000364.00000000.169808.04BF0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00000364.00000000.169808.04BF0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00000364.00000000.169808.04BF0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00000364.00000000.169808.04BF0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00000364.00000000.169808.04BF0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00000364.00000000.169808.04BF0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00000364.00000000.169808.04BF0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512CryptoServiceProvider"; Source: "00000000-00000364.00000000.169808.04BF0000.00000004.mdmp") Found reference to "RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00000364.00000000.169808.04BF0000.00000004.mdmp") Found reference to "System.Security.Cryptography.HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00000364.00000000.169808.04BF0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00000364.00000000.169808.04BF0000.00000004.mdmp") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00000364.00000000.169808.04BF0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384" (Indicator: "SHA384"; Source: "00000000-00000364.00000000.169808.04BF0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng" (Indicator: "SHA384"; Source: "00000000-00000364.00000000.169808.04BF0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider" (Indicator: "SHA384"; Source: "00000000-00000364.00000000.169808.04BF0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00000364.00000000.169808.04BF0000.00000004.mdmp") Found reference to "SHA512" (Indicator: "SHA512"; Source: "00000000-00000364.00000000.169808.04BF0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512" (Indicator: "SHA512"; Source: "00000000-00000364.00000000.169808.04BF0000.00000004.mdmp")28:T6f1,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to perform encryption (API string) Matched sigs: Contains ability to decode base64 data Matched sigs: Contains ability to import cryptographic keys (seen in ransomware) Matched sigs: Able to utilize the Windows bcrypt cryptographic API Matched sigs: Contains reference to cryptographic keys Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Reads the cryptographic machine GUID Matched sigs: Calls an API typically used to decrypt data Matched sigs: Contains ability to perform symmetric encryption (Dotnet) Matched sigs: Contains ability to perform asymmetric crypto operations Matched sigs: Contains ability to perform symmetric decryption (Dotnet) Matched sigs: Able to decode string content at runtime (.NET) Matched sigs: Contains ability to perform crypto operations Matched sigs: Contains ability to perform CryptoStream operations (Dotnet) Matched sigs: YARA signature match - AES encryption Matched sigs: Able to access crypto-related API (String) Matched sigs: Contains ability to decrypt/decode data Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Contains ability to perform AES cryptographic operations (Dotnet) Matched sigs: Contains ability to perform symmetric crypto operations Matched sigs: Dotnet file contains encryption/decryption functions29:T2a7f,Found XOR loop in file "lsass.exe.bin" at offset 576270; code bytes = 30d0 Found XOR loop in file "lsass.exe.bin" at offset 609147; code bytes = 30d0 Found XOR loop in file "lsass.exe.bin" at offset 802011; code bytes = 30d0 Found XOR loop in file "lsass.exe.bin" at offset 829867; code bytes = 30d0 Found XOR loop in file "lsass.exe.bin" at offset 837451; code bytes = 30d0 Found XOR loop in file "lsass.exe.bin" at offset 854661; code bytes = 30d0 Found XOR loop in file "lsass.exe.bin" at offset 877133; code bytes = 30d0 Found XOR loop in file "lsass.exe.bin" at offset 953805; code bytes = 30d0 Found XOR loop in file "lsass.exe.bin" at offset 804042; code bytes = 33c1 Found XOR loop in file "lsass.exe.bin" at offset 850451; code bytes = 33c1 Found XOR loop in file "lsass.exe.bin" at offset 869053; code bytes = 33c1 Found XOR loop in file "lsass.exe.bin" at offset 1001713; code bytes = 33c1 Found XOR loop in file "lsass.exe.bin" at offset 1020260; code bytes = 33c1 Found XOR loop in file "lsass.exe.bin" at offset 484185; code bytes = 8030 Found XOR loop in file "lsass.exe.bin" at offset 805451; code bytes = 8030 Found XOR loop in file "lsass.exe.bin" at offset 822680; code bytes = 8030 Found XOR loop in file "lsass.exe.bin" at offset 828007; code bytes = 8030 Found XOR loop in file "lsass.exe.bin" at offset 868810; code bytes = 8030 Found XOR loop in file "lsass.exe.bin" at offset 888173; code bytes = 8030 Found XOR loop in file "lsass.exe.bin" at offset 1039696; code bytes = 8030 Found XOR loop in file "tor.exe.bin" at offset 576270; code bytes = 30d0 Found XOR loop in file "tor.exe.bin" at offset 609147; code bytes = 30d0 Found XOR loop in file "tor.exe.bin" at offset 802011; code bytes = 30d0 Found XOR loop in file "tor.exe.bin" at offset 829867; code bytes = 30d0 Found XOR loop in file "tor.exe.bin" at offset 837451; code bytes = 30d0 Found XOR loop in file "tor.exe.bin" at offset 854661; code bytes = 30d0 Found XOR loop in file "tor.exe.bin" at offset 877133; code bytes = 30d0 Found XOR loop in file "tor.exe.bin" at offset 953805; code bytes = 30d0 Found XOR loop in file "tor.exe.bin" at offset 804042; code bytes = 33c1 Found XOR loop in file "tor.exe.bin" at offset 850451; code bytes = 33c1 Found XOR loop in file "tor.exe.bin" at offset 869053; code bytes = 33c1 Found XOR loop in file "tor.exe.bin" at offset 1001713; code bytes = 33c1 Found XOR loop in file "tor.exe.bin" at offset 1020260; code bytes = 33c1 Found XOR loop in file "tor.exe.bin" at offset 484185; code bytes = 8030 Found XOR loop in file "tor.exe.bin" at offset 805451; code bytes = 8030 Found XOR loop in file "tor.exe.bin" at offset 822680; code bytes = 8030 Found XOR loop in file "tor.exe.bin" at offset 828007; code bytes = 8030 Found XOR loop in file "tor.exe.bin" at offset 868810; code bytes = 8030 Found XOR loop in file "tor.exe.bin" at offset 888173; code bytes = 8030 Found XOR loop in file "tor.exe.bin" at offset 1039696; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 576270; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 609147; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 802011; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 829867; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 837451; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 854661; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 877133; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 953805; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 804042; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 850451; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 869053; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 1001713; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 1020260; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 484185; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 805451; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 822680; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 828007; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 868810; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 888173; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 1039696; code bytes = 8030 Found XOR loop in file "ApplicationFrameHost.exe.bin" at offset 576270; code bytes = 30d0 Found XOR loop in file "ApplicationFrameHost.exe.bin" at offset 609147; code bytes = 30d0 Found XOR loop in file "ApplicationFrameHost.exe.bin" at offset 802011; code bytes = 30d0 Found XOR loop in file "ApplicationFrameHost.exe.bin" at offset 829867; code bytes = 30d0 Found XOR loop in file "ApplicationFrameHost.exe.bin" at offset 837451; code bytes = 30d0 Found XOR loop in file "ApplicationFrameHost.exe.bin" at offset 854661; code bytes = 30d0 Found XOR loop in file "ApplicationFrameHost.exe.bin" at offset 877133; code bytes = 30d0 Found XOR loop in file "ApplicationFrameHost.exe.bin" at offset 953805; code bytes = 30d0 Found XOR loop in file "ApplicationFrameHost.exe.bin" at offset 804042; code bytes = 33c1 Found XOR loop in file "ApplicationFrameHost.exe.bin" at offset 850451; code bytes = 33c1 Found XOR loop in file "ApplicationFrameHost.exe.bin" at offset 869053; code bytes = 33c1 Found XOR loop in file "ApplicationFrameHost.exe.bin" at offset 1001713; code bytes = 33c1 Found XOR loop in file "ApplicationFrameHost.exe.bin" at offset 1020260; code bytes = 33c1 Found XOR loop in file "ApplicationFrameHost.exe.bin" at offset 484185; code bytes = 8030 Found XOR loop in file "ApplicationFrameHost.exe.bin" at offset 805451; code bytes = 8030 Found XOR loop in file "ApplicationFrameHost.exe.bin" at offset 822680; code bytes = 8030 Found XOR loop in file "ApplicationFrameHost.exe.bin" at offset 828007; code bytes = 8030 Found XOR loop in file "ApplicationFrameHost.exe.bin" at offset 868810; code bytes = 8030 Found XOR loop in file "ApplicationFrameHost.exe.bin" at offset 888173; code bytes = 8030 Found XOR loop in file "ApplicationFrameHost.exe.bin" at offset 1039696; code bytes = 8030 Found XOR loop in file "tor.exe" at offset 576270; code bytes = 30d0 Found XOR loop in file "tor.exe" at offset 609147; code bytes = 30d0 Found XOR loop in file "tor.exe" at offset 802011; code bytes = 30d0 Found XOR loop in file "tor.exe" at offset 829867; code bytes = 30d0 Found XOR loop in file "tor.exe" at offset 837451; code bytes = 30d0 Found XOR loop in file "tor.exe" at offset 854661; code bytes = 30d0 Found XOR loop in file "tor.exe" at offset 877133; code bytes = 30d0 Found XOR loop in file "tor.exe" at offset 953805; code bytes = 30d0 Found XOR loop in file "tor.exe" at offset 804042; code bytes = 33c1 Found XOR loop in file "tor.exe" at offset 850451; code bytes = 33c1 Found XOR loop in file "tor.exe" at offset 869053; code bytes = 33c1 Found XOR loop in file "tor.exe" at offset 1001713; code bytes = 33c1 Found XOR loop in file "tor.exe" at offset 1020260; code bytes = 33c1 Found XOR loop in file "tor.exe" at offset 484185; code bytes = 8030 Found XOR loop in file "tor.exe" at offset 805451; code bytes = 8030 Found XOR loop in file "tor.exe" at offset 822680; code bytes = 8030 Found XOR loop in file "tor.exe" at offset 828007; code bytes = 8030 Found XOR loop in file "tor.exe" at offset 868810; code bytes = 8030 Found XOR loop in file "tor.exe" at offset 888173; code bytes = 8030 Found XOR loop in file "tor.exe" at offset 1039696; code bytes = 8030 Found XOR loop in file "ApplicationFrameHost.exe" at offset 576270; code bytes = 30d0 Found XOR loop in file "ApplicationFrameHost.exe" at offset 609147; code bytes = 30d0 Found XOR loop in file "ApplicationFrameHost.exe" at offset 802011; code bytes = 30d0 Found XOR loop in file "ApplicationFrameHost.exe" at offset 829867; code bytes = 30d0 Found XOR loop in file "ApplicationFrameHost.exe" at offset 837451; code bytes = 30d0 Found XOR loop in file "ApplicationFrameHost.exe" at offset 854661; code bytes = 30d0 Found XOR loop in file "ApplicationFrameHost.exe" at offset 877133; code bytes = 30d0 Found XOR loop in file "ApplicationFrameHost.exe" at offset 953805; code bytes = 30d0 Found XOR loop in file "ApplicationFrameHost.exe" at offset 804042; code bytes = 33c1 Found XOR loop in file "ApplicationFrameHost.exe" at offset 850451; code bytes = 33c1 Found XOR loop in file "ApplicationFrameHost.exe" at offset 869053; code bytes = 33c1 Found XOR loop in file "ApplicationFrameHost.exe" at offset 1001713; code bytes = 33c1 Found XOR loop in file "ApplicationFrameHost.exe" at offset 1020260; code bytes = 33c1 Found XOR loop in file "ApplicationFrameHost.exe" at offset 484185; code bytes = 8030 Found XOR loop in file "ApplicationFrameHost.exe" at offset 805451; code bytes = 8030 Found XOR loop in file "ApplicationFrameHost.exe" at offset 822680; code bytes = 8030 Found XOR loop in file "ApplicationFrameHost.exe" at offset 828007; code bytes = 8030 Found XOR loop in file "ApplicationFrameHost.exe" at offset 868810; code bytes = 8030 Found XOR loop in file "ApplicationFrameHost.exe" at offset 888173; code bytes = 8030 Found XOR loop in file "ApplicationFrameHost.exe" at offset 1039696; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 576270; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 609147; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 802011; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 829867; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 837451; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 854661; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 877133; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 953805; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 804042; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 850451; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 869053; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1001713; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1020260; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 484185; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 805451; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 822680; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 828007; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 868810; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 888173; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1039696; code bytes = 80302a:T12ce,"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018000000000000006a29bdb6ea8100000800000000000000ffffffffffffffff3400000000000000642f49dbff7f0000e8ed7e0000000000db0421eeff7f000000000000ff7f00002a9672eaff7f0000000000000000000009000000000000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff340000000000000050ee7e0000000000080000000000000000000000000000000000000000000000fa3abeb6ea810000c3f01feeff7f00000000efebff7f0000a71320eeff7f0000a8ee7e00 (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0aca9ecff7f0000000000000000000051ed23eeff7f00000000000000000000000000000000000051a226be92d100002a00000000000000f086b402000000008fec23eeff7f0000e0aca9ecff7f0000e0aca9ecff7f0000000000000000000000000000ff7f0000ffffff7fc0bc000000000000000000000000000000000000d8ce9decff7f00002a0000000000000069c356ecff7f00003100000000000000e003000000000000e40300000000000011000110000000005096ab1d0000000003a312ecff7f00005096ab1d0000000000000000000000002b00000000000000000000000000000020b05cecff7f0000b43f5becff7f0000e0ce9dec (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000400000000000000000008f04000000000b8e21eeff7f000000008f040000000002000000000000003800000000000000400000000000000030038f040000000078ceab1d000000000100000000000000030000000000000001000000000000001800000000000000a00ea3020000000000000000000000000000a30200000000006087000000000000000000000000000c020000010000000000000000000000800000000000000004000000000000000000000000000000988fb3020000000004000000000000003800000000000000f09811ecff7f000038000000000000003800000000000000f0cfab1d00000000c00c85c9ff7f000000000000 (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000000000000000000d0b00ee3ff7f000007000000000000000000000000000000010000000000000040a58f04000000000000000000000000204efe1d000000004c9811ecff7f0000906bfe1d00000000b3ce7bc9ff7f0000304ffe1d00000000004f0ee3ff7f0000d0b00ee3ff7f000000000000000000000000000000000000304ffe1d0000000040a58f04000000005089fe1d0000000048d0ab1d000000004c9811ecff7f0000010000000000000048d0ab1d000000005089fe1d00000000304ffe1d00000000010000000000000002bc7bc9ff7f00004054fe1d00000000b0a4fc1d00000000feffffff040000007df00de3ff7f00009087fe1d (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000000007000000000000000000000000000000010000000000000040a58f04000000000000000000000000204efe1d000000004c9811ecff7f00009068fe1d00000000b3ce7bc9ff7f0000b053fe1d00000000384f0ee3ff7f0000d0b00ee3ff7f000000000000000000000000000000000000b053fe1d0000000040a58f04000000005089fe1d0000000040d0ab1d000000004c9811ecff7f0000010000000000000040d0ab1d000000005089fe1d00000000b053fe1d00000000010000000000000002bc7bc9ff7f00000000000000000000b0a4fc1d000000004054fe1d04000000feffffffffffffff40a58f04000000007df00de3ff7f000000000000 (UID: 00000000-00000364)2b:Tdcc,"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000330034003500320066006400640064003500660064006400360034003600640037003200610039003500350038006200650064003600370033003300370064006200610063003500360037003000310065003400350035003800640030006300610064003300390066006300340063002e0065007800650000006f006e00 (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetVersionExA" with parameter 940000000600000002000000f023000002000000000000006c0c4f626a65637400000000000000000000000000000000000000000000000000000000000000002014bf040000000000000000000000000300000000000000c46717c5ff7f000010000000000000001000000000000000e0d0ab1d0000000080000000000000001000000000000000a16999d3ff7f000000000000 (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetVersionExA" with parameter 940000000600000002000000f023000002000000000000006c0c4f626a65637400000000000000000000000000000000000000000000000000000000000000002014bf040000000000000000000000000300000000000000c46717c5ff7f00001000000000000000100000000000000050d0ab1d0000000080000000000000001000000000000000a16999d3ff7f000000000000 (UID: 00000000-00000364) "lsass.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000007000000073005c006d006900630072006f0073006f00660074002e006e00650074005c006600720061006d00650077006f0072006b00360034005c00760034002e0030002e00330030003300310039005c0063006f006e006600690067005c006d006100630068000e0054d03d4f048f4e86000000000000000000000000 (UID: 00000000-00007272) "lsass.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000cf6d6c0c4f626a65637465b82a5a091b0000000000000000000000000000000000000000000000000000030000000000000080000000000000001000000000000000c46778c9ff7f0000100000000000000080000000000000000100000000000000c0b09ad3ff7f00001000000000000000a16999d3ff7f000000000000 (UID: 00000000-00007272) "lsass.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000c8b8d01d00000000c5bb2a5a091b0000000000000000000074c09f1f0000000068c19f1f00000000000000000000000000000000000000001000000000000000c46778c9ff7f000010000000000000000000000000000000ffffffff00000000d927a6bdff7f00001000000000000000a16999d3ff7f0000e8f6d21d (UID: 00000000-00007272) "lsass.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000000000000000000085bb2a5a091b00000300000000000000ffffffff000000000300000000000000000000000000000030c19f1f000000001000000000000000c46778c9ff7f0000100000000000000030c19f1f00000000181c7205000000001c000000000000001000000000000000a16999d3ff7f000003000000 (UID: 00000000-00007272) "lsass.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000cf6d6c0c4f626a65637465bb2a5a091b0000000000000000000000000000000000000000000000000000030000000000000080000000000000001000000000000000c46778c9ff7f0000100000000000000080000000000000000100000000000000c0b09ad3ff7f00001000000000000000a16999d3ff7f000000000000 (UID: 00000000-00007272) "lsass.exe" called "GetVersionExA" with parameter 940000000600000002000000f023000002000000000000000863d21d00000000c5ba2a5a091b0000000000000000000074c19f1f0000000068c29f1f00000000000000000000000000000000000000001000000000000000c46778c9ff7f000010000000000000000000000000000000ffffffff00000000d927a6bdff7f00001000000000000000a16999d3ff7f000038e5ea02 (UID: 00000000-00007272)2c:Tbec,"lsass.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "lsass.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "lsass.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "SEARCHLIST"; Value: "") "lsass.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "lsass.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "lsass.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "lsass.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "lsass.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "NAMESERVER"; Value: "") "lsass.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "PROFILENAMESERVER"; Value: "") "lsass.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPNAMESERVER"; Value: "") "lsass.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "SEARCHLIST"; Value: "") "lsass.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "lsass.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "lsass.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "lsass.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "lsass.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "NAMESERVER"; Value: "") "lsass.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "PROFILENAMESERVER"; Value: "")2d:T500f,"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Drawing\ece80f2e3752a779e894fd45d8f27e64\System.Drawing.ni.dll (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\b138f79dea860272ebe6694d9b73f656\System.Windows.Forms.ni.dll (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\\wminet_utils.dll (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Runteb92aa12#\59a4984a6afe6b209eaaa379927ab81d\System.Runtime.Serialization. (UID: 00000000-00000364) "lsass.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007272) "lsass.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007272) "lsass.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007272) "lsass.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007272) "lsass.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007272) "lsass.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00007272) "lsass.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00007272) "lsass.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00007272) "lsass.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00007272) "lsass.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00007272) "lsass.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007272) "lsass.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00007272) "lsass.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00007272) "lsass.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00007272) "lsass.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00007272) "lsass.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00007272) "lsass.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00007272) "lsass.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\WTSAPI32.dll (UID: 00000000-00007272) "lsass.exe" called "LoadLibrary" with a parameter WTSAPI32.dll (UID: 00000000-00007272) "lsass.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00007272) "lsass.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00007272) "lsass.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007272) "lsass.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00007272) "lsass.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007272) "lsass.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00007272) "lsass.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00007272) "lsass.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007272) "lsass.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00007272) "lsass.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00007272) "lsass.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00007272) "lsass.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00007272) "lsass.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00007272) "lsass.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00007272) "lsass.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00007272) "lsass.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00007272) "lsass.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007272) "lsass.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00007272) "lsass.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Drawing\ece80f2e3752a779e894fd45d8f27e64\System.Drawing.ni.dll (UID: 00000000-00007272) "lsass.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\b138f79dea860272ebe6694d9b73f656\System.Windows.Forms.ni.dll (UID: 00000000-00007272) "lsass.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00007272) "lsass.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00007272) "lsass.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00007272) "lsass.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00007272) "lsass.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00007272) "lsass.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00007272) "lsass.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00007272) "lsass.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00007272) "lsass.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00007272) "lsass.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00007272) "lsass.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00007272) "lsass.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00007272) "lsass.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00007272) "lsass.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00007272) "lsass.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00007272) "lsass.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00007272) "lsass.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00007272) "lsass.exe" called "LoadLibrary" with a parameter advapi32 (UID: 00000000-00007272) "lsass.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00007272) "lsass.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\\wminet_utils.dll (UID: 00000000-00007272) "lsass.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00007272) "lsass.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00007272) "lsass.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00007272) "lsass.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00007272) "lsass.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00007272) "lsass.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00007272) "lsass.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00007272) "lsass.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll (UID: 00000000-00007272) "lsass.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00007272) "lsass.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00007272) "lsass.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00007272) "lsass.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll (UID: 00000000-00007272) "lsass.exe" called "LoadLibrary" with a parameter rasapi32.dll (UID: 00000000-00007272) "lsass.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00007272) "lsass.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00007272) "lsass.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll (UID: 00000000-00007272) "lsass.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00007272) "lsass.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00007272) "lsass.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00007272)2e:T138bb,"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter RtlVirtualUnwind (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter WindowsCreateStringReference (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter SetWaitableTimerEx (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter GetSystemDirectory (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter GetComputerName (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter GetComputerNameW (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter GetDiskFreeSpaceEx (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter GetDiskFreeSpaceExW (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter OpenMutex (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter OpenMutexW (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter CreateMutex (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter CreateMutexW (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter WldpIsDynamicCodePolicyEnabled (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter AmsiScanBuffer (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter MpManagerOpen (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter MpHandleClose (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter MpFreeMemory (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter MpScanStart (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter MpMemoryScanStart (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter MpScanResult (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter MpThreatOpen (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter MpThreatEnumerate (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter MpConfigOpen (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter MpConfigGetValue (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter MpConfigGetValueAlloc (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter MpConfigClose (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter MpFastMemoryScanOpen (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter MpFastMemoryScan (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter MpTelemetryInitialize (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter MpTelemetryUninitialize (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter MpTelemetryAddToAverageDWORD (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter MpAmsiScan (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter MpAmsiCloseSession (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter MpConfigRegisterForNotifications (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter MpConfigUnregisterNotifications (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter MpClientUtilExportFunctions (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter MpManagerVersionQuery (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter UnregisterGPNotification (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter FindFirstFile (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter FindNextFile (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter CopyFile (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter CopyFileW (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter CoGetObjectContext (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter LoadLibrary (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter ResetSecurity (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter SetSecurity (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter BlessIWbemServices (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter BlessIWbemServicesObject (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter GetPropertyHandle (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter WritePropertyValue (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter Clone (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter VerifyClientKey (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter GetQualifierSet (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter Get (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter Put (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter Delete (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter GetNames (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter BeginEnumeration (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter Next (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter EndEnumeration (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter GetPropertyQualifierSet (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter GetObjectText (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter SpawnDerivedClass (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter SpawnInstance (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter CompareTo (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter GetPropertyOrigin (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter InheritsFrom (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter GetMethod (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter PutMethod (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter DeleteMethod (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter BeginMethodEnumeration (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter NextMethod (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter EndMethodEnumeration (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter GetMethodQualifierSet (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter GetMethodOrigin (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter QualifierSet_Get (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter QualifierSet_Put (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter QualifierSet_Delete (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter QualifierSet_GetNames (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter QualifierSet_BeginEnumeration (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter QualifierSet_Next (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter QualifierSet_EndEnumeration (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter GetCurrentApartmentType (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter GetDemultiplexedStub (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter CreateInstanceEnumWmi (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter CreateClassEnumWmi (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter ExecQueryWmi (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter ExecNotificationQueryWmi (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter PutInstanceWmi (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter PutClassWmi (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter CloneEnumWbemClassObject (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter ConnectServerWmi (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter GetErrorInfo (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter Initialize (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter IIDFromString (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter SysStringLen (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter RtlZeroMemory (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter RegSetValueEx (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter QueryFullProcessImageName (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter QueryFullProcessImageNameA (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter RegCreateKeyEx (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter GetTokenInformationW (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter DuplicateTokenExW (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter CheckTokenMembershipW (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter ShellExecuteEx (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter ShellExecuteExW (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00000364) "lsass.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter RtlVirtualUnwind (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter WTSEnumerateProcessesW (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter WTSFreeMemory (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter WindowsCreateStringReference (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter SetWaitableTimerEx (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter EnumProcesses (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter EnumProcessesW (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter FormatMessage (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter GetSystemDirectory (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter GetComputerName (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter GetComputerNameW (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter GetDiskFreeSpaceEx (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter GetDiskFreeSpaceExW (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter OpenMutex (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter OpenMutexW (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter CreateMutex (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter CreateMutexW (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter WldpIsDynamicCodePolicyEnabled (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter AmsiScanBuffer (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter MpManagerOpen (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter MpHandleClose (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter MpFreeMemory (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter MpScanStart (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter MpMemoryScanStart (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter MpScanResult (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter MpThreatOpen (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter MpThreatEnumerate (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter MpConfigOpen (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter MpConfigGetValue (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter MpConfigGetValueAlloc (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter MpConfigClose (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter MpFastMemoryScanOpen (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter MpFastMemoryScan (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter MpTelemetryInitialize (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter MpTelemetryUninitialize (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter MpTelemetryAddToAverageDWORD (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter MpAmsiScan (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter MpAmsiCloseSession (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter MpConfigRegisterForNotifications (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter MpConfigUnregisterNotifications (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter MpClientUtilExportFunctions (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter MpManagerVersionQuery (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter UnregisterGPNotification (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter CryptAcquireContext (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter CryptGetProvParam (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter CryptContextAddRef (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter CryptDuplicateKey (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter CryptSetKeyParam (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter CryptDecrypt (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter CoGetObjectContext (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter LoadLibrary (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter ResetSecurity (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter SetSecurity (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter BlessIWbemServices (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter BlessIWbemServicesObject (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter GetPropertyHandle (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter WritePropertyValue (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter Clone (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter VerifyClientKey (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter GetQualifierSet (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter Get (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter Put (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter Delete (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter GetNames (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter BeginEnumeration (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter Next (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter EndEnumeration (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter GetPropertyQualifierSet (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter GetObjectText (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter SpawnDerivedClass (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter SpawnInstance (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter CompareTo (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter GetPropertyOrigin (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter InheritsFrom (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter GetMethod (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter PutMethod (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter DeleteMethod (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter BeginMethodEnumeration (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter NextMethod (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter EndMethodEnumeration (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter GetMethodQualifierSet (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter GetMethodOrigin (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter QualifierSet_Get (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter QualifierSet_Put (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter QualifierSet_Delete (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter QualifierSet_GetNames (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter QualifierSet_BeginEnumeration (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter QualifierSet_Next (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter QualifierSet_EndEnumeration (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter GetCurrentApartmentType (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter GetDemultiplexedStub (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter CreateInstanceEnumWmi (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter CreateClassEnumWmi (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter ExecQueryWmi (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter ExecNotificationQueryWmi (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter PutInstanceWmi (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter PutClassWmi (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter CloneEnumWbemClassObject (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter ConnectServerWmi (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter GetErrorInfo (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter Initialize (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter IIDFromString (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter SysStringLen (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter RtlZeroMemory (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter RegQueryInfoKey (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter RegEnumKeyEx (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter GetNetworkParams (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter GetPerAdapterInfo (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter RoGetParameterizedTypeInstanceIID (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter RasEnumConnections (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter RasEnumConnectionsW (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter WSASocket (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter setsockopt (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter WSAEventSelect (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter ioctlsocket (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter closesocket (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter RasConnectionNotification (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter RasConnectionNotificationW (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter RegOpenCurrentUser (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter RegNotifyChangeKeyValue (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter WinHttpOpen (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter WinHttpOpenW (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter WinHttpCloseHandle (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter WinHttpCloseHandleW (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter WinHttpSetTimeouts (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter WinHttpSetTimeoutsW (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter WinHttpGetIEProxyConfigForCurrentUser (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter ResetEvent (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter WinHttpGetProxyForUrl (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter WinHttpGetProxyForUrlW (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter freeaddrinfo (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter WSAConnect (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter send (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter recv (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter shutdown (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter QueryUnbiasedInterruptTime (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00007272) "lsass.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00007272)2f:T21c4,Found reference to API (Indicator: "CreateDirectory"; File: "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c") Found reference to API (Indicator: "GetProcessById"; File: "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c") Found reference to API (Indicator: "Sleep"; File: "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c") Found reference to API (Indicator: "GetCurrentProcess"; File: "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c") Found reference to API (Indicator: "GetParent"; File: "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c") Found reference to API (Indicator: "MessageBox"; File: "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c") Found reference to API (Indicator: "CloseHandle"; File: "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c") Found reference to API (Indicator: "DestroyIcon"; File: "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c") Found reference to API (Indicator: "DeleteObject"; File: "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c") Found reference to API (Indicator: "SelectObject"; File: "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c") Found reference to API (Indicator: "CreateCompatibleDC"; File: "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c") Found reference to API (Indicator: "GetDesktopWindow"; File: "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c") Found reference to API (Indicator: "BitBlt"; File: "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c") Found reference to API (Indicator: "CreateDC"; File: "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c") Found reference to API (Indicator: "DeleteDC"; File: "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c") Found reference to API (Indicator: "SetCursorPos"; File: "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c") Found reference to API (Indicator: "QueryFullProcessImageName"; File: "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c") Found reference to API (Indicator: "GetCursorInfo"; File: "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c") Found reference to API (Indicator: "CopyIcon"; File: "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c") Found reference to API (Indicator: "GetIconInfo"; File: "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c") Found reference to API (Indicator: "GetForegroundWindow"; File: "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c") Found reference to API (Indicator: "GetWindowText"; File: "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c") Found reference to API (Indicator: "SendInput"; File: "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c") Found reference to API (Indicator: "SuspendThread"; File: "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c") Found reference to API (Indicator: "ResumeThread"; File: "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c") Found reference to API (Indicator: "OpenThread"; File: "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c") Found reference to API (Indicator: "GetTempPath"; File: "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c") Found reference to API (Indicator: "SeDebugPrivilege"; Source: "00000000-00000364.00000000.169808.04BF0000.00000004.mdmp") Found reference to API (Indicator: "GetTempFileName"; Source: "00000000-00000364.00000000.169808.04BF0000.00000004.mdmp") Found reference to API (Indicator: "CreateDirectory"; Source: "00000000-00007272.00000000.170294.008C2000.00000002.mdmp") Found reference to API (Indicator: "GetProcessById"; Source: "00000000-00007272.00000000.170294.008C2000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00007272.00000000.170294.008C2000.00000002.mdmp, 00000000-00007272.00000000.170294.03190000.00000004.mdmp, 00000000-00007272.00000000.170294.05600000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00007272.00000000.170294.008C2000.00000002.mdmp") Found reference to API (Indicator: "GetParent"; Source: "00000000-00007272.00000000.170294.008C2000.00000002.mdmp") Found reference to API (Indicator: "MessageBox"; Source: "00000000-00007272.00000000.170294.008C2000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00007272.00000000.170294.008C2000.00000002.mdmp") Found reference to API (Indicator: "DestroyIcon"; Source: "00000000-00007272.00000000.170294.008C2000.00000002.mdmp") Found reference to API (Indicator: "DeleteObject"; Source: "00000000-00007272.00000000.170294.008C2000.00000002.mdmp") Found reference to API (Indicator: "SelectObject"; Source: "00000000-00007272.00000000.170294.008C2000.00000002.mdmp") Found reference to API (Indicator: "CreateCompatibleDC"; Source: "00000000-00007272.00000000.170294.008C2000.00000002.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00007272.00000000.170294.008C2000.00000002.mdmp") Found reference to API (Indicator: "BitBlt"; Source: "00000000-00007272.00000000.170294.008C2000.00000002.mdmp") Found reference to API (Indicator: "CreateDC"; Source: "00000000-00007272.00000000.170294.008C2000.00000002.mdmp") Found reference to API (Indicator: "DeleteDC"; Source: "00000000-00007272.00000000.170294.008C2000.00000002.mdmp") Found reference to API (Indicator: "SetCursorPos"; Source: "00000000-00007272.00000000.170294.008C2000.00000002.mdmp") Found reference to API (Indicator: "QueryFullProcessImageName"; Source: "00000000-00007272.00000000.170294.008C2000.00000002.mdmp") Found reference to API (Indicator: "GetCursorInfo"; Source: "00000000-00007272.00000000.170294.008C2000.00000002.mdmp") Found reference to API (Indicator: "CopyIcon"; Source: "00000000-00007272.00000000.170294.008C2000.00000002.mdmp") Found reference to API (Indicator: "GetIconInfo"; Source: "00000000-00007272.00000000.170294.008C2000.00000002.mdmp") Found reference to API (Indicator: "GetForegroundWindow"; Source: "00000000-00007272.00000000.170294.008C2000.00000002.mdmp") Found reference to API (Indicator: "GetWindowText"; Source: "00000000-00007272.00000000.170294.008C2000.00000002.mdmp") Found reference to API (Indicator: "SendInput"; Source: "00000000-00007272.00000000.170294.008C2000.00000002.mdmp") Found reference to API (Indicator: "SuspendThread"; Source: "00000000-00007272.00000000.170294.008C2000.00000002.mdmp") Found reference to API (Indicator: "ResumeThread"; Source: "00000000-00007272.00000000.170294.008C2000.00000002.mdmp") Found reference to API (Indicator: "OpenThread"; Source: "00000000-00007272.00000000.170294.008C2000.00000002.mdmp") Found reference to API (Indicator: "GetTempPath"; Source: "00000000-00007272.00000000.170294.008C2000.00000002.mdmp") Found reference to API (Indicator: "QueueUserWorkItem"; Source: "00000000-00007272.00000000.170294.008C2000.00000002.mdmp") Found reference to API (Indicator: "GetLength"; Source: "00000000-00007272.00000000.170294.008C2000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileName"; Source: "00000000-00007272.00000000.170294.03160000.00000004.mdmp, 00000000-00007272.00000000.170294.05600000.00000004.mdmp") Found reference to API (Indicator: "SeDebugPrivilege"; Source: "00000000-00007272.00000000.170294.05600000.00000004.mdmp") Found reference to API (Indicator: "GetErrorInfo"; Source: "00000000-00007272.00000000.170294.05600000.00000004.mdmp") Found reference to API (Indicator: "ExitWindowsEx"; Source: "00000000-00007272.00000000.170294.1DD00000.00000004.mdmp") Found reference to API (Indicator: "OpenServiceA"; Source: "00000000-00007272.00000000.170294.1DD00000.00000004.mdmp") Found reference to API (Indicator: "WinHttpConnect"; Source: "00000000-00007272.00000000.170294.1DD00000.00000004.mdmp") Found reference to API (Indicator: "FindWindowA"; Source: "00000000-00007272.00000000.170294.1DD00000.00000004.mdmp") Found reference to API (Indicator: "BCryptImportKey"; Source: "00000000-00007272.00000000.170294.1DD00000.00000004.mdmp") Found reference to API (Indicator: "GetCursorPos"; Source: "00000000-00007272.00000000.170294.1DD00000.00000004.mdmp") Found reference to API (Indicator: "CreateServiceW"; Source: "00000000-00007272.00000000.170294.1DD00000.00000004.mdmp") Found reference to API (Indicator: "GrayStringA"; Source: "00000000-00007272.00000000.170294.1DD00000.00000004.mdmp")30:T6ab,Observed Namespace "System.IO.FileSystemInfo" and MemberReference "get_Attributes" in "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c" Observed Namespace "System.IO.File" and MemberReference "GetAttributes" in "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c" Observed Namespace "System.IO.File" and MemberReference "SetAttributes" in "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c" Observed Namespace "System.IO.File" and MemberReference "SetCreationTimeUtc" in "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c" Observed Namespace "System.IO.File" and MemberReference "SetLastAccessTimeUtc" in "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c" Observed Namespace "System.IO.File" and MemberReference "SetLastWriteTimeUtc" in "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c" Observed Namespace "System.IO.File" and MemberReference "SetLastWriteTime" in "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c" Observed Namespace "System.IO.FileSystemInfo" and MemberReference "get_Attributes" in "lsass.exe.bin" Observed Namespace "System.IO.File" and MemberReference "GetAttributes" in "lsass.exe.bin" Observed Namespace "System.IO.File" and MemberReference "SetAttributes" in "lsass.exe.bin" Observed Namespace "System.IO.File" and MemberReference "SetCreationTimeUtc" in "lsass.exe.bin" Observed Namespace "System.IO.File" and MemberReference "SetLastAccessTimeUtc" in "lsass.exe.bin" Observed Namespace "System.IO.File" and MemberReference "SetLastWriteTimeUtc" in "lsass.exe.bin" Observed Namespace "System.IO.File" and MemberReference "SetLastWriteTime" in "lsass.exe.bin"31:T1813,"E\Software\M" in Source: 00000000-00000364.00000000.169808.02A80000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00000364.00000000.169808.02A80000.00000004.mdmp "y\Machine\Software\Classes\AppID\da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" in Source: 00000000-00000364.00000000.169808.02A80000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00000364.00000000.169808.04BF0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00000364.00000000.169808.04BF0000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00000364.00000000.169808.04BF0000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\InstallationType" in Source: 00000000-00000364.00000000.169808.04BF0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v{0}" in Source: 00000000-00000364.00000000.169808.04BF0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.Use" in Source: 00000000-00000364.00000000.169808.04BF0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00000364.00000000.169808.04BF0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00000364.00000000.169808.04BF0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseHttpPipeliningAndBufferP" in Source: 00000000-00000364.00000000.169808.04BF0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseHttpPipeliningAndBufferPooling" in Source: 00000000-00000364.00000000.169808.04BF0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseHttpPipeliningAndBufferPx" in Source: 00000000-00000364.00000000.169808.04BF0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseSafeSynchron" in Source: 00000000-00000364.00000000.169808.04BF0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseSafeSynchronousClose" in Source: 00000000-00000364.00000000.169808.04BF0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseStrictRfcInterimResponse" in Source: 00000000-00000364.00000000.169808.04BF0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseStrictRfcInterimResponseHandling" in Source: 00000000-00000364.00000000.169808.04BF0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseStrictRfcInterimResponseX" in Source: 00000000-00000364.00000000.169808.04BF0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowDangerousUnicodeDecomp" in Source: 00000000-00000364.00000000.169808.04BF0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowDangerousUnicodeDecompositions" in Source: 00000000-00000364.00000000.169808.04BF0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.UseStrictIPv6Addres" in Source: 00000000-00000364.00000000.169808.04BF0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.UseStrictIPv6AddressParsing" in Source: 00000000-00000364.00000000.169808.04BF0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowAllUriEncoding" in Source: 00000000-00000364.00000000.169808.04BF0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowAllUriEncodingExpansion" in Source: 00000000-00000364.00000000.169808.04BF0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SchSend" in Source: 00000000-00000364.00000000.169808.04BF0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SchSendAuxRecord" in Source: 00000000-00000364.00000000.169808.04BF0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.RequireCertific" in Source: 00000000-00000364.00000000.169808.04BF0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.RequireCertificateEKUs" in Source: 00000000-00000364.00000000.169808.04BF0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.Securit" in Source: 00000000-00000364.00000000.169808.04BF0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SecurityProtocol" in Source: 00000000-00000364.00000000.169808.04BF0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00000364.00000000.169808.04BF0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00000364.00000000.169808.04BF0000.00000004.mdmp "SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full\" in Source: 00000000-00000364.00000000.169808.04BF0000.00000004.mdmp "SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full" in Source: 00000000-00000364.00000000.169808.04BF0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full" in Source: 00000000-00000364.00000000.169808.04BF0000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" in Source: 00000000-00007272.00000000.170294.02EDF000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Windows Defender\Policy Manager" in Source: 00000000-00007272.00000000.170294.05000000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00007272.00000000.170294.05600000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00007272.00000000.170294.05600000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007272.00000000.170294.05600000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\InstallationType" in Source: 00000000-00007272.00000000.170294.05600000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v{0}" in Source: 00000000-00007272.00000000.170294.05600000.00000004.mdmp32:Tc3f,Process da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:364:304:WilStaging_02" Process da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:364:120:WilError_01" Process da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe created mutex with name "\Sessions\1\BaseNamedObjects\8fb4c81bf54f650e17fea326f5282c40e7fb0e47" Process da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe created mutex with name "SM0:364:304:WilStaging_02" Process da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe created mutex with name "Local\SM0:364:304:WilStaging_02" Process da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe created mutex with name "Local\ZonesLockedCacheCounterMutex" Process da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe created mutex with name "Local\SM0:364:120:WilError_01" Process da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe created mutex with name "8fb4c81bf54f650e17fea326f5282c40e7fb0e47" Process da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe created mutex with name "Local\ZonesCacheCounterMutex" Process da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe created mutex with name "SM0:364:120:WilError_01" Process da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:364:304:WilStaging_02" Process da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe created mutex with name "\BaseNamedObjects\SyncRootManager" Process da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:364:120:WilError_01" Process da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process lsass.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7272:304:WilStaging_02" Process lsass.exe created mutex with name "8fb4c81bf54f650e17fea326f5282c40e7fb0e47" Process lsass.exe created mutex with name "Local\SM0:7272:304:WilStaging_02" Process lsass.exe created mutex with name "Global\RasPbFile" Process lsass.exe created mutex with name "SM0:7272:304:WilStaging_02" Process lsass.exe created mutex with name "SM0:7272:120:WilError_01" Process lsass.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7272:304:WilStaging_02" Process lsass.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7272:120:WilError_01" Process lsass.exe created mutex with name "\Sessions\1\BaseNamedObjects\8fb4c81bf54f650e17fea326f5282c40e7fb0e47" Process lsass.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\RasPbFile"33:T144d,"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:ffffffffc0000135] "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:ffffffffc0000135] "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:ffffffffc0000135] "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:ffffffffc0000135] "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:ffffffffc0000135] "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:ffffffffc0000135] "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:ffffffffc0000135] "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:ffffffffc0000135] "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:ffffffffc0000135] "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:ffffffffc0000135] "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:ffffffffc0000135] "lsass.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:ffffffffc0000135] "lsass.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\WTSAPI32.dll" - [base:0; Status:ffffffffc0000135] "lsass.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:ffffffffc0000135] "lsass.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:ffffffffc0000135] "lsass.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:ffffffffc0000135] "lsass.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:ffffffffc0000135] "lsass.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:ffffffffc0000135] "lsass.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:ffffffffc0000135] "lsass.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:ffffffffc0000135] "lsass.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:ffffffffc0000135] "lsass.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:ffffffffc0000135] "lsass.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:ffffffffc0000135] "lsass.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" - [base:0; Status:ffffffffc0000135] "lsass.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:ffffffffc0000135] "lsass.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll" - [base:0; Status:ffffffffc0000135] "lsass.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:ffffffffc0000135] "lsass.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll" - [base:0; Status:ffffffffc0000135]34:Tacc,Observed unmanaged function "EnumDisplaySettings" in "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c" Observed unmanaged function "GetMessageExtraInfo" in "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c" Observed unmanaged function "CloseHandle" in "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c" Observed unmanaged function "DestroyIcon" in "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c" Observed unmanaged function "DeleteObject" in "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c" Observed unmanaged function "SelectObject" in "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c" Observed unmanaged function "CreateCompatibleDC" in "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c" Observed unmanaged function "GetDesktopWindow" in "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c" Observed unmanaged function "BitBlt" in "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c" Observed unmanaged function "CreateDC" in "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c" Observed unmanaged function "DeleteDC" in "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c" Observed unmanaged function "SetCursorPos" in "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c" Observed unmanaged function "mouse_event" in "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c" Observed unmanaged function "QueryFullProcessImageName" in "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c" Observed unmanaged function "GetCursorInfo" in "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c" Observed unmanaged function "CopyIcon" in "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c" Observed unmanaged function "GetIconInfo" in "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c" Observed unmanaged function "GetForegroundWindow" in "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c" Observed unmanaged function "GetWindowText" in "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c" Observed unmanaged function "waveInGetNumDevs" in "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c" Observed unmanaged function "waveInGetDevCaps" in "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c" Observed unmanaged function "SendInput" in "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c" Observed unmanaged function "SuspendThread" in "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c" Observed unmanaged function "ResumeThread" in "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c"35:T50f5,"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" loaded module "KERNEL32" at base 7fffede50000 "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7fffeaa90000 "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7fffeaa90000 "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7fffeaa90000 "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 2c50000 "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7fffeaa90000 "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7fffeaa90000 "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7fffeaa90000 "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" loaded module "ADVAPI32.DLL" at base 7fffeb6c0000 "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7fffc51f0000 "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" loaded module "SHLWAPI.DLL" at base 7fffec0a0000 "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7fffea5d0000 "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" loaded module "VERSION.DLL" at base 7fffe0f50000 "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7fffbd8f0000 "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" loaded module "USER32.DLL" at base 7fffedf00000 "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7fffeaa90000 "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREE.DLL" at base 0 "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" loaded module "MSCOREE.DLL" at base 7fffc93b0000 "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" loaded module "NTDLL" at base 7fffee1f0000 "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7fffedab0000 "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" loaded module "PSAPI.DLL" at base 7fffec090000 "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" loaded module "RPCRT4.DLL" at base 7fffee090000 "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" loaded module "KERNEL32.DLL" at base 7fffede50000 "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\FE2524177EB3088C77BE666722039F52\MSCORLIB.NI.DLL" at base 7fffbc2f0000 "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLE32.DLL" at base 0 "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" loaded module "OLE32.DLL" at base 7fffebf40000 "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7fffe8b80000 "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7fffedab0000 "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7fffeaa90000 "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7fffc4fe0000 "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\COMBASE.DLL" at base 0 "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" loaded module "COMBASE.DLL" at base 7fffedab0000 "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7fffedab0000 "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 0 "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" loaded module "NTDLL.DLL" at base 7fffee1f0000 "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\E43DD9C73AB5615E461BF5109C3FACD6\SYSTEM.NI.DLL" at base 7fffbb680000 "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DRAWING\ECE80F2E3752A779E894FD45D8F27E64\SYSTEM.DRAWING.NI.DLL" at base 7fffc4de0000 "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.WINDOWS.FORMS\B138F79DEA860272EBE6694D9B73F656\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 7fffba5d0000 "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\0D59B0E237D7519417DE10CD84BDA4E7\SYSTEM.CORE.NI.DLL" at base 7fffb9b50000 "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\4BEB1EECA20B27D4BD1BB9880F03CC2A\SYSTEM.CONFIGURATION.NI.DLL" at base 7fffc4ca0000 "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\5EE35DEBFC22F727E70E4479DDCBC045\SYSTEM.XML.NI.DLL" at base 7fffb92a0000 "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" loaded module "SHELL32.DLL" at base 7fffec4b0000 "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" loaded module "BCRYPT.DLL" at base 7fffea0a0000 "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7fffe9980000 "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" loaded module "SSPICLI.DLL" at base 7fffea440000 "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" loaded module "WLDP.DLL" at base 7fffe95a0000 "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" loaded module "AMSI.DLL" at base 7fffe30f0000 "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7fffe0f50000 "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7fffe30d0000 "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" loaded module "%WINDIR%\SYSTEM32\V5N6B23U.DLL" at base 7fffc9860000 "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 7fffc9780000 "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7fffede50000 "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" loaded module "USERENV.DLL" at base 7fffea470000 "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7fffeb6c0000 "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\B221AF81285C1305324612E6DC9C88FF\SYSTEM.MANAGEMENT.NI.DLL" at base 7fffc9610000 "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\\WMINET_UTILS.DLL" at base 7fffd3990000 "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 7fffeaa90000 "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 7fffdd640000 "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 7fffddd40000 "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 7fffdd670000 "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 7fffeaa90000 "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 7fffeaa90000 "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 7fffdde70000 "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" loaded module "OLEAUT32.DLL" at base 7fffeb9c0000 "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLEAUT32.DLL" at base 0 "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.RUNTEB92AA12#\59A4984A6AFE6B209EAAA379927AB81D\SYSTEM.RUNTIME.SERIALIZATION.NI.DLL" at base 7fffb8f50000 "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 7fffe6920000 "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" loaded module "%WINDIR%\SYSTEM32\\WINDOWS.STATEREPOSITORYPS.DLL" at base 7fffdc670000 "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 7fffec4b0000 "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 7fffdfa60000 "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" loaded module "MSISO.DLL" at base 7fffd5ba0000 "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 7fffeaa90000 "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 7fffead00000 "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 7fffe8940000 "lsass.exe" loaded module "KERNEL32" at base 7fffede50000 "lsass.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7fffeaa90000 "lsass.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7fffeaa90000 "lsass.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7fffeaa90000 "lsass.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 2d90000 "lsass.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7fffeaa90000 "lsass.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7fffeaa90000 "lsass.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7fffeaa90000 "lsass.exe" loaded module "ADVAPI32.DLL" at base 7fffeb6c0000 "lsass.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7fffc9800000 "lsass.exe" loaded module "SHLWAPI.DLL" at base 7fffec0a0000 "lsass.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7fffea5d0000 "lsass.exe" loaded module "VERSION.DLL" at base 7fffe0f50000 "lsass.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7fffbd8f0000 "lsass.exe" loaded module "USER32.DLL" at base 7fffedf00000 "lsass.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7fffeaa90000 "lsass.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREE.DLL" at base 0 "lsass.exe" loaded module "MSCOREE.DLL" at base 7fffc93b0000 "lsass.exe" loaded module "NTDLL" at base 7fffee1f0000 "lsass.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7fffedab0000 "lsass.exe" loaded module "PSAPI.DLL" at base 7fffec090000 "lsass.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\WTSAPI32.DLL" at base 0 "lsass.exe" loaded module "WTSAPI32.DLL" at base 7fffe5350000 "lsass.exe" loaded module "KERNEL32.DLL" at base 7fffede50000 "lsass.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\FE2524177EB3088C77BE666722039F52\MSCORLIB.NI.DLL" at base 7fffbc2f0000 "lsass.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLE32.DLL" at base 0 "lsass.exe" loaded module "OLE32.DLL" at base 7fffebf40000 "lsass.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7fffe8b80000 "lsass.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "lsass.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7fffedab0000 "lsass.exe" loaded module "RPCRT4.DLL" at base 7fffee090000 "lsass.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7fffeaa90000 "lsass.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7fffc95f0000 "lsass.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\COMBASE.DLL" at base 0 "lsass.exe" loaded module "COMBASE.DLL" at base 7fffedab0000 "lsass.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7fffedab0000 "lsass.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 0 "lsass.exe" loaded module "NTDLL.DLL" at base 7fffee1f0000 "lsass.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\E43DD9C73AB5615E461BF5109C3FACD6\SYSTEM.NI.DLL" at base 7fffbb680000 "lsass.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DRAWING\ECE80F2E3752A779E894FD45D8F27E64\SYSTEM.DRAWING.NI.DLL" at base 7fffc50a0000 "lsass.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.WINDOWS.FORMS\B138F79DEA860272EBE6694D9B73F656\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 7fffba5d0000 "lsass.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\0D59B0E237D7519417DE10CD84BDA4E7\SYSTEM.CORE.NI.DLL" at base 7fffb9b50000 "lsass.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\4BEB1EECA20B27D4BD1BB9880F03CC2A\SYSTEM.CONFIGURATION.NI.DLL" at base 7fffc94b0000 "lsass.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\5EE35DEBFC22F727E70E4479DDCBC045\SYSTEM.XML.NI.DLL" at base 7fffb92a0000 "lsass.exe" loaded module "SHELL32.DLL" at base 7fffec4b0000 "lsass.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "lsass.exe" loaded module "BCRYPT.DLL" at base 7fffea0a0000 "lsass.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7fffe9980000 "lsass.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "lsass.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "lsass.exe" loaded module "SSPICLI.DLL" at base 7fffea440000 "lsass.exe" loaded module "WLDP.DLL" at base 7fffe95a0000 "lsass.exe" loaded module "AMSI.DLL" at base 7fffe30d0000 "lsass.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7fffe0f50000 "lsass.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7fffd51e0000 "lsass.exe" loaded module "%WINDIR%\SYSTEM32\V5N6B23U.DLL" at base 7fffc9460000 "lsass.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 7fffc4fc0000 "lsass.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7fffede50000 "lsass.exe" loaded module "USERENV.DLL" at base 7fffea470000 "lsass.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7fffeb6c0000 "lsass.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "lsass.exe" loaded module "ADVAPI32" at base 7fffeb6c0000 "lsass.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7fffeb640000 "lsass.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\B221AF81285C1305324612E6DC9C88FF\SYSTEM.MANAGEMENT.NI.DLL" at base 7fffc4e50000 "lsass.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\\WMINET_UTILS.DLL" at base 7fffd3990000 "lsass.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 7fffeaa90000 "lsass.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 7fffdd640000 "lsass.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 7fffddd40000 "lsass.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 7fffdd670000 "lsass.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 7fffeaa90000 "lsass.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 7fffeaa90000 "lsass.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 7fffdde70000 "lsass.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "lsass.exe" loaded module "OLEAUT32.DLL" at base 7fffeb9c0000 "lsass.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLEAUT32.DLL" at base 0 "lsass.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\IPHLPAPI.DLL" at base 0 "lsass.exe" loaded module "IPHLPAPI.DLL" at base 7fffe9b60000 "lsass.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 0 "lsass.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 7fffedab0000 "lsass.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\RASAPI32.DLL" at base 0 "lsass.exe" loaded module "RASAPI32.DLL" at base 7fffde140000 "lsass.exe" loaded module "RASMAN.DLL" at base 7fffde0c0000 "lsass.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WS2_32.DLL" at base 0 "lsass.exe" loaded module "WS2_32.DLL" at base 7fffeb7f0000 "lsass.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7fffe9dd0000 "lsass.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WINHTTP.DLL" at base 0 "lsass.exe" loaded module "WINHTTP.DLL" at base 7fffe6b00000 "lsass.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 7fffcc0b0000 "lsass.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7fffe2120000 "lsass.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7fffe25a000036:Ta9d,"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" touched "Sync root manager" (Path: "HKCU\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" touched "WbemDefaultPathParser" (Path: "HKCU\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\INPROCSERVER32") "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCSERVER32") "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "lsass.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS")37:T949,"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "lsass.exe.bin" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"38:T826,Process "lsass.exe" (UID: 00000000-00007272) was launched with new environment variables: "USERDNSDOMAIN="vEXStF0XHEDnHfu"" Process "lsass.exe" (UID: 00000000-00007272) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "tor.exe" (UID: 00000000-00005520) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", SSLKEYLOGFILE="%TEMP%\sslkey.txt", LOGONSERVER="\\DESKTOP-FVVF82A", PROMPT="$P$G", SESSIONNAME="Console", OneDrive="%USERPROFILE%\OneDrive", PROCESSOR_ARCHITEW6432="AMD64", HOMEPATH="\Users\4VUWXCo", HOMEDRIVE="C:"" Process "tor.exe" (UID: 00000000-00005520) was launched with modified environment variables: "LOCALAPPDATA, USERDOMAIN, PROCESSOR_ARCHITECTURE, PSModulePath, APPDATA, USERNAME, CommonProgramFiles, Path, PATHEXT, TEMP, USERPROFILE, TMP, ProgramFiles" Process "ApplicationFrameHost.exe" (UID: 00000000-00007180) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", SSLKEYLOGFILE="%TEMP%\sslkey.txt", LOGONSERVER="\\DESKTOP-FVVF82A", PROMPT="$P$G", SESSIONNAME="Console", OneDrive="%USERPROFILE%\OneDrive", PROCESSOR_ARCHITEW6432="AMD64", HOMEPATH="\Users\4VUWXCo", HOMEDRIVE="C:"" Process "ApplicationFrameHost.exe" (UID: 00000000-00007180) was launched with modified environment variables: "LOCALAPPDATA, USERDOMAIN, PROCESSOR_ARCHITECTURE, PSModulePath, APPDATA, USERNAME, CommonProgramFiles, Path, PATHEXT, TEMP, USERPROFILE, TMP, ProgramFiles" Process "lsass.exe" (UID: 00000000-00004668) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", SSLKEYLOGFILE="%TEMP%\sslkey.txt", LOGONSERVER="\\DESKTOP-FVVF82A", PROMPT="$P$G", SESSIONNAME="Console", OneDrive="%USERPROFILE%\OneDrive", PROCESSOR_ARCHITEW6432="AMD64", HOMEPATH="\Users\4VUWXCo", HOMEDRIVE="C:"" Process "lsass.exe" (UID: 00000000-00004668) was launched with modified environment variables: "LOCALAPPDATA, USERDOMAIN, PROCESSOR_ARCHITECTURE, PSModulePath, APPDATA, USERNAME, CommonProgramFiles, Path, PATHEXT, TEMP, USERPROFILE, TMP, ProgramFiles"39:T48b,"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "lsass.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "lsass.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "lsass.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "lsass.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "lsass.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409")3a:T1014,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00000364-00000C2A-1653745471] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00000364-00000C2A-1654109034] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00000364-00000C2A-1654234041] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00000364-00000C2A-1654337903] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll" [Source: 00000000-00000364-00000C2A-1654540640] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00000364-00000C2A-1654609414] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00000364-00000C2A-1654755868] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll" [Source: 00000000-00000364-00000C2A-1654953138] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00000364-00000C2A-1655031447] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00000364-00000C2A-1655257601] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll" [Source: 00000000-00000364-00000C2A-1655553726] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Drawing\ece80f2e3752a779e894fd45d8f27e64\System.Drawing.ni.dll" [Source: 00000000-00000364-00000C2A-1655585029] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\b138f79dea860272ebe6694d9b73f656\System.Windows.Forms.ni.dll" [Source: 00000000-00000364-00000C2A-1655636931] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll" [Source: 00000000-00000364-00000C2A-1655880922] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll" [Source: 00000000-00000364-00000C2A-1655935435] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll" [Source: 00000000-00000364-00000C2A-1655979229] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00000364-00000C2A-1656326659] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00000364-00000C2A-1656680446] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00000364-00000C2A-1656829625] Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00000364-00000C2A-1657411415] Observed system executable string:"%WINDIR%\system32\kernel32.dll" [Source: 00000000-00000364-00000C2A-1658122914] Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00000364-00000C2A-1658256134] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00000364-00000C2A-1658395020] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll" [Source: 00000000-00000364-00000C2A-1658597803] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\\wminet_utils.dll" [Source: 00000000-00000364-00000C2A-1658631696]3b:T85f,"lsass.exe.bin" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows 4 sections"- [targetUID: N/A] "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe.log" has type "CSV ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\CLR_v4.0\UsageLogs\da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe.log]- [targetUID: 00000000-00000364] "lsass.exe.log" has type "CSV ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\CLR_v4.0\UsageLogs\lsass.exe.log]- [targetUID: 00000000-00007272] "6dd19aba3e2428" has type "ASCII text with very long lines (643) with no line terminators"- Location: [C:\Recovery\6dd19aba3e2428]- [targetUID: 00000000-00000364] "d2afed7e6d557d" has type "ASCII text with very long lines (626) with no line terminators"- Location: [C:\Recovery\d2afed7e6d557d]- [targetUID: 00000000-00000364] "6203df4a6bafc7" has type "ASCII text with very long lines (500) with no line terminators"- Location: [C:\TorService\tor\6203df4a6bafc7]- [targetUID: 00000000-00007272] "ApplicationFrameHost.exe%3AZone.Identifier" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "tor.exe.bin" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows 4 sections"- [targetUID: N/A] "lsass.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows 4 sections"- Location: [C:\TorService\tor\lsass.exe]- [targetUID: 00000000-00007272] "ApplicationFrameHost.exe.bin" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows 4 sections"- [targetUID: N/A] "tor.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows 4 sections"- Location: [C:\Recovery\tor.exe]- [targetUID: 00000000-00000364] "ApplicationFrameHost.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows 4 sections"- Location: [C:\Recovery\ApplicationFrameHost.exe]- [targetUID: 00000000-00000364] "lsass.exe%3AZone.Identifier" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "tor.exe%3AZone.Identifier" has type "ASCII text with CRLF line terminators"- [targetUID: N/A]3c:Tf27,"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: ""; Value: "") "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION\CUSTOMATTRIBUTES"; Key: ""; Value: "") "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER"; Key: ""; Value: "") "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: ""; Value: "") "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\DEBUGINFORMATION"; Key: ""; Value: "") "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY\CUSTOMATTRIBUTES"; Key: ""; Value: "") "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "") "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "") "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "") "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "") "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" (Access type: "OPEN"; Path: "HKCU\INTERFACE\{8645456F-D9A2-4B82-AFEC-58F0E8DF0ACF}"; Key: ""; Value: "") "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{8645456F-D9A2-4B82-AFEC-58F0E8DF0ACF}"; Key: ""; Value: "") "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" (Access type: "OPEN"; Path: "HKCU\INTERFACE\{8645456F-D9A2-4B82-AFEC-58F0E8DF0ACF}\PROXYSTUBCLSID32"; Key: ""; Value: "") "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{8645456F-D9A2-4B82-AFEC-58F0E8DF0ACF}\PROXYSTUBCLSID32"; Key: ""; Value: "") "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}"; Key: ""; Value: "") "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}"; Key: ""; Value: "") "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}\TREATAS"; Key: ""; Value: "") "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}\TREATAS"; Key: ""; Value: "") "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}\INPROCSERVER32"; Key: ""; Value: "") "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}\INPROCSERVER32"; Key: ""; Value: "")3d:T1315,"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATIONTYPE"; Value: "") "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "SERVER"; Value: "") "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "DLLPATH"; Value: "") "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "THREADING"; Value: "") "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "TRUSTLEVEL"; Value: "") "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "REMOTESERVER"; Value: "") "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATEASUSER"; Value: "") "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATEINSHAREDBROKER"; Value: "") "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "PERMISSIONS"; Value: "") "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "EXEPATH"; Value: "") "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "COMMANDLINE"; Value: "") "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "IDENTITYTYPE"; Value: "") "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "PERMISSIONS"; Value: "") "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "ACTIVATABLECLASSES"; Value: "") "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "SERVERTYPE"; Value: "") "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "APPID"; Value: "") "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "IDENTITY"; Value: "") "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "SERVICENAME"; Value: "") "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "EXPLICITPSMACTIVATIONTYPE"; Value: "") "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{8645456F-D9A2-4B82-AFEC-58F0E8DF0ACF}\PROXYSTUBCLSID32"; Key: ""; Value: "") "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}"; Key: ""; Value: "") "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "")3e:T629,"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" reads file "c:\windows\microsoft.net\framework64\v4.0.30319\config\machine.config" "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll.aux" "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.windows.forms\b138f79dea860272ebe6694d9b73f656\system.windows.forms.ni.dll.aux" "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system\e43dd9c73ab5615e461bf5109c3facd6\system.ni.dll.aux" "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.drawing\ece80f2e3752a779e894fd45d8f27e64\system.drawing.ni.dll.aux" "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\system.configuration.ni.dll.aux" "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.core\0d59b0e237d7519417de10cd84bda4e7\system.core.ni.dll.aux" "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.xml\5ee35debfc22f727e70e4479ddcbc045\system.xml.ni.dll.aux"3f:T48c,"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" trying to touch file "C:\Windows\System32\mscoree.dll" "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" trying to touch file "C:\Windows\System32\apphelp.dll" "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" trying to touch file "C:\da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" trying to touch file "C:\Windows\System32\ntdll.dll" "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" trying to touch file "C:\Windows\System32\kernel32.dll" "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" trying to touch file "C:\Windows\System32\KernelBase.dll" "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" trying to touch file "C:\FLTLIB.DLL" "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" trying to touch file "C:\Windows\System32\fltLib.dll"40:Tefa,"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" trying to access non-existent file "C:\FLTLIB.DLL" "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CLR.DLL" "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.DLL" "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.dll" "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\UCRTBASE_CLR0400.DLL" "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ucrtbase_clr0400.dll" "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSCOREE.DLL" "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\OLE32.DLL" "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\COMBASE.DLL" "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\BCRYPT.DLL" "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" trying to access non-existent file "C:\CRYPTBASE.DLL" "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" trying to access non-existent file "C:\CRYPTBASE.dll" "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\PSAPI.DLL"41:T921,"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\MSCOREE.DLL.local" "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" trying to access non-existent file "C:\DA0812E23452FDDD5FDD646D72A9558BED67337DBAC56701E4558D0CAD39FC4C.EXE.CONFIG" "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\FUSION.LOCALGAC" "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fusion.localgac" "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\DA0812E23452FDDD5FDD646D72A9558BED67337DBAC56701E4558D0CAD39FC4C.EXE.LOG" "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" trying to access non-existent file "C:\da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe.config" "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_64\TWDSWTBX73U7CC353A7#" "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" trying to access non-existent file "C:\DA0812E23452FDDD5FDD646D72A9558BED67337DBAC56701E4558D0CAD39FC4C.INI" "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" trying to access non-existent file "C:\da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.INI" "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" trying to access non-existent file "C:\91DFCF65A43B4E" "lsass.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "lsass.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\MSCOREE.DLL.local" "lsass.exe" trying to access non-existent file "C:\TorService\tor\LSASS.EXE.CONFIG"42:T511,"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" writes file "c:\recovery\tor.exe" "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" writes file "c:\recovery\tor.exe:zone.identifier" "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" writes file "c:\recovery\d2afed7e6d557d" "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" writes file "c:\torservice\tor\lsass.exe" "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" writes file "c:\torservice\tor\lsass.exe:zone.identifier" "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" writes file "c:\torservice\tor\6203df4a6bafc7" "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" writes file "c:\recovery\applicationframehost.exe" "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" writes file "c:\recovery\applicationframehost.exe:zone.identifier" "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" writes file "c:\recovery\6dd19aba3e2428" "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" writes file "c:\users\%osuser%\appdata\local\microsoft\clr_v4.0\usagelogs\da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe.log"43:T4c9,Observed Namespace "System.Net.Sockets.TcpClient" and MemberReference ".ctor" in "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c" Observed Namespace "System.Net.Sockets.Socket" and MemberReference ".ctor" in "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c" Observed Namespace "System.Net.Sockets.TcpClient" and MemberReference "get_Client" in "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Send" in "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "SendTo" in "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c" Observed Namespace "System.Net.Sockets.TcpClient" and MemberReference ".ctor" in "lsass.exe.bin" Observed Namespace "System.Net.Sockets.Socket" and MemberReference ".ctor" in "lsass.exe.bin" Observed Namespace "System.Net.Sockets.TcpClient" and MemberReference "get_Client" in "lsass.exe.bin" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Send" in "lsass.exe.bin" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "SendTo" in "lsass.exe.bin"44:T7d8,Observed Namespace "System.Net.WebClient" and MemberReference ".ctor" in "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c" Observed Namespace "System.Net.WebClient" and MemberReference "DownloadFile" in "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c" Observed Namespace "System.Net.WebClient" and MemberReference "DownloadData" in "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c" Observed Namespace "System.Net.WebClient" and MemberReference "get_Headers" in "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c" Observed Namespace "System.Net.WebClient" and MemberReference "DownloadString" in "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c" Observed Namespace "System.Net.HttpWebRequest" and MemberReference "set_UserAgent" in "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c" Observed Namespace "System.Net.HttpWebRequest" and MemberReference "set_CookieContainer" in "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c" Observed Namespace "System.Net.HttpWebRequest" and MemberReference "set_ReadWriteTimeout" in "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c" Observed Namespace "System.Net.WebClient" and MemberReference ".ctor" in "lsass.exe.bin" Observed Namespace "System.Net.WebClient" and MemberReference "DownloadFile" in "lsass.exe.bin" Observed Namespace "System.Net.WebClient" and MemberReference "DownloadData" in "lsass.exe.bin" Observed Namespace "System.Net.WebClient" and MemberReference "get_Headers" in "lsass.exe.bin" Observed Namespace "System.Net.WebClient" and MemberReference "DownloadString" in "lsass.exe.bin" Observed Namespace "System.Net.HttpWebRequest" and MemberReference "set_UserAgent" in "lsass.exe.bin" Observed Namespace "System.Net.HttpWebRequest" and MemberReference "set_CookieContainer" in "lsass.exe.bin" Observed Namespace "System.Net.HttpWebRequest" and MemberReference "set_ReadWriteTimeout" in "lsass.exe.bin"45:T1342,Heuristic match: "f+(@.bn" Heuristic match: "a0950024.xsph.ru" Pattern match: "microsoft.net/framework64/v4.0.30319/" Heuristic match: "ystem.windows.fo" Heuristic match: "ystem.drawing.ni" Pattern match: "http://www.w3.org/2001/xmlschema-instance" Heuristic match: "/.net/netclasses/httpwebrequest/connect__group$$/" Pattern match: "http://www.w3.org/2000/09/xmldsig#dsa-sha1" Pattern match: "http://www.w3.org/2000/09/xmldsig#rsa-sha1" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha512" Pattern match: "http://www.w3.org/2000/09/xmldsig#sha1" Pattern match: "http://www.w3.org/2001/04/xmlenc#sha256" Pattern match: "http://www.w3.org/2001/04/xmlenc#sha512" Pattern match: "http://www.w3.org/2001/04/xmlenc#ripemd160" Pattern match: "http://www.w3.org/2001/04/xmlenc#des-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#tripledes-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-tripledes" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes128-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes128" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes192-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes192" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes256-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes256" Pattern match: "http://www.w3.org/tr/2001/rec-xml-c14n-20010315" Pattern match: "http://www.w3.org/tr/2001/rec-xml-c14n-20010315#withcomments" Pattern match: "http://www.w3.org/2001/10/xml-exc-c14n#" Pattern match: "http://www.w3.org/2001/10/xml-exc-c14n#withcomments" Pattern match: "http://www.w3.org/2000/09/xmldsig#base64" Pattern match: "http://www.w3.org/tr/1999/rec-xpath-19991116" Pattern match: "http://www.w3.org/tr/1999/rec-xslt-19991116" Pattern match: "http://www.w3.org/2000/09/xmldsig#enveloped-signature" Pattern match: "http://www.w3.org/2002/07/decrypt#xml" Pattern match: "http://www.w3.org/2000/09/xmldsig#" Pattern match: "http://www.w3.org/2001/04/xmlenc#" Pattern match: "http://www.w3.org/2000/09/xmldsig#hmac-sha1" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#md5" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-md5" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-ripemd160" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha256" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha512" Pattern match: "http://www.w3.org/2000/xmlns/" Pattern match: "http://www.w3.org/xml/1998/namespace" Pattern match: "http://schemas.microsoft.com/.netconfiguration/v2.0" Pattern match: "system.web/anonymousidentification" Pattern match: "system.web/authentication" Pattern match: "system.web/authorization" Pattern match: "system.web/browsercaps" Pattern match: "system.web/clienttarget" Pattern match: "system.web/compilation" Pattern match: "system.web/customerrors" Pattern match: "system.web/deployment" Pattern match: "system.web/devicefilters" Pattern match: "system.web/fulltrustassemblies" Pattern match: "system.web/globalization" Pattern match: "system.web/healthmonitoring" Pattern match: "system.web/hostingenvironment" Pattern match: "system.web/httpcookies" Pattern match: "system.web/httphandlers" Pattern match: "system.web/httpmodules" Pattern match: "system.web/httpruntime" Pattern match: "system.web/identity" Pattern match: "system.web/machinekey" Pattern match: "system.web/membership" Pattern match: "system.web/mobilecontrols" Pattern match: "system.web/pages" Pattern match: "system.web/partialtrustvisibleassemblies" Pattern match: "system.web/processmodel" Pattern match: "system.web/profile" Pattern match: "system.web/protocols" Pattern match: "system.web/rolemanager" Pattern match: "system.web/securitypolicy" Pattern match: "system.web/sessionpagestate" Pattern match: "system.web/sessionstate" Pattern match: "system.web/sitemap" Pattern match: "system.web/trace" Pattern match: "system.web/trust" Pattern match: "system.web/urlmappings" Pattern match: "system.web/webcontrols" Pattern match: "system.web/webparts" Pattern match: "system.web/webservices" Pattern match: "system.web/xhtmlconformance" Pattern match: "system.web/caching" Pattern match: "system.web/caching/cache" Pattern match: "system.web/caching/outputcache" Pattern match: "system.web/caching/outputcachesettings" Pattern match: "system.web/caching/sqlcachedependency" Pattern match: "system.web/rolh" Heuristic match: "f+ (@.bn" Pattern match: "http://go.microsoft.com/fwlink/?linkid=42127" Pattern match: "https://wdcp.microsoft.com/wdcp.svc/submitreport" Pattern match: "wdcp.microsoft.com/wdcp.svc/submitreport"46:T587,Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00000364.00000000.169808.02A80000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe.configc:\da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exesystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userconfigmachine.configpath2path1c:\windows\microsoft.net\framework64\v4.0.30319\config\machine.configexecutionengine_missingsecuritydescriptor\\.\modeaccessrightsshare\\?\config_base_unrecognized_elementsystem.security.cryptography.randomnumbergeneratorcryptonamemappingoidmapmscorlibmachine.configconfigurationcryptographysettingsc:\windows\microsoft.net\framework64\v4.0.30319\config\c:\users\4vuwxco\appdata\roaming\microsoft\clr" - Source: "00000000-00000364.00000000.169808.04BF0000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00000364.00000000.169808.04BF0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007272.00000000.170294.02E00000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00007272.00000000.170294.02E13000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportwindows" - Source: "00000000-00007272.00000000.170294.05000000.00000004.mdmp")47:Tc71,"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\* (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "FindNextFileW" with parameter fe2524177eb3088c77be666722039f52 (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\TWdSwTBx73u7cc353a7#\* (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\* (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "FindNextFileW" with parameter b138f79dea860272ebe6694d9b73f656 (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\* (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "FindNextFileW" with parameter e43dd9c73ab5615e461bf5109c3facd6 (UID: 00000000-00000364) "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Drawing\* (UID: 00000000-00000364)48:T192e,Found string "uSD8aESghI9s42cBfdH" (Indicator: "aes"; File: "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c") Found string "arUPJjyAIgyAESUjsXQ" (Indicator: "aes"; File: "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c") Found string "FromBase64String" (Indicator: "base64"; File: "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c") Found string "FromBase64String" (Indicator: "FromBase64String"; File: "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c") Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; File: "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c") Found string "GZipStream" (Indicator: "GzipStream"; File: "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c") Found string "ToBase64String" (Indicator: "base64"; File: "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c") Found string "ToBase64String" (Indicator: "ToBase64String"; File: "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c") Found string "System.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "aes"; File: "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c") Found string "System.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "aescryptoserviceprovider"; File: "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c") Found string "System.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "System.Security.Cryptography"; File: "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c") file/memory contains long string with (Indicator: "aes"; File: "6dd19aba3e2428") file/memory contains long string with (Indicator: "cast5"; File: "d2afed7e6d557d") Found string "icrosoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00000364.00000000.169808.02A80000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.DoNotAddrOfCspParentWindowHandle" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000364.00000000.169808.04BF0000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.UseLegacyFipsThrow" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000364.00000000.169808.04BF0000.00000004.mdmp") Found string "System.Security.Cryptography.RandomNumberGenerator" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000364.00000000.169808.04BF0000.00000004.mdmp") Found string "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "aes"; Source: "00000000-00000364.00000000.169808.04BF0000.00000004.mdmp") Found string "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "aescryptoserviceprovider"; Source: "00000000-00000364.00000000.169808.04BF0000.00000004.mdmp") Found string "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000364.00000000.169808.04BF0000.00000004.mdmp") Found string "System.Security.Cryptography.RSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000364.00000000.169808.04BF0000.00000004.mdmp") Found string "System.Security.Cryptography.DSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000364.00000000.169808.04BF0000.00000004.mdmp") Found string "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "aes"; Source: "00000000-00000364.00000000.169808.04BF0000.00000004.mdmp") Found string "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000364.00000000.169808.04BF0000.00000004.mdmp") Found string "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000364.00000000.169808.04BF0000.00000004.mdmp") Found string "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ecdsa"; Source: "00000000-00000364.00000000.169808.04BF0000.00000004.mdmp") Found string "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000364.00000000.169808.04BF0000.00000004.mdmp") Found string "System.Security.Cryptography.MD5Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000364.00000000.169808.04BF0000.00000004.mdmp") Found string "System.Security.Cryptography.SHA1Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000364.00000000.169808.04BF0000.00000004.mdmp") Found string "System.Security.Cryptography.SHA256Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000364.00000000.169808.04BF0000.00000004.mdmp") Found string "System.Security.Cryptography.SHA256CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000364.00000000.169808.04BF0000.00000004.mdmp") Found string "System.Security.Cryptography.SHA384Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000364.00000000.169808.04BF0000.00000004.mdmp") Found string "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000364.00000000.169808.04BF0000.00000004.mdmp")49:T44e,Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; File: "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; File: "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c") Found reference to API "BitBlt" (Indicator: "BitBlt"; File: "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c") Found reference to API "CreateDC" (Indicator: "CreateDC"; File: "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00007272.00000000.170294.008C2000.00000002.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00007272.00000000.170294.008C2000.00000002.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00007272.00000000.170294.008C2000.00000002.mdmp") Found reference to API "CreateDC" (Indicator: "CreateDC"; Source: "00000000-00007272.00000000.170294.008C2000.00000002.mdmp")4a:T475,Found reference to API "GetProcessById" (Indicator: "GetProcessById"; File: "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c") Found reference to API "GetProcessesByName" (Indicator: "GetProcessesByName"; File: "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c") Found reference to API "GetProcessesByName" (Indicator: "GetProcessesByName"; Source: "00000000-00000364.00000000.169808.04BF0000.00000004.mdmp") Found reference to API "GetProcessById" (Indicator: "GetProcessById"; Source: "00000000-00007272.00000000.170294.008C2000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00007272.00000000.170294.008C2000.00000002.mdmp") Found reference to API "GetProcessesByName" (Indicator: "GetProcessesByName"; Source: "00000000-00007272.00000000.170294.008C2000.00000002.mdmp, 00000000-00007272.00000000.170294.03160000.00000004.mdmp, 00000000-00007272.00000000.170294.05600000.00000004.mdmp")4b:T638,"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\TORSERVICE\TOR\LSASS.EXE"; Value: "") "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WCIFS"; Key: "SUPPORTEDFEATURES"; Value: "") "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WOF"; Key: "SUPPORTEDFEATURES"; Value: "") "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\FILEINFO"; Key: "SUPPORTEDFEATURES"; Value: "") "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "lsass.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "lsass.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "lsass.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "QUERYADAPTERNAME"; Value: "")4c:T506,"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN"; Key: "TOR"; Value: ""C:\Recovery\tor.exe"") "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN"; Key: "TOR"; Value: ""C:\Recovery\tor.exe"") "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN"; Key: "LSASS"; Value: ""C:\TorService\tor\lsass.exe"") "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN"; Key: "LSASS"; Value: ""C:\TorService\tor\lsass.exe"") "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN"; Key: "APPLICATIONFRAMEHOST"; Value: ""C:\Recovery\ApplicationFrameHost.exe"") "da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN"; Key: "APPLICATIONFRAMEHOST"; Value: ""C:\Recovery\ApplicationFrameHost.exe"")4d:T82fd,Executable loaded in memory "MZ@ !L!This program cannot be run in DOS mode. $PELb" n @ `t@ K $@ H.textt `.rsrc$ @@.reloc@@BPH<[c|w{ko0g+׫vʂ}YGԢr&6?4q1#'u ,nZR;ֳ)/S [j˾9JLXCM3EPfHa5WiَU(ߌ BhA-TR j068@|9/4CDT{2#=LBN.f($v[Im%rdhԤ\]elpHP^FWث XE,?k:AOgst"57unGq)ŉobV>Ky xZݨ31Y'_`QJ -zɜ;M*((*B++ }*++:( }*b++*(G +(g+>+%*s+R~++*+(+>(("*>((*B++ }'*++fs })( (!*.+{(*+B++ }(*++B++ }**++.+{+*+B++ }+*++>(("*>(%('*B++ },*++>(("*>(((+*.+{-*+B++ }-*++zs }.s }/(*f+ {.++*++o +f+ {.++*++o +f+ {/++*++o ++{.+ +{/+*+o ++o +z+{.++ + *+++o +R+{.+*+o +f+ {.+ *+o + *b++*(G +(g+**R }E( *&(P*++gF*(G +(g+( }Z}Y}[}X*.+{Z*+.+{[*+.+{X*+.+{Y*+( -~] ׹f(is zo) t}\*b++*(G +(g+"( *(^*"(_*( *+*++{+'_d}-++{+Y},*++++++z~+ {_+ t*+(+.+{)*++ ~+ +t**++(++${+ {-Y-+{-c-X*++++# _b,+- _d%,Z,a*+++ +++b`*+o ++o +^+{+{*++.+{^*++++,{+({__d}++{_}*+++++++++b`*+(++(+,+n.+t.,+,- * *+*+++++ _d+- +Y%,_-b,`*++++F +{Y*+.+{*++++ dm++ -X++m+,*+++(x++++(x+.+{*+z~+ {\+ t*+(+b,++*(G +(g+>++*+(+( s}}s}~}wi{}(*^ g}( *:( (*&(0 *2E+*(e+2F+*(e+2G+*(e+2H+*(e+2I+*(e+2J+*(e+2K+*(e+2L+*(e+2M+*(e+2N+*(e+2O+*(e+2P+*(e+2Q+*(e+2R+*(e+2S+*(e+2T+*(e+2U+*(e+2V+*(e+2W+*(e+2X+*(e+2Y+*(e+2Z+*(e+2[+*(e+2\+*(e+2]+*(e+2^+*(e+2_+*(e+2`+*(e+2a+*(e+2b+*(e+2c+*(e+2d+*(e+2e+*(e+2f+*(e+2g+*(e+2h+*(e+2i+*(e+2j+*(e+2k+*(e+2l+*(e+2m+*(e+2n+*(e+2o+*(e+2p+*(e+2q+*(e+2r+*(e+2s+*(e+2t+*(e+2u+*(e+2v+*(e+2w+*(e+2x+*(e+2y+*(e+2z+*(e+2{+*(e+2|+*(e+2}+*(e+2~+*(e+2+*(e+> +*(e+> +*(e+> +*(e+> +*(e+> +*(e+> +*(e+> +*(e+> +*(e+> +*(e+0 8~8~:&8~ ݾf88Y98d8i8j9&~ f(i(" ( :9~ f(i(" ~ f(i( ~%-&~s %(+(+~ %-&~s % o ~ f(i(" ~ f(i( ~ %-&~ s % (+(+~%-&~s %o ~ f(i(" ~ f(i( T,[+_s J} {s o o 30 {~ f(i( (+ s o JXTJi2~ ¾f(i(? ~ f(i~ f(i(" ~ f(i( (+T( ~ Of(i( o (+-~ ¾f(i(? ~ bf(io ((888&~ Af(io Y9s XR(, ( -~ 4f(io 8~ f(is ~ ޿f(i( T+oJ( oY o ,Jo o ( (4 ~ տf(i(" ( (+(o XRJXTJi2&(+(+XTXF,X(+T~~ f(iXJo ~ f(iX( ~ ~f(i( (? ~ uf(i( o (~ Pf(io Y9;:~ Gf(i (w ~ *f(i(" ( 9 ~ *f(i(" ~ =f(i( (+~%-&~s %o ~ 4f(i( (+~ %-&~s % o ~ ~ f(i(" ( ,e ~ f(i(" ( T+=-J ~ f(i ( ~ uf(i( JXTJi2~ (ro +x( %%~ f(i%%~ f(i%%~ f(i%%~ uf(i( ( :| o ~ ּf(i((" ~ f(i(? %~ f(i%(%~ Sf(i%(%~ Jf(i%(%~ Of(i% %~ f(i% (% ~ f(i%%~ f(i% ( o (+ ~ f(i(? o (~~ ƽf(i o &~ f(io Y9(4 o ~ f(i(" ( ,9~ f(i(4 o ~ f(i(" ( ((4 o ~ Rf(i(" ( ,9~ )f(i(4 o ~ Rf(i(" ( (&~* 8]o 8]o 8_8^(i8co 8^A|Cv!0,D~~ ~f+8~+8{+4~ af+/~+/+0+5~+5+6(ݷ(i++(+(i++(+(++(+&~( ~(~~ ~f(i~{(~ af(i~((~((~(--&*~0,<-9~+T+U+] j/F~~+S+T+Y~ Ѻf+T+Y-&,!, ~~+Ls ((**+s 8(8+s +(+(i+(++0T~~ f+~+++ ~+ +!,%&&*(i++(+(++(+(+0~~+r8s8x~ df8s8x-P~~+t+x8}~ 7f+{(-*~~s (~ Jf(i(**8s 8(8~(i8(8~8s 8~(8y(i8{0T~~ f+~+++ ~+ +!,%&&*(i++(+(++(+(+0T~~ f+~+++ ~+ +!,%&&*(i++(+(++(+(+0888,*888888YEg38 }o/ ( }o *: }o/ ( }o *o %92o/ (.~ +f(io/ sz }}o *X(:XF:-( }}}}*:" }}o Jo /Jo o (* 8l8k( 8f8h8go/ 8c(8^8]8\08\8]{-~ ֺf8M8Rz~8Q{8M/$~ f8E~ ֺf8@8Ez-{(%o /$~ f(i~ ֺf(is zs o 8r( {3 ~{(o 8B:{-',{s)P{8{3_s o 1? o +( {) o ( -o o u8~ f(isz9F{:~{~(X(,XJs& +=~{o~((, Os +{s) o 1@ o +( {)o ( -o o o38{@s, o 1@ o +( {)o ( -o o o3 u+A{-{+-{3o#u+~ Vf(isz( : o ,~ f(isz** 88(i8s 88(8(i8(i8s 8AdD#g0$T$;0,8-~0 )f88z-8288{.82~0 f88z~o (,~0 f(is zo (,4~~0 f(io ~0 f(i(s zo${.o {/o o *8(i8$s 88"8$8#o 8#(i8*s 8%0\,+4{.+0+1+6+7{.+3+4+9{/+5o o &--,*++o + +++o +++0~8{.888888,&,?8{/8{.o o o &-/{/o o ,+9{/o o {.o *8m8qo 8lo 8g8fo 8a(8\8`8d08-~0 )f88z~888 ~0 f88z8o (,4~~0 f(io ~0 f(i(s zo${.o {/o o *8L(i8Ss 8N8So 8N(8I(i8Ps 8K8K0+j-~0 )f+b8gz ~+f+j8o ~0 f+k+sz8w{/o o - {/o o * *8(i8s 88o 8(8(i8s 880,+~-~0 )f8s8xz~8w8x8} ~0 f8v8{z8(5-,'-{/o o &{.o &%,*%-*8|(i8s 8~8o 8~(8y(i8s 8{8{0~9- 89~8- 88~7- 87-~6- 86,]~788+A888-"%,&3( ,+( -~7o> &X o 2,(G ~7o (*s 89s 8@s 8Gs 8Qo 8Z 8Z8[8Zo/ 8U0888%:888888b8o -e,o c(G o ,3c(G ( tco ( -o , o ,X-i,?U*( 8.s 8) 8(8.82818584(G 890+Ou-&~~D %f+:~~+5+6+;+@+Ez+I+Jt((}>}C*+(i++(+(+(+s +++0,!8{>-~D f88z8X8i1~D ˸f88z8X8i1~D f(isaz{C,(t{>(q(|+(t{>((|*8K(i8Ws 8R8R8T(i8]sa8X8W8Y0~+T+Y- %,g%`+H: g%a+8;-%,%,g%b+"<*(G +(g+(( +(( +(( +08Q8R{E8E{E88{E58*{E58{E888T+6~{EJJX(t({EJJcTJ9/~{E(t({EXT+F~{EXJXJX(t (:_{EXJ XXJcTXJ%9/XT+wXT+W~{EXJ(t{EXJ({EXJXJXXXJXTXJXJ2XXJXJXTXJ?~X% 3*>c{E{E5XT+F~{EYXJ(t(}{EXJXXJcTXJ08 8888888(880) 58888{E88X88_8% 8a% a% a% a{EXX _c% a% a% a% aY8=8<8A8M8M(i8Ysc8T8T0 8c + X+ +++( +(G ++&݁98} (8y8~8T8QJ o XRXTXo YT+gXJo/ ~3XR+\XT-+.~dXJ3XXJ:ZXJXT+XXJXTXJ:2XXJYT:XJ(= 8?8>(89(= 84828108~8|8}-*~8y8y{@~8r~8n8oY8r}@(o ],*o [s XT+L~XJo ~XJo (Y()XJXo (zo XXJXTXJo 2*~(&[3k~~(Y(&]3O( o s XT+# XJo (zo XXJXTXJ o 2*-~(&"3T~~(Y(&"38~~~(Y()~e Qf(i~ (,*~~(&(/-~(&-3[~~e f(i(,$~ ~((&O*~X(2&XJ*~~e Lf(i(,Y*~~e cf(i(,Y** 8z8~(8y8(&8}88(8(&80o-H+G+H{?+D+E,%-"+D+E{@+AX+@-+B{AX(-{BX(*+++(++++(++08-+++,&+Y,,++--* ++(++ ++08X8Y8Z8_g8Z8[(%c8S8TbY {z}@8GEy8(TJgXT+SX(TX(TXJgio^ &XJsXJ(&XXJXJXTXJJ2+wg%Ч(( g%С(( (iYo (~-,o rp rps zrsps zo * 88s8888 8 8 8+0l8~6808+ ~688888!8"3*T~7o XT8XJo/ :5".<,.H:.C+b-]5[.].+N{.}. +BJXT+:JYT+2XXJ(T+6J-~7o o ~7o +~7XJo/ o> &XXJXTXJo Y?M~7o o * 8o 8s 8o 888o 88o 80\+7+8+9+>,+<-+9+:a-+7+8a%, (a,(a*++(+ +++++(+0l8~e Zf88 t~e -f88t8888 (+(+(+(+(+sCsOs[ sV % oQ%ioRg%ioSoT&( o ~e 8f(i( o *&( o ~e 8f(i( o *8(i8o 8(i8o 8( 8(+8(+8( 8)*0L+0-+%%+&+'+'+(aҜ+%Y+$,+"%-%-/-* ++++++ ++0f+T8Y-+- -+++++ +!+"o ,)++++o +++ -o *s 8 8=D0K+3 _%-+$ +"+#,-+" %+ a*+ ++(+++0; 888i[T8J.'8J.8J.~e f88z8JX}={=X:s XTXT+0XJcXJ_XJ(( XXJXTXXJXTXJi2X{=XbTXJT8XXJYcXJY_( TXJJ]-*XXK((~7(5+(i+(+(+(5+(i+(+ +&,*+*+0 ~8N8O8T8U8V8[8\8]],8^*~8o -~T(;( +~8o ~9o -~T(>( + ~9 o 8~o (>~o ~o (Y()Xo o "~~(((A+- o ,!~~(((DXo ?E*8(88 88(888o 880|!~k+\~8X8Y~j++&+,-,-++,"+o ++++~(G-+(** 88(G8+4J0,_+N,Z+Y{+U+V{+R+SX}+M+N{%X+F+F{ _}, _%Y,=*+++ ++++++0>"88T+<8{T% 8J%88X%8-88JYTJ/g{G{ToA&{I,~~FY(+XYT+0% XJ% XJaҜXJXXJXXJYTXJ/{S(-{H{SoJ%{VjX}V* 8888 8 88 88 0~~~ ~e f+)( %~e ٶf++#t+#+$+)+*-ݐ(i+(i+o. + +(+++&~~~ ~e f+,( %~e ٶf+!o. t(,,#(i+(i+&~e ~f(i*,*jUii[0888{T88{9,p18{+#88{8{YX _TXT---XJYTXJ%-"1'{ XJYXJ(+ XJXJ{JY(+ {XJY}{/s zXJ* 8$8#8"8'8&858=8<8@0#%,r+tg8n-- 8iT+P-g+_+`X~+Zi+YJY+VT~+UJXJ(({HoJJXTJi2* 888++++(J++0?~~7~8888&8X88~888\3C,~~7~(&(M&~~7~X(&(M&X +J~(&"3~~7~(&(M&*~~7~(&(M&X ~(?F~(Y*88(&8(M88 888(&8 0~~~ ~e f+)( %~e Ķf++#t+#+$+)+*-ݐ(i+(i+o. + +(+++&~~~ ~e f+,( %~e Ķf+!o. t(,,#(i+(i+&~e ~f(i*,*jUii[08-8888T-8X88K8TXXK(T,XXKaTKXKaXKaKXKa- (aXKXK,a(aXK-(a* 8d8f8e8d(8_8b8c8b(8^08D%{?8>8?{=8:a}?%{@8283{=8.a}@%{A8&8'{=( a}A%{B{=( a}B{=Y8g~;{? _~;{Bd _ba~;{Ad _ba~;{@d _ba(( aTX~;{@ _~;{?d _ba~;{Bd _ba~;{Ad _ba(( aTX~;{A _~;{@d _ba~;{?d _ba~;{Bd _ba(( aT~;{B _~;{Ad _ba~;{@d _ba~;{?d _ba(%Y( a~;K _~;d _ba~;XKd _ba~;XKd _ba(( a}?~;XK _~;Kd _ba~;d _ba~;XKd _ba(( a}@~;XK _~;XKd _ba~;Kd _ba~;d _ba(( a}A~; _~;XKd _ba~;XKd _ba~;Kd _ba(%Y( a}B=~;{? _~;{Bd _ba~;{Ad _ba~;{@d _ba(( aTX~;{@ _~;{?d _ba~;{Bd _ba~;{Ad _ba(( aTX~;{A _~;{@d _ba~;{?d _ba~;{Bd _ba(( aT~;{B _~;{Ad _ba~;{@d _ba~;{?d _ba(( a~;K _~;d _ba~;XKd _ba~;XKd _ba( a}?~;XK _~;Kd _ba~;d _ba~;XKd _ba( a}@~;XK _~;XKd _ba~;Kd _ba~;d _ba( a}A~; _~;XKd _ba~;XKd _ba~;Kd _ba( a}B* 888( 888( 8880$9&8~e f88888X89&XF-||%P(" Q}*}{o Jo /Jo o (* 8o8n(i8s8r(" 8m8m8l(8i8j0V+9+:+:+;+<+=X%b`+5+6+7X%b` -X%b` *++ ++++ +++0%888*% 8~&%-&~%s %&888+7+?+@{,%! s" (+%! s" (oA -+o# +,o -*s$ 8R 8Q8Po% 8V(+8po' 8k8jMM 0I&88~i%X9&88 _-888-e~ *8,,@_-?_b~i%X-X +7_b~i%XbX~i%XbX-~i%XX- -~~~ (P~i(S( ~~~ (P i(S(~l,( &-*888888 888` 0b+A+B+CiT+AJ+Ai.*+8R8Q8U8Y8X0*'88~~8~e ڹf88888t8-+P,o t-K-H~~e f(io2to*(-,o ݌~ (V-,-~(Y(8< 8;(w8@(i8E(8@(8;s86(81o981&~e ~f(i* *A4Gd0P+3+4+5Ҝ+4+5X%+1dҜ+.+/X%++dҜX%dҜ*+++++++++0H~+5_b~+*c_b`~+c_b`~+c`h*++++0Y(5+.+/+.+/,+0+/+0+4+3((* +++(+++(+++0+s8t{O8p}S8p8q{P+p}T+s}U+qj}V+k{Q,~{Q{Qi(Y,}R{GoB*88({888({88++0D)88{~88888{wT8JYE0/8 8{~8(Y% /9'*{{}(% _, /#%:X/*}}}w*~s Y}y~t Y}x{x1J}wX{}{x(TXJ/*-{}{x(o{yXJX}y }w:{{}(/*~u}z~v}x{x1K }wX{}{x(TXJ%-/*{}{x(o{zXJX}z{~{y{z({yY,}w <* 88(8888888#0G+%{g++{++{+++*+ ++++(+ ++s+0\~:+I _~:+=d _b`~:+,d _b`~:+d _b`*++++0[-,&+4+4+5T+4X+3+4T+3+4+5XKdK`X%3*XKbT+ +++++++++0+f8g{8c8dX}-+^ 3,+Uz,+V{+R+S{ X}Ҝ--{ _}*88 88+s ++++08"588 YEDB\\D8e .;8b".B,-+E8Z\58W/.&,+T\.+(+O{.+L}.+***,**,*%,%,**8w8z8888+++0T):8 8 (%?8{8%2 -88_88-c*8ceTX_TXJ(%2{J c`_(oc*X{TXJ({J c`,A_XJ0_(o-c**X{TXJ({2_XJ0_(oc** 88888 8(o888 05*@8888XT+D8X88XJT8XJ18XJ%JXTXXJXTXJi2TX TXT+uXJJJXJXJY_bXTXJ 2?XXJ _TXJ _TXXJXJXJYXJY_cXTXXJXTXJ>XJw}X T XT8$XJ _TJ XJ XJY_bYT(XJ _T+E{(XJ(XJeb XJ`hXXJ XJ Y_bXT(X(XJ XT(XJ$XJ2 X XJYT XJ s 8@8@8D 8J8Q0/~ 88888~,~e of8888~,~e f(i(o, ~,~e Qf(i(o, ,!~,~e df(i(o, +3,&~~~.o- ((( X&&~~~e f(i((,~~~e f(i((--v~~~0~e Wf(is ~/~e :f(i(t((~e f(i~e ȷf(i(, & K 8e8es. 8`8_8^(i8h(8co, 8^8]&* *AL/%s0088R8XR8 X8~8|8}8~8R:s :9T8w~J(&(9.;8XF XF_,J1JXT~(* XF9?-"~e Ƿf(i~J(&szXF9~~J(&((M&XR89^ XF,~~J(&(M&8JT~(*XF,~~J(&((M&XXFR:y+GXF,'~~J(&((M&XR+~~J(&(M&JXTJ~(?w~(T XF9~~(Y(&(.R+]9XTX~(YT+XXJXTXXJYTXJ2~XJ(&(.XJ]R~(* 8u8s8t8x8z8~8}(&8x(8s0T%98 8X8 {wT8XJYE"n88{|:,8}w*88{}8TJ/*{}(oJ9_, 9e}|JcE8+H{}(,}w+1~}~}}w+s}}w*{}(%}{/*{}(o}w{}(-/*{}(o}wX{~{}{{(yT{{XJY}{{{- }w*{}(*{{}(-*{(}{(v}}w(*9** 88888/8;8C8B(8C0q+@-~e f+5+:z~+9+:,~e qf+3+8z+<{/+8o --*+(i+s ++(+(i+s +++0b+E+Fb+C+D,-2+?+@X%b,-`+1+2+3X%b-` X%` *++ ++++ +++021rpgrph,i8kl%-m~~grp8,9l8j~2~h8-m~5~38rp88~6~+3+4(g~8(&-(~i,+(+,~(*s 8((8Fs/ 8O(8Y(8f(8f 8eI0S+/, f%, a+$+&~m-Y+~l--++*++*+++++(++(+0|%Т+Qs-B%Щ+At,%Ъ+1u%,%Х+!v--*(( +(( +(( +(( +02 g8:9&,\+8%X88 2,`+-8%X8 8 2+8%X %,62+%X 2s g +%X 2,s* 8H8P8T8W8X8f8i8k8s0\%Ш+9-%,%У+'-%,͍%Ц+*(( +(( +(( +0%Ц8^g%Ф8Q w g-\8/+-~8)08(Xb8&-~%X88 2+&~8 Xb(~%X 2::+(~ X b(9~%X 2+~Xb(~%X 2wg:3 +(~b(9~9X 2*(( 8(( 8 888(8 888{z}2E&/^'@GB#/yCՇ>vʽ"H&ezc"b<၊=uZSC:ԛޘgY+~TF)|ں" fDx6Q _n19+zɷO/wVTtQ{Z3hf߼}/HATmC2q^4\6C}:[KqNsuݸ"7ϓˣ|S#(1DBTQ{CC)z<-S(v3e[-W}ršKEU%$[OsJ"H.A:&RW$Z;P@ccVW$еm{7A{Sjqfy<;fT7On)+rƈfF͊#crM*U Ggϟ [F`܂4ZwOWZ牮Z>`C~/A&:l6u:+0Pg VLv:|חh9Bo&~pGR":(-WZ ʞ :fՎU&?uH *]pX# &&Qo8DWgFv噠b(.ҪSq@)m2t=w C B G F KJNQT*W6[AZA_P^Pc_b_g_f_kkjkyy ~ ! %$)(,/2598?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~ !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~h%k0rt%{%# %){%# x9%)%){%# :{L;;{L;<<&# &# &#&+&#H=0?:&)S&){%# c&x&#&# &&#&w&&'&&-'#'#3.'?'#O'#_'wk'|'#'JTCPD' WD P']E-' Fc(i0( GcE(qE(_( +b()HI {%# J{(dK( pL){%# LO(# (#P#@Q(TTU#()(#*( 5( ):):)#K)){%# &# d)#m)# u)#m)# u)#{%# W? ZZ)H[_#9q le bp ~)# ~)# ~)# )w)]d)epfghcipij)hmm(n*C*oXqqHss$t|t'o*6v=*GyNzY*azh{cX|s~z~$pctLc **6hhzБ@Pcl + ԕ 4@+ n+$ ++ +3 ; hC ȜM V ] dc +$ $+j 8c|q X } 8 +)~)# ~)# ~)# ,z)z~)# ~)# ,#X){%# T,# )l,#{%# )L){,#e #9Fq,)#9Fq ,)#9Fq ,)#9Fq ,)#9Fq ,)#9Fq ,)#9Fq{,)#9Fq& ,)#9Fq2 ,)#9Fq,)#9FqB -)#9Fq-)#9Fqw!-)#9FqY .-)#9Fq;-)#9Fqj H-)#9Fqt U-)#9Fq~ b-)#9Fqo-)#9Fq |-)#9Fq -)#9Fq -)#9Fq -)#9Fq -)#9Fq -)#9Fq -)#9Fq -)#9Fq -)#9Fq-)#9Fq -)#9Fq.)#9Fq#.)#9Fq/%.)#9Fq;2.)#9FqF?.)#9FqUL.)#9FqdY.)#9Fqpf.)#9Fq s.)#9Fq.)#9Fq.)#9Fq.)#9Fq.)#9Fq.)#9Fq.)#9Fq.)#9Fq.)#9Fq.)#9Fq.)#9Fq/)#9Fq/)#9Fq /)#9Fq-)/)#9Fq;6/)#9FqGC/)#9FqSP/)#9Fqb]/)#9Fqnj/)#9Fqyw/)#9Fq/)#9Fq/)#9Fq/)#9Fq/)#9Fq/)#9Fq/)#9Fq/)#9Fq/)#9Fq0)m hqqM1 1 A M !PXLLL q#(3e>>/CGJ;JP PkPP/UY ] ]pcgn s s!Zw ww w)cw1*w {& { {/ 7N?O 9}A/AA7 QzYi6 @y @ #V+I+ +++A/8;@G@`HM XanA2vA@0q=7 At AA+`1& 'Y # !#)# 1#A#I#Q#Y#a#i#q#y######## ##(# /$#9_?OV,#94f p# p /+wwf < 4# 4# +Ye< m DL/LV+>< T # <# T# ## Qw\qd'#dl4'4t|tV+4 lV+## # `#1' #Y & YQ%# # # # ZwQZw!#1#/#II+YI 'a%Qi#.i;yAqFyAyIAymAyAqMyk Ayf Ay@AqUyrAi_' gn2si#yyuA yAQ# nDD# <#4 < #J ## 'sn]H[GW# #v! # 1# 44444#9d\#9d# T #T$T%$ $# # Y#/TX\`dtx|.c.k.s.{ . .# .k Cccq Cc @`#{ @AC `ac !cbb#$%t1@ALBtCxD ,6AGTu &2:A_er{ { 012Z\^`bhjlnprtv%,39?FMU\cjryP `P!aP"bp"f""p###$X$h$x$$ e U #"$"%"10328797:7;7<7=7>7@?A?B?C?D?{}666z:'6CCC|G|LMQ~~~~~~~~~~~~~~~~~~~~~~~~~Ldarg_0Ldarg_1IEnumerable`1Stack`1Action`1ICollection`1IEqualityComparer`1IEnumerator`1IList`1Microsoft.Win32UInt32ToInt32Ldarg_2Func`2Dictionary`2m0000D3Ldarg_3Ldc_I4Int168PjL4j9p1T4HRGW6get_UTF8XleD8lmu2TukS_OnInitDoneZdHepKsnhZdDeeUG93ky9OjZ8GM5rlvnM8PWPluginUrWtnueHw9t59ZdHepKsnhZdDeeUG93ky9OjZ8GM5rlvnM8PWPluginUrWtnueHw9t59OnStealerZdHepKsnhZdDeeUG93ky9OjZ8GM5rlvnM8PWPluginUrWtnueHw9t59UIDtypeIDkDgA3J9dTGoVv4ZKSystem.IOLdarg_Svalue__ProtectedDatamscorlibSubSystem.Collections.Genericget_IsStaticReadAddIsDefinedTrimEndAppendDynamicMethodmethodReplaceIsWhiteSpaceCreateInstanceOpCodeget_UnicodeAddRangeTakeEndInvokeBeginInvokeIEnumerableIDisposableDoubleRuntimeFieldHandleRuntimeMethodHandleResolveMethodHandleget_ModuleHandleRuntimeTypeHandleResolveTypeHandleGetMethodFromHandleGetTypeFromHandleFileget_Moduleget_MainModuleProcessModuleget_Nameget_FileNameGetTempFileNameGetFileNameGetProcessesByNameGetDirectoryNameLocalMachineCloneDataProtectionScopeget_IsGenericTypeget_FieldTypeChangeTypeValueTypeget_ReturnTypeownerTypeget_ParameterTypeGetTypeGetElementTypeget_PropertyTypeWhereSystem.Coreget_InvariantCultureCaptureMethodBaseget_OrdinalIgnoreCaseCloseDisposeTryParseCreateDelegateCreateGetStringDelegateMulticastDelegateDeleteThreadStaticAttributeCompilerGeneratedAttributeGuidAttributeAttributeUsageAttributeDebuggableAttributeComVisibleAttributeAssemblyTitleAttributeAssemblyTrademarkAttributeTargetFrameworkAttributeGetCustomAttributeExtensionAttributeAssemblyFileVersionAttributeAssemblyConfigurationAttributeAssemblyDescriptionAttributeIgnoreDataMemberAttributeDefaultMemberAttributeCompilationRelaxationsAttributeAssemblyProductAttributeAssemblyCopyrightAttributeCLSCompliantAttributeAssemblyCompanyAttributeRuntimeCompatibilityAttributeReadByteget_ValueTryGetValueSetValueget_IsPrimitiveRemoveIndexOfBuildTagStealerConfigSystem.ThreadingEncodingSystem.Runtime.VersioningFromBase64StringToStringGetStringSubstringForEachMatchPushMathGetFolderPathget_Lengthset_LengthEndsWithStartsWithiAsyncCallbackcallbackTransformFinalBlockDecimalCallTailcallGetManifestResourceStreamMemoryStreamget_Itemset_ItemSystemSymmetricAlgorithmTrimICryptoTransformget_IsEnumBooleanget_MetadataTokenMinJoinSystem.GlobalizationSystem.Runtime.SerializationSystem.ReflectionGetGenericTypeDefinitionSearchOptionArgumentOutOfRangeExceptionArgumentNullExceptionInvalidOperationExceptionFormatExceptionArgumentExceptionInternCopyToFieldInfoMethodInfoFileInfoCultureInfoFileSystemInfoMemberInfoParameterInfoConstructorInfoDirectoryInfoPropertyInfoSkipPopGroupSystem.LinqClearCharAesCryptoServiceProviderIFormatProviderStringBuilderSpecialFolderStringComparerCurrentUserEnterIEnumeratorGetEnumeratorGetILGenerator.ctor.cctorGetConstructorMonitorCreateDecryptorCreateEncryptordummy_ptrSystem.DiagnosticsGetFieldsGetMethodsSystem.Runtime.InteropServicesSystem.Runtime.CompilerServicesFormatterServicesOpCodesDebuggingModesGetDirectoriesGetPropertiesGetFilesGetModulesNumberStylesCreateMemberRefsDelegatesReadAllBytesGetBytesBindingFlagsStringsContainsSystem.Text.RegularExpressionsSystem.Collectionsget_CharsRuntimeHelpersGetParametersget_SuccessProcessAttributeTargetsGetGenericArgumentsExistsRemoveAtConcatGetUninitializedObjectobjectSelectUnprotectDistinctGetRetSetIsDigitSplitSystem.Reflection.EmitExitget_DefaultIAsyncResultZdHepKsnhZdDeeUG93ky9OjZ8GM5rlvnM8PWPluginUrWtnueHw9t59OnStealerWorkResultresultEnvironmentget_Currentget_CountInsertConvertCallvirtIListToListMoveNextSystem.TextReadAllTextRegexInitializeArrayToArrayToCharArrayget_IsArrayOpenSubKeyContainsKeyRegistryKeySystem.Security.CryptographyGetExecutingAssemblyget_IsReadOnlydummyCopyIDictionaryDirectoryRegistryop_Equalityop_InequalitySystem.SecurityIsNullOrEmptyMemberRefsProxy{7dd4f6ff-8200-4ae5-8a57-1edf78202c30}{7dac886c-d93d-41aa-ae79-d6fffeab5ea4}{b457cb8e-1ec3-453a-a0c3-b70d2a289d5d}~~~~~~~~~~~~~~~~~~~~~~~versionaSelected compression algorithm is not supported.Unknown Header154M{b457cb8e-1ec3-453a-a0c3-b70d2a289d5d}aܿJv0++*+(=+(1 sB}@sC}A}:i{@(*^ :}J(1 *:(1 (*&(o *2)+*(.+2*+*(.+2++*(.+2,+*(.+2-+*(.+2.+*(.+2/+*(.+20+*(.+21+*(.+22+*(.+23+*(.+24+*(.+25+*(.+26+*(.+27+*(.+28+*(.+29+*(.+2:+*(.+2;+*(.+2<+*(.+2=+*(.+2>+*(.+2?+*(.+2@+*(.+2A+*(.+2B+*(.+2C+*(.+2D+*(.+2E+*(.+2F+*(.+2G+*(.+2H+*(.+2I+*(.+2J+*(.+2K+*(.+2L+*(.+0P888~ f8~88~ lf8~9&&&8~ wf(2~0o/ ~ Jf(2~0o/ ,~ -f(2~o/ ~ 8f(2~o/ ~ f(2~o/ ~ f(2~o/ ~ f(2~o/ ~ Կf(2~ o/ ~ f(2~ o/ ~ f(2~ o/ ~ f(2~o/ ~ pf(2~o/ ~ sf(2~o/ ~ Zf(2~o/ ~ %f(2~o/ ~ f(2~o/ ~ f(2~o/ ~ f(2~o/ ~ żf(2~o/ ~ f(2~o/ ~ f(2~o/ ~ f(2~o/ ~ f(2~o/ ~ df(2~o/ ~ wf(2~ o/ ~ rf(2~"o/ *s0 8 88(28o/ 88(28o/ 8808u8z~ Vf8u~ Vf8k~ Vf8U~ Vf8K~ Vf8A~ Vf87 ~ Vf8- ~ Vf(2~ Vf(2 ~ if(2~ 8f(2s3 ~o(L(+(+9B~q~ f(2(O-~ &f(2+$~u~q~ f(2(O(R~q~ !f(2(O-~ &f(2+$~u~q~ !f(2(O(R~q~ f(2(O-+~q~ f(2(O0~q~ ۽f(2(O-+~q~ ۽f(2(O0~q~ f(2(O-~ &f(2+$~u~q~ f(2(O(R~q~ Žf(2(O-~ &f(2+=~x~u~q~ Žf(2(O(R~ f(2(U~q~ f(2(O-~ &f(2+=~x~u~q~ f(2(O(R~ f(2(U~q~ zf(2(O-~ &f(2+$~u~q~ zf(2(O(R ~q~ f(2(O-~ &f(2+$~u~q~ f(2(O(R ~q~ \f(2(O-~ &f(2+=~x~u~q~ \f(2(O(R~ Of(2(U~q~ ff(2(O-~ &f(2+=~x~u~q~ ff(2(O(R~ Of(2(U~q~ Mf(2(O-+.~y~u~q~ Mf(2(O(R(X ,~|([,~|([&*(2 8(08|(28(28(28(28(28(28(28ALJYqj{089&~ ^f8~ ^f8~ ^f8~ ^f8~ ^f8}~ ^f8s~ ^f8i~~} (^~ Hf(2(a ~(d(+~s~(a~ úf(2(Ou,&~s~(a~ f(2(O~s~(a~ f(2(O ,# , ~u(R 6(&,~|([&~ qf(2~ @f(2s3 ~o(L(+(+9~~~ ^f(2(g9~q~ f(2(O-~ .f(2+%~u~q~ f(2(O(R~q~ /f(2(O-~ .f(2++~~q~ /f(2(O(jn(~q~ f(2(O-~ .f(2+%~u~q~ f(2(O(R~q~ f(2(O-~ .f(2+%~u~q~ f(2(O(R~q~ f(2(O-~ .f(2+%~u~q~ f(2(O(R~q~ f(2(O-~ .f(2+%~u~q~ f(2(O(R~q~ ӻf(2(O-~ .f(2+>~x~u~q~ ӻf(2(O(R~ f(2(U,~|([,~|([&*(2 8O(08L(28Q(28[(28e(28o(28y(28(28A~0-#8i8n~ af8i~ af8_~~883!~~~888/~ f(2+~ f(2~ bf(2s3 ~o(L(+(+,V~q~ 9f(2(O-~ 1f(2+$~u~q~ 9f(2(O(R,~|([,~|([5(m8(p8(m8 (s8(v8&~~(m(p3!~~~(m(s(v/~ f(2+~ f(2~ (f(2s3 ~o(L(+(+ ,V~q ~ 9f(2(O-~ 1f(2+$~u~q ~ 9f(2(O(R ,-~| ([,~|([&*(2 8(08(28(28A[):2l[Maor0t8$8)~ gf8$~ gf8~ gf8~ gf8~ gf89~ zf8u~ f8ps3 ~o(L(+(+9 ~q~ f(2(O-~ 7f(2+.~w~u~q~ f(2(O(R(R~q~ f(2(O-~ 7f(2+.~w~u~q~ f(2(O(R(R~q~ ޸f(2(O-~ 7f(2+.~w~u~q~ ޸f(2(O(R(R,~|([,~|([(28(28&~ zf(2~ f(2s3 ~o(L(+(+ 9 9~q ~ f(2(O-~ 7f(2+$~u~q ~ f(2(O(R~q ~ f(2(O-~ 7f(2+$~u~q ~ f(2(O(R ,~| ([,~|([&*(2 8(08(28(28(28(28(28A(OsN8*0Q8)8.-~! if8& :~! |f8~! f88:&~o88(+(+,[~q~! Pf(2(O-~! 9f(2+)~~q~! Pf(2(O(y(' ,,~|([%8v(L8q,,~|([-'(28&(28+s3 8& 8'&*(2 8(08(28ALp`V& /0f8>8C~# kf8>"~8888888~(G."~(@~(@~~~(((+Ko6 ~~((3+~(n.~u~((R"[~(-,~|([ X i?#+(|88 88 8 8 &*(2 8(08(28A4]#!D0D88{A88888{:T8JYE0/8, 8{A8((Y% /9'*{C{@(% _, /#%:X/*}D}C}:*~6 Y}<~7 Y};{;1J}:X{@{;(TXJ/*-{@{;({XJ7}MX T XT8$XJ _TJ XJ XJY_bYT(XJ _T+E{M(XJ(XJeb XJ`hXXJ XJ Y_bXT(X(XJ XT(XJ$XJ2 X XJYT XJ /*{@(}:{@(-/*{@(}:X{A{@{>(!T{>XJY}>{>- }:*{@(*{B{@(%-*{B(}C{B(}D}:( *9** 88888/8;8C8B(8C0 888{KT88{L9,p18{L+#88{K8{LYX _TXT---XJYTXJ%-"1'{J XJYXJ(9 XJXJ{JJY(9 {LXJY}L{L/s8 zXJ* 8$8#8"8'8&858=8<8@0H~_+5_b~_+*c_b`~_+c_b`~_+c`h*++++0f+T8Y-+- -+++++ +!+"o; ,)++++o< +++ -o *s= 8 8=D08{I8<8{F8{G3: o* 88{H8{E88{F X}F _{E{F X}F _b`{I_b`}H{IX}I{Hn-_b-% Yj_i*82868:8>8R8Q8U8Y8X0P ++{W:+"+#{S+{V++{W+++*+ +++++(9 ++sE+0U ~.+=-~+6+7,~-+ + +-++o> +-~( ++(+&* 3QQ0 888lW8XT+.,,8X8XJXT88O#@[W-8O#@7XJX~%i,2~~$ Vf(2(? ~$ -f(2~%XJ(* 8V8U8T8U8`8a8f8e8s08X8Y8Z8_:8Z8[(*%c8S8TbY {z}@8GEy8(*TJ:XT+SX(*TX(*TXJ:io) &XJs@XJ(&&XXJXJXTXJJ2+w:%j(@ :%d(@ (iYoA (-,o rp rpsB zrspsC zoD * 88sI8888 8 8 8+0|~.+\~8X8Y~-++&+,-,-++,"+oE ++++~(-+()** 88(8+4J088{L8X%}L8 18z8{K8Y _8-v 8-Y0c{K/Z0L{J{J{K(9 {KX}K*{J{KX}K{J%X %Y0*("*8483878>s8 8@8@8D 8J8Q0 88 %,8{LY888888X {KYTXJ1:{J{KXJ(TJXJ3/J{JXJY(XT+{J{K(T{KJX _}K{LJX}LJ* 88878>(F 8?8>($89(F 8482810,_+N,Z+Y{J+U+V{K+R+SX}K+M+N{J%X+F+F{K _}K, _%Y,=*+++ ++++++0888{UT8JEJ-+8p8q8q}V8q{V/*8h{V X}V(}U(}W{W/*{WX}W({V{WX}Y{Y:}S}U(}X{X/*{XX}X(:}R}\}U+AX(TXJ/*({R~]{\XJҜ{\X}\{\{X2{RsE}T}R}\}U+<{SX{\TXJX}\XJ%}[{\{Y3*{T(%_,/*2}[Y}Z}UX~Q{ZTXJ( /*XJ( ~P{ZX +'{SX{\TXJX}\XJ{[ %Y 0{\{Y3*}U8n 8h8g8f8k88(8880 +}8~T8}{:%,U.?8rX8q8r8s{A+r+vTXJXJXJXTXJY-J*(-{A{L1 {:@J* 8}8|8}88888(80 8,88W8XT+(8X8XJXT88O#@[W8O#@7XJX~%i2~~$ Vf(2(? ~$ -f(2~%XJ(* 8`8b8a8a8f8g8l8k8v0+f8g{L8c8dX}L-+^ 3,+Uz,+V{J+R+S{K X}KҜ--{K _}K*88 88+s8 ++++0I88~,%X9&88 _-888-e~G *8,,@_-?_b~,%X-X +7_b~,%XbX~,%XbX-~,%XX- -~~~(~,(( ~~~( i((~/,( &-*888888 888` 0-3 88, 88~& *f88~& Ef88~& @f+~~& ;f(2~& 6f(2~& f(2%*(2 8g(08b 8j8i(28o8o(28u8u(28x08' + X+ +++(H +(2 ++&݁98} (8y8~8T8QJ oI XRXTXoJ YT+gXJoK ~3XR+\XT-+.~(XJ3XXJ:ZXJXT+XXJXTXJ:2XXJYT:XJ<'XJ X(L (M tF&݁oN , oO (P U&^oQ XiXTXJ' (2 XT+) XJXJYoR :aXXJXTXJXJ2~G oS sT oU ~V oW XJ1~X oW XJ1~Y oW XJ1~Z oW XJ11XT+~[ XJo\ XXJXTXJXJ2~] oW XF-~^ +~_ o` ~a oW ob & oc &-JXTJi?* 8I8}od 8}8|8{@ )3" /CO0Z,:P%)+%(+ , +#+(++'--,*(@ +(2 +(& +oe +of +08[8\ (8X8]8^T,8-8U8VJ8U8oO (2 .9~G (2 '%(2 og sh oU ~V oW (2 oi XT+]XJoS (2 34~j ok _o\ ~l oW ~^ o` +,XXJXTXJi-2~a oW (2 ob oc 8&JXTJi?* 88od 888888A=P02rp*rp+,,8./%-0~~*rp8,9/8-~z~+8-0~~8rp88~~+3+4(:~(&-(,,+(+,~|([*s1 8((g8Fsn 8O(X8Y(8f(8f 8eI0S+/, f%, a+$+&~0-Y+~/--++*++*+++++()++(+0|%e+Q6-B%l+A7,%m+18%,%h+!9--*(@ +(@ +(@ +(@ +0 :8:9&,\+8%X88 2,`+-8%X8 8 2+8%X %,62+%X 2sEN : +%X 2,sEO* 8H8P8T8W8X8f8i8k8s0\%k+9P-%,%f+'Q-%,͍%i+]*(@ +(@ +(@ +0%i8^^:%g8Q_ 7` :a-\8/+-~`8)08(Xb8&-~a%X88 2+&~`8 Xb(~a%X 2::+(~` X b(9~a%X 2+~`Xb(~a%X 27b:c:3 +(~bb(9~c9X 2*(@ 8(@ 8 888(8 888d{z}/%n|eͩtQ&:cmhi EWr}C4ݢg֡=VޥY0/G%HHc@AċIvu@Oeyj!yPhı~,۰ Č{^jZDOEG-6(|mN$bD+/h;e9H'BD&a{cY?ƕP{ϢPb X'S|3+5o3.Q3LߺM7FR]"F.7-qKrw5cZgzhtE-6hm*FxI-10~̋4|!*KO>ãs pSDMr)CCޤ5R^Jr7.gWVb24WvC670}4Vg t!FVSjhT ج/9f7!~>1#m)gq_&9_ȕ:=c'Xo;y͖Oiw%9a8"b|w5eEsY<`v\y'0CZw"ȎlD2reyݪ-5}UQt^ses@3O bޅ] q7+877rVs M?.pYoqm+eTYs;i_HkήIߍ()ͧ 45(qw/Ju9'8l͒&n YXa`?s%gWg#lp"2F4~jz|t`Qѱkn"^½{[ofޏ:+nFX$IjN=XBSJBv4.0.30319l#- #Strings%#US&#GUID&#Blobw( %3RN o]/% L r_: r` r" \ddxddddLdd: a%(9T xTToTP-lVL w } T'fSH>f^}t-x{ " $ %, '.)0\ )1 )5 )6 )7 )8 )9 ):);*;*;1= 1> 1?1@6@6@EBJCMDPF^HdIdJnJnJnJnJnJ8 InJ nJ pM tP xS yV {Y }\ ~_ b e h k! n# q% t( w+ z. }0 2 5 8 ; > A D ICTTW C!C C C5CC(C35C"3O113S3W3_3b1W7WVeVeVeVe3}3}3}3}WWWWWbSWWTWSWW663}3}SSWWWWWWW3}1}3S11S11S3333333333 !#'%1(;';+F*F.Q-Q0[2e5p4p8{7{;:>=A@DC ( 2 2 !"#$%&'()*+ -./0123456789:;<=>?@ABCDEFGHIKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~J'GH# P#Pd*P0PD6P9P=PD?P@Z%P 2 F K%P 2 F X%P 2 F e%P 2 F r%P 2 F %P 2 F %P 2 F %P 2 F! %P 2 F %P 2 F6 %P 2 F@ %P 2 FK %P 2 FV %P 2 F` %P 2 Fj &P 2 Fu &P 2 F &P 2 F (&P 2 F 5&P 2 F B&P 2 F O&P 2 F \&P 2 F i&P 2 F v&P 2 F &P 2 F &P 2 F &P 2 F &P 2 F &P 2 FS &P 2 F &P 2 F &P 2 F- &P 2 F7 &P vv I/Y4a 4 S9i9i=q0CyC( a Ha} QaWi \ybJg"lXqvyzm00004AtypeIDPlatformIDSystem.IOLdarg_Svalue__mscorlibSubSystem.Collections.Genericget_IsStaticReadAddDynamicMethodmethodNetworkInterfaceOpCodeEndInvokeBeginInvokeIEnumerableIDisposableToDoubleRuntimeFieldHandleRuntimeMethodHandleResolveMethodHandleget_ModuleHandleRuntimeTypeHandleResolveTypeHandleGetMethodFromHandleGetTypeFromHandleget_Moduleget_Nameget_AddressPreferredLifetimeget_FieldTypeget_NetworkInterfaceTypeValueTypeOfTypeget_ReturnTypeownerTypeget_ParameterTypeSystem.CoreMethodBaseCloseDisposeParseCreateDelegateCreateGetStringDelegateMulticastDelegateCompilerGeneratedAttributeAttributeUsageAttributeAssemblyFileVersionAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeReadByteTryGetValueSetValueRegistryHiveSystem.ThreadingEncodingFromBase64StringToStringGetStringMathget_LengthiAsyncCallbackcallbackTransformFinalBlockCallTailcallVj927xlGetManifestResourceStreamMemoryStreamget_ItemOperatingSystemSymmetricAlgorithmTrimICryptoTransformget_PlatformEnumget_MetadataTokenMinget_OSVersionget_VersionSystem.Net.NetworkInformationUnicastIPAddressInformationSystem.ReflectionUnicastIPAddressInformationCollectionManagementObjectCollectionArgumentOutOfRangeExceptionInvalidOperationExceptionFormatExceptionInternFieldInfoMethodInfoMemberInfoParameterInfoSystem.LinqCharAesCryptoServiceProviderManagementObjectSearcherEnterget_MajorIEnumeratorGetEnumeratorGetILGenerator.ctor.cctorMonitorCreateDecryptorCreateEncryptordummy_ptrGetFieldsGetMethodsGetAllNetworkInterfacesSystem.Runtime.CompilerServicesOpCodesGetIPPropertiesIPInterfacePropertiesGetModulesGetSubKeyNamesget_UnicastAddressesCreateMemberRefsDelegatesBindingFlagsStringsSystem.Collectionsget_CharsRuntimeHelpersGetParametersIPAddressget_AddressAttributeTargetsSystem.Net.Socketsget_OperationalStatusConcatManagementBaseObjectManagementObjectobjectGetSystem.NetRetSystem.Reflection.EmitExitFirstOrDefaultIAsyncResultresultSystem.ManagementEnvironmentget_CurrentConvertCallvirtMoveNextSystem.TextRegistryViewInitializeArrayOpenSubKeyOpenBaseKeyRegistryKeySystem.Security.CryptographyGetExecutingAssemblyget_AddressFamilydummyCopyop_EqualityEmptyMemberRefsProxy{adb006eb-85b2-43f9-a9f8-6af353805f50}{07e2ef30-4ddc-4684-9260-9df82f693502}{3e03b2a1-9107-4786-9026-fceb81cee6cf}~~~~~~~versionaSelected compression algorithm is not supported.Unknown Header1119M{3e03b2a1-9107-4786-9026-fceb81cee6cf}Rd"Jvxz\V4 ?_ :!qu! ) 1EI 1 Q U Y ] a e i m qu } ! % -5 5 5 5 ! 9 E E E 9 4 ! p|t|x tttt| t x t xxttt p x T!htx| ) 1EI 1 Q U Y ] a e i m qu } $( , 0 4 TWrapNonExceptionThrowslD@!%1%%%]u]qu h $!%)-)-ؙ _CorDllMainmscoree.dll% @0HX4VS_VERSION_INFO?,StringFileInfo000004B0$FileVersion$InternalName(LegalCopyright,OriginalFilename(ProductVersion,Assembly VersionDVarFileInfo$Translation:", Executable loaded in memory "MZ@ !L!This program cannot be run in DOS mode. $PELa! ( @ @'K@` H.text$ `.rsrc@@@.reloc`@B(H!L0;j xs +!o o - o X X 2j[l*j*( *0f~rpr!p{s ( ( ( r5p( o &~rpr!pr=po ( +>>0%s }s s ( *( *( *BSJBv4.0.30319ll#~D#StringsL#USh#GUIDx#BlobW %3 ;4R4[4M h h h 444#0 '999AnP B d@!y-q!5y!5 5 5!J)515959TA[A` 5QqQvYvazi*qii<5..COOd=+4UserPingCounter.dclibPluginAPImscorlibSystemObjectPingTimeAverageAction`2Action`3OnAPIDelegatesCreateOnLoad.ctorsetDataaddDatasetStatussetCustomColumnDatahostechoNumUIDPathBuildTagHostAddressSystem.Runtime.CompilerServicesCompilationRelaxationsAttributeRuntimeCompatibilityAttributeUserPingCounterCompilerGeneratedAttributeSystem.Net.NetworkInformationPingPingReplySendIPStatusget_Statusget_RoundtripTime<>c__DisplayClass1b__0Uriget_HostDoubleToStringStringConcatInvokeSystem.ThreadingThreadSleepThreadStartStartUserPingCounterUser Ping ms-1 ms٨E"+Xz\V4 ! % ! 9TWrapNonExceptionThrows'( (_CorDllMainmscoree.dll% 0HX@ll4VS_VERSION_INFO?DVarFileInfo$TranslationStringFileInfo000004b0,FileDescription 0FileVersion0.0.0.0LInternalNameUserPingCounter.dclib(LegalCopyright TOriginalFilenameUserPingCounter.dclib4ProductVersion0.0.0.08Assembly Version0.0.0.0 8"1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1792096661848,"unified_at":"2026-10-15T20:37:41.848Z","metadata":{"hashes":{"sha256":"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c","sha1":"d1486d6b3d39ea619861674fdbcc26fcb0be4efa","md5":"a7d1a64806b4813a93a8b525043d658e","sha512":"38e8ed405a66142b4bfc998a6b3db4bded5d24fbd404ec1dc13174d5a6801f060c093dd0cd18cb0c9520ffd6491b2d0a3f9e847876783cff6acae8b64fd6d9d1","ssdeep":"24576:j8kvnsgubZe2V+Nd+vPIeUjZUlQuIozWOfY4f:pnsguV+APHU1UbWm","ssdeep_chunks":["24576:j8kvnsg","24576:8kvnsgu","24576:kvnsgub","24576:vnsgubZ","24576:nsgubZe","24576:sgubZe2","24576:gubZe2V","24576:ubZe2V+","24576:bZe2V+N","24576:Ze2V+Nd","24576:e2V+Nd+","24576:2V+Nd+v","24576:V+Nd+vP","24576:+Nd+vPI","24576:Nd+vPIe","24576:d+vPIeU","24576:+vPIeUj","24576:vPIeUjZ","24576:PIeUjZU","24576:IeUjZUl","24576:eUjZUlQ","24576:UjZUlQu","24576:jZUlQuI","24576:ZUlQuIo","24576:UlQuIoz","24576:lQuIozW","24576:QuIozWO","24576:uIozWOf","24576:IozWOfY","24576:ozWOfY4","24576:zWOfY4f","49152:j8kvnsg","49152:8kvnsgu","49152:kvnsgub","49152:vnsgubZ","49152:nsgubZe","49152:sgubZe2","49152:gubZe2V","49152:ubZe2V+","49152:bZe2V+N","49152:Ze2V+Nd","49152:e2V+Nd+","49152:2V+Nd+v","49152:V+Nd+vP","49152:+Nd+vPI","49152:Nd+vPIe","49152:d+vPIeU","49152:+vPIeUj","49152:vPIeUjZ","49152:PIeUjZU","49152:IeUjZUl","49152:eUjZUlQ","49152:UjZUlQu","49152:jZUlQuI","49152:ZUlQuIo","49152:UlQuIoz","49152:lQuIozW","49152:QuIozWO","49152:uIozWOf","49152:IozWOfY","49152:ozWOfY4","49152:zWOfY4f","24576:pnsguV+","24576:nsguV+A","24576:sguV+AP","24576:guV+APH","24576:uV+APHU","24576:V+APHU1","24576:+APHU1U","24576:APHU1Ub","24576:PHU1UbW","24576:HU1UbWm"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"bounty-43939206573778426","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":1070592,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1714440094000,"last_seen":1755951854000,"last_multi_scan":1755951854000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["windows-server-utility","evasive"]},"stats":{"av":{"malicious_count":18,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":80},"sandbox_signatures":{"informative_count":183,"suspicious_count":16,"malicious_count":12,"total":211},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.FUJL","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Backdoor]/MSIL.DCRat","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1323984","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Ransom.Prometheus.2","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Ransom.Prometheus.2 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/Spy.Agent.DTP trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"TrojanSpy/MSIL.Stealer.n","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005c37eb1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Trojan-FUJL!A7D1A64806B4","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.DCRat.kqegle","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/DCRat-N","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/MSIL_Agent.LQ.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.MSIL_Heur.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TScope.Trojan.MSIL","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware_42.7","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.BasicGen.Win32.4","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Ransom.Prometheus.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Able to execute application (.NET)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to start a process (Dotnet)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Found Native API in Dotnet file"},{"type":"suspicious","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Able to use GrayString API for text rendering"},{"type":"informative","value":"Able to execute applications using .NET process API"}],"sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Found a reference to a WMI query string known to be used for VM detection"},{"type":"suspicious","value":"Executes WMI queries known to be used for VM detection"},{"type":"informative","value":"Contains ability to execute a WMI query"},{"type":"informative","value":"Contains ability to execute WMI queries (Dotnet)"},{"type":"informative","value":"Executes WMI queries"},{"type":"suspicious","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"},{"type":"informative","value":"Contains reference to multiple windows system processes"}],"sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"The analysis extracted a file that was identified as malicious"},{"type":"malicious","value":"The analysis spawned a process that was identified as malicious"}],"sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to create a service (API string)"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"tactic":"Persistence","technique":"Winlogon Helper DLL","attack_id":"T1547.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/004","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Dotnet code contains ability to modify/delete registry"}],"sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"tactic":"Privilege Escalation","technique":"Portable Executable Injection","attack_id":"T1055.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/002","identifiers":[{"type":"informative","value":"Attempts remote code execution into another process memory space"}],"sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"informative","value":"Found PE header in memory"},{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"malicious","value":"Script loads executable in memory (Antimalware Scan Interface)"}],"sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to perform AES cryptographic operations (Dotnet)"},{"type":"informative","value":"Dotnet file contains encryption/decryption functions"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains ability to perform symmetric encryption (Dotnet)"},{"type":"informative","value":"Contains ability to perform crypto operations"},{"type":"informative","value":"Contains ability to perform CryptoStream operations (Dotnet)"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Able to utilize the Windows bcrypt cryptographic API"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Dotnet file resource with suspicious entropy"},{"type":"informative","value":"Contains ability to load manifest resource from assembly (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Contains strings related to AMSI (Anti Malware Scan Interface)"},{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"}],"sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Dotnet code contains potential unpacker"},{"type":"informative","value":"Can load assembly that contains the code that is currently executing (Dotnet)"},{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to decode base64 data"},{"type":"informative","value":"Contains ability to perform symmetric decryption (Dotnet)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"tactic":"Defense Evasion","technique":"Match Legitimate Resource Name or Location","attack_id":"T1036.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/005","identifiers":[{"type":"malicious","value":"Creates a fake system process"},{"type":"malicious","value":"Found a system process name at an unusual pathway"}],"sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"},{"type":"informative","value":"Dotnet file contains function to dynamically call methods at runtime"}],"sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"tactic":"Defense Evasion","technique":"Compile After Delivery","attack_id":"T1027.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/004","identifiers":[{"type":"informative","value":"Contains ability to perform code compilation at runtime (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – Anomalous PE file structure"},{"type":"informative","value":"YARA signature match - Medium entropy File"}],"sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"The input sample contains the RDTSCP instruction"}],"sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"tactic":"Defense Evasion","technique":"Masquerade File Type","attack_id":"T1036.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/008","identifiers":[{"type":"suspicious","value":"Drops binary executable file with an unexpected extension"}],"sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to set file attributes (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"tactic":"Credential Access","technique":"Input Capture","attack_id":"T1056","attack_id_wiki":"https://attack.mitre.org/techniques/T1056","identifiers":[{"type":"informative","value":"Contains ability to register/read input devices (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Contains ability to collect clipboard information (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to retrieve operating system version"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Contains ability to gather system information (Dotnet)"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Able to gather system file/directory information (.NET)"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Reads system-defined device setup information from registry"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"}],"sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"suspicious","value":"Able to retrieve open application windows"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Contains ability to get active window titles (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"}],"sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to retrieve running process details (.NET)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Contains ability to gather process details (Dotnet)"},{"type":"malicious","value":"Opens a handle of credential dumping utility"},{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"References to WMI query strings used for process discovery"}],"sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Queries TCP/IP interface details"}],"sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Contains ability to retrieve current user details (Dotnet)"},{"type":"informative","value":"Contains ability to retrieve user privileges (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"tactic":"Discovery","technique":"Device Driver Discovery","attack_id":"T1652","attack_id_wiki":"https://attack.mitre.org/techniques/T1652","identifiers":[{"type":"informative","value":"Tries to retrieve device driver information"}],"sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"malicious","value":"Executes WMI queries in order to detect local security applications"}],"sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Able to modify Remote Configuration"}],"sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Writes log files"}],"sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen information (Dotnet)"},{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"},{"type":"informative","value":"Able to perform SQL operations"}],"sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Calls an API typically used to copy file from one location to another"}],"sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"},{"type":"informative","value":"Contains ability to decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contacts server"}],"sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Contains reference to Windows HTTP services (API string)"},{"type":"informative","value":"Contains ability to provide interface for network protocols (Dotnet)"},{"type":"informative","value":"Contains ability to communicate with network (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains ability to perform asymmetric crypto operations"},{"type":"informative","value":"Contains ability to perform encryption/decryption using RSA algorithm"}],"sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Drops executable files"},{"type":"suspicious","value":"Drops a text file that contains suspicious strings (e.g. shell/ActiveX/DOM related)"},{"type":"informative","value":"Contains ability to download files with network (Dotnet)"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate via sockets (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Contains ability to perform symmetric crypto operations"},{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Able to retrieve/open a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains ability to perform encryption (API string)"},{"type":"informative","value":"Contains reference to cryptographic keys"},{"type":"informative","value":"Able to access crypto-related API (String)"}],"sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"},{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"Found string \"Switch.System.IO.Compression.DoNotUseNativeZipLibraryForDecompression\" (Source: \"00000000-00000364.00000000.169808.04BF0000.00000004.mdmp\")\n Found string \"elected compression algorithm is not supported.\" (Source: \"00000000-00000364.00000000.169808.04BF0000.00000004.mdmp\")\n Found string \"GZipStream\" (Source: \"00000000-00007272.00000000.170294.008C2000.00000002.mdmp\")\n Found string \"elected compression algorithm is not supported.\" (Source: \"00000000-00007272.00000000.170294.03160000.00000004.mdmp, 00000000-00007272.00000000.170294.03180000.00000004.mdmp, 00000000-00007272.00000000.170294.05600000.00000004.mdmp\")\n Found string \"Switch.System.IO.Compression.DoNotUseNativeZipLibraryForDecompression\" (Source: \"00000000-00007272.00000000.170294.05600000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe\" called \"FindResourceW\" with parameter \"7\" - (UID: 00000000-00000364)\n \"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe\" called \"FindResourceW\" with parameter \"63\" - (UID: 00000000-00000364)\n \"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe\" called \"FindResourceW\" with parameter \"64\" - (UID: 00000000-00000364)\n \"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe\" called \"FindResourceW\" with parameter \"8\" - (UID: 00000000-00000364)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe\" called \"LoadResource with parameter {'hModule': '77004801', 'hResInfo': '77006048'}\" (UID: 00000000-00000364)\n \"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe\" called \"LoadResource with parameter {'hModule': '77004801', 'hResInfo': '77006080'}\" (UID: 00000000-00000364)\n \"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe\" called \"LoadResource with parameter {'hModule': '77004801', 'hResInfo': '77006096'}\" (UID: 00000000-00000364)\n \"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe\" called \"LoadResource with parameter {'hModule': '77004801', 'hResInfo': '77006064'}\" (UID: 00000000-00000364)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to decompress content at runtime","description":"Observed function \"System.IO.Compression.GZipStream\" in \"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c\"\n Observed function \"System.IO.Compression.GZipStream\" in \"lsass.exe.bin\"","origin":"Static Parser","mitre_attack_id":"T1560.002","relevance":1,"id":"static-116","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load manifest resource from assembly (Dotnet)","description":"Observed namespace \"System.Reflection.Assembly\" and TypeReference \"GetManifestResourceStream\" in \"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c\"\n Observed namespace \"System.Reflection.Assembly\" and TypeReference \"GetManifestResourceStream\" in \"lsass.exe.bin\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-173","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenServiceA\" (Indicator: \"OpenService\"; Source: \"00000000-00007272.00000000.170294.1DD00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform code compilation at runtime (Dotnet)","description":"Observed namespace \"Microsoft.CSharp.CSharpCodeProvider\" and TypeReference \".ctor\" in \"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c\"\n Observed namespace \"Microsoft.CSharp.CSharpCodeProvider\" and TypeReference \".ctor\" in \"lsass.exe.bin\"","origin":"Static Parser","mitre_attack_id":"T1027.004","relevance":1,"id":"static-174","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetCreationTimeUtc\" (Indicator: \"SetCreationTime\"; Source: \"00000000-00007272.00000000.170294.008C2000.00000002.mdmp\")\n Found reference to API \"SetLastAccessTimeUtc\" (Indicator: \"SetLastAccessTime\"; Source: \"00000000-00007272.00000000.170294.008C2000.00000002.mdmp\")\n Found reference to API \"SetLastWriteTimeUtc\" (Indicator: \"SetLastWriteTime\"; Source: \"00000000-00007272.00000000.170294.008C2000.00000002.mdmp\")\n Found reference to API \"SetLastWriteTime\" (Indicator: \"SetLastWriteTime\"; Source: \"00000000-00007272.00000000.170294.008C2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$27","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"Observed string: \"amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00000364.00000000.169808.02A80000.00000004.mdmp\n Observed string: \":\\WINDOWS\\SYSTEM32\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00007272.00000000.170294.1DD00000.00000004.mdmp\n Observed string: \"amsiscanbuffer\" (Indicator: \"amsiscanbuffer\") in Source: 00000000-00007272.00000000.170294.1DD00000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-231","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet code contains potential unpacker","description":"Observed function \"System.Load\" in \"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c\"\n Observed function \"System.Reflection.Load\" in \"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c\"\n Observed function \"System.Load\" in \"lsass.exe.bin\"\n Observed function \"System.Reflection.Load\" in \"lsass.exe.bin\"","origin":"Static Parser","mitre_attack_id":"T1620","relevance":1,"id":"static-115","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file contains encryption/decryption functions","description":"Observed namespace \"System.Security.Cryptography\" and MemberReference \"TransformFinalBlock\" in \"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c\"\n Observed namespace \"System.Security.Cryptography\" and MemberReference \"CreateDecryptor\" in \"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c\"\n Observed namespace \"System.Security.Cryptography\" and MemberReference \"TransformFinalBlock\" in \"lsass.exe.bin\"\n Observed namespace \"System.Security.Cryptography\" and MemberReference \"CreateDecryptor\" in \"lsass.exe.bin\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-134","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file contains function to dynamically call methods at runtime","description":"Observed namespace \"System\" and MemberReference \"GetMethods\" in \"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c\"\n Observed namespace \"System.Management\" and MemberReference \"GetMethodParameters\" in \"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c\"\n Observed namespace \"System.Diagnostics\" and MemberReference \"GetMethod\" in \"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c\"\n Observed namespace \"System\" and MemberReference \"GetMethod\" in \"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c\"\n Observed namespace \"System\" and MemberReference \"GetMethods\" in \"lsass.exe.bin\"\n Observed namespace \"System.Management\" and MemberReference \"GetMethodParameters\" in \"lsass.exe.bin\"\n Observed namespace \"System.Diagnostics\" and MemberReference \"GetMethod\" in \"lsass.exe.bin\"\n Observed namespace \"System\" and MemberReference \"GetMethod\" in \"lsass.exe.bin\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":1,"id":"static-135","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file resource with suspicious entropy","description":"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c has big resource with name: \"Vfgo5niYV4PSBld8SD.7xLdBVuUfJP3VKNP8Y\" size: \"268340\" and abnormal entropy:\"7.988251131537127\"\n lsass.exe.bin has big resource with name: \"Vfgo5niYV4PSBld8SD.7xLdBVuUfJP3VKNP8Y\" size: \"268340\" and abnormal entropy:\"7.988251131537127\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-129","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00000364.00000000.169808.04BF0000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00007272.00000000.170294.03160000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00007272.00000000.170294.03180000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00007272.00000000.170294.03190000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00007272.00000000.170294.05600000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00000364.00000000.169808.04BF0000.00000004.mdmp\")\n Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00000364.00000000.169808.04BF0000.00000004.mdmp\")\n Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00007272.00000000.170294.05600000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to utilize the Windows bcrypt cryptographic API","description":"Found reference to API \"BCryptImportKey\" (Indicator: \"BCryptImportKey\"; Source: \"00000000-00007272.00000000.170294.1DD00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-927","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; File: \"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c\")\n Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"00000000-00000364.00000000.169808.04BF0000.00000004.mdmp\")\n Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"00000000-00007272.00000000.170294.008C2000.00000002.mdmp, 00000000-00007272.00000000.170294.03160000.00000004.mdmp, 00000000-00007272.00000000.170294.03180000.00000004.mdmp, 00000000-00007272.00000000.170294.05600000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES cryptographic operations (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.Aes\" and TypeReference \"Create\" in \"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c\"\n Observed namespace \"System.Security.Cryptography.Aes\" and TypeReference \"Create\" in \"lsass.exe.bin\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-167","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform CryptoStream operations (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.CryptoStream\" and TypeReference \"FlushFinalBlock\" in \"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c\"\n Observed namespace \"System.Security.Cryptography.CryptoStream\" and TypeReference \"FlushFinalBlock\" in \"lsass.exe.bin\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-166","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform asymmetric crypto operations","description":"Observed namespace \"System.Security.Cryptography.RSACryptoServiceProvider\" and TypeReference \"set_UseMachineKeyStore\" in \"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c\"\n Observed namespace \"System.Security.Cryptography.RSACryptoServiceProvider\" and TypeReference \"set_UseMachineKeyStore\" in \"lsass.exe.bin\"","origin":"Static Parser","mitre_attack_id":"T1573.002","relevance":1,"id":"static-141","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform crypto operations","description":"Observed namespace \"System.Security.Cryptography\" in [Source: \"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c\"]","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-118","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00000364.00000000.169808.04BF0000.00000004.mdmp\")\n Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00000364.00000000.169808.04BF0000.00000004.mdmp\")\n Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00007272.00000000.170294.05600000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"RSACryptoServiceProvider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00007272.00000000.170294.008C2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-352","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform symmetric crypto operations","description":"Observed namespace \"System.Security.Cryptography.Aes\" and TypeReference \"Create\" in \"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c\"\n Observed namespace \"System.Security.Cryptography.AesCryptoServiceProvider\" and TypeReference \".ctor\" in \"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c\"\n Observed namespace \"System.Security.Cryptography.RijndaelManaged\" and TypeReference \".ctor\" in \"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c\"\n Observed namespace \"System.Security.Cryptography.Aes\" and TypeReference \"Create\" in \"lsass.exe.bin\"\n Observed namespace \"System.Security.Cryptography.AesCryptoServiceProvider\" and TypeReference \".ctor\" in \"lsass.exe.bin\"\n Observed namespace \"System.Security.Cryptography.RijndaelManaged\" and TypeReference \".ctor\" in \"lsass.exe.bin\"","origin":"Static Parser","mitre_attack_id":"T1573.001","relevance":1,"id":"static-140","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform symmetric decryption (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateDecryptor\" in \"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c\"\n Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateDecryptor\" in \"lsass.exe.bin\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-168","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform symmetric encryption (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateEncryptor\" in \"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c\"\n Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateEncryptor\" in \"lsass.exe.bin\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-165","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"System.Security.Cryptography.Xml.KeyInfoEncryptedKey, System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\" (Indicator: \"encryptedkey\"; Source: \"00000000-00000364.00000000.169808.04BF0000.00000004.mdmp\")\n Found string \"http://www.w3.org/2001/04/xmlenc# EncryptedKey\" (Indicator: \"encryptedkey\"; Source: \"00000000-00000364.00000000.169808.04BF0000.00000004.mdmp\")\n Found string \"System.Security.Cryptography.Xml.KeyInfoEncryptedKey, System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\" (Indicator: \"encryptedkey\"; Source: \"00000000-00007272.00000000.170294.05600000.00000004.mdmp\")\n Found string \"http://www.w3.org/2001/04/xmlenc# EncryptedKey\" (Indicator: \"encryptedkey\"; Source: \"00000000-00007272.00000000.170294.05600000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$28","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$29","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00000364-00000C2B-1655510804\")\n Found reference to API \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00000364-00000C2B-1658480401\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system file/directory information (.NET)","description":"Observed dotnet function \"GetDirectories\" in \"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c\"\n Observed dotnet function \"GetFiles\" in \"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c\"\n Observed dotnet function \"GetDirectories\" in \"lsass.exe.bin\"\n Observed dotnet function \"GetFiles\" in \"lsass.exe.bin\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":3,"id":"static-200","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"UserName\" (Source: \"00000000-00000364.00000000.169808.04BF0000.00000004.mdmp\")\n Found string \"GetDrives\" (Source: \"00000000-00007272.00000000.170294.008C2000.00000002.mdmp\")\n Found string \"get_OSVersion\" (Source: \"00000000-00007272.00000000.170294.008C2000.00000002.mdmp, 00000000-00007272.00000000.170294.03180000.00000004.mdmp, 00000000-00007272.00000000.170294.05600000.00000004.mdmp\")\n Found string \"get_Is64BitOperatingSystem\" (Source: \"00000000-00007272.00000000.170294.008C2000.00000002.mdmp\")\n Found string \"get_MachineName\" (Source: \"00000000-00007272.00000000.170294.008C2000.00000002.mdmp\")\n Found string \"get_UserName\" (Source: \"00000000-00007272.00000000.170294.008C2000.00000002.mdmp\")\n Found string \"UserName\" (Source: \"00000000-00007272.00000000.170294.05600000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00000364-00000C2B-1655510804\")\n Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00000364-00000C2B-1658480401\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; Source: \"00000000-00007272.00000000.170294.1DD00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"WTSEnumerateProcessesW\" (Indicator: \"WTSEnumerateProcesses\"; Source: \"00000000-00007272-00000C2B-1661917116\")\n Found reference to API \"WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; Source: \"00000000-00007272-00000C2B-1662150615\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00000364-00000C2B-1654336413\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00000364-00000C2B-1654336986\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00000364-00000C2B-1659857802\")\n Found reference to API \"CheckTokenMembershipW\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00000364-00000C2B-1659857826\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00007272-00000C2B-1669441060\")\n Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00007272.00000000.170294.1DD00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"FindWindowW\" (Indicator: \"findwindow\"; Source: \"00000000-00007272.00000000.170294.1DD00000.00000004.mdmp\")\n Found reference to API \"FindWindowExW\" (Indicator: \"findwindow\"; Source: \"00000000-00007272.00000000.170294.1DD00000.00000004.mdmp\")\n Found reference to API \"FindWindowA\" (Indicator: \"findwindow\"; Source: \"00000000-00007272.00000000.170294.1DD00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00000364)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00000364)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00000364)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe\" called \"GetForegroundWindow\" (UID: 00000000-00000364)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe\" called \"IsWow64Process\" with parameter \"364\" - (UID: 00000000-00000364)\n \"lsass.exe\" called \"IsWow64Process\" with parameter \"7272\" - (UID: 00000000-00007272)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00000364)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2a","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe\" called \"OpenMutexW\" with parameter \"8fb4c81bf54f650e17fea326f5282c40e7fb0e47\" - (UID: 00000000-00000364)\n \"lsass.exe\" called \"OpenMutexW\" with parameter \"8fb4c81bf54f650e17fea326f5282c40e7fb0e47\" - (UID: 00000000-00007272)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$2b","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00000364)\n \"lsass.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00007272)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute WMI queries (Dotnet)","description":"Observed namespace \"System.Management.ManagementObjectSearcher\" in \"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c\"\n Observed namespace \"System.Management.ManagementObjectSearcher\" in \"lsass.exe.bin\"","origin":"Static Parser","mitre_attack_id":"T1047","relevance":1,"id":"static-114","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"Found string \"SELECT * FROM Win32_Processor\" (Indicator: \"select * from \"; Source: \"00000000-00007272.00000000.170294.05600000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowW\" (Indicator: \"FindWindowW\"; Source: \"00000000-00007272.00000000.170294.1DD00000.00000004.mdmp\")\n Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; Source: \"00000000-00007272.00000000.170294.1DD00000.00000004.mdmp\")\n Found reference to API \"FindWindowA\" (Indicator: \"FindWindowA\"; Source: \"00000000-00007272.00000000.170294.1DD00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to gather system information (Dotnet)","description":"Observed function \"get_SystemDirectory\" in \"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c\"\n Observed function \"get_OSVersion\" in \"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c\"\n Observed function \"get_Is64BitOperatingSystem\" in \"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c\"\n Observed function \"get_MachineName\" in \"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c\"\n Observed function \"get_UserName\" in \"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c\"\n Observed function \"get_Version\" in \"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c\"\n Observed function \"get_SystemDirectory\" in \"lsass.exe.bin\"\n Observed function \"get_OSVersion\" in \"lsass.exe.bin\"\n Observed function \"get_Is64BitOperatingSystem\" in \"lsass.exe.bin\"\n Observed function \"get_MachineName\" in \"lsass.exe.bin\"\n Observed function \"get_UserName\" in \"lsass.exe.bin\"\n Observed function \"get_Version\" in \"lsass.exe.bin\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":1,"id":"static-120","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to get active window titles (Dotnet)","description":"Observed Namespace \"System.Diagnostics.Process\" and MemberReference \"get_MainWindowTitle\" in \"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c\"\n Observed Namespace \"System.Diagnostics.Process\" and MemberReference \"get_MainWindowTitle\" in \"lsass.exe.bin\"","origin":"Static Parser","mitre_attack_id":"T1010","relevance":1,"id":"static-148","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"lsass.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve current user details (Dotnet)","description":"Observed Namespace \"System.Security.Principal.WindowsIdentity\" and MemberReference \"GetCurrent\" in \"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c\"\n Observed Namespace \"System.Security.Principal.WindowsIdentity\" and MemberReference \"GetCurrent\" in \"lsass.exe.bin\"","origin":"Static Parser","mitre_attack_id":"T1033","relevance":1,"id":"static-152","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetLastAccessTime\" (Indicator: \"GetLastAccessTime\"; File: \"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c\")\n Found reference to API \"GetLastWriteTime\" (Indicator: \"GetLastWriteTime\"; File: \"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c\")\n Found reference to API \"GetCreationTime\" (Indicator: \"GetCreationTime\"; File: \"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c\")\n Found reference to API \"GetLastAccessTime\" (Indicator: \"GetLastAccessTime\"; Source: \"00000000-00007272.00000000.170294.008C2000.00000002.mdmp\")\n Found reference to API \"GetLastWriteTime\" (Indicator: \"GetLastWriteTime\"; Source: \"00000000-00007272.00000000.170294.008C2000.00000002.mdmp\")\n Found reference to API \"GetCreationTime\" (Indicator: \"GetCreationTime\"; Source: \"00000000-00007272.00000000.170294.008C2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; File: \"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c\")\n Found reference to API \"GetWindowText\" (Indicator: \"GetWindowText\"; File: \"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c\")\n Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; Source: \"00000000-00007272.00000000.170294.008C2000.00000002.mdmp\")\n Found reference to API \"GetWindowText\" (Indicator: \"GetWindowText\"; Source: \"00000000-00007272.00000000.170294.008C2000.00000002.mdmp\")\n Found reference to API \"FindWindowW\" (Indicator: \"FindWindow\"; Source: \"00000000-00007272.00000000.170294.1DD00000.00000004.mdmp\")\n Found reference to API \"FindWindowExW\" (Indicator: \"FindWindow\"; Source: \"00000000-00007272.00000000.170294.1DD00000.00000004.mdmp\")\n Found reference to API \"FindWindowA\" (Indicator: \"FindWindow\"; Source: \"00000000-00007272.00000000.170294.1DD00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"Observed string: \"Ver\" (Indicator: \"ver\") in Source: 00000000-00007272.00000000.170294.02E13000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-327","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionInfo\" (Indicator: \"GetVersion\"; File: \"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c\")\n Found reference to API \"GetVersionInfo\" (Indicator: \"GetVersion\"; Source: \"00000000-00007272.00000000.170294.008C2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Environment Awareness","name":"Executes WMI queries","description":"\"lsass.exe\" issued a query \"SELECT * FROM Win32_Processor\"\n \"lsass.exe\" issued a query \"$objects\"\n \"lsass.exe\" issued a query \"SELECT * FROM Win32_VideoController\"\n \"lsass.exe\" issued a query \"SELECT * FROM Win32_BaseBoard\"\n \"lsass.exe\" issued a query \"SELECT * FROM Win32_BIOS\"\n \"lsass.exe\" issued a query \"SELECT * FROM AntivirusProduct\"\n \"lsass.exe\" issued a query \"SELECT * FROM FirewallProduct\"\n \"lsass.exe\" issued a query \"SELECT * FROM Win32_ComputerSystem\"","origin":"API Call","mitre_attack_id":"T1047","relevance":10,"id":"api-56","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$2c","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe\" queries volume information of \"C:\\da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe\" at 00000000-00000364-00000C17-1654608296\n \"lsass.exe\" queries volume information of \"C:\\TorService\\tor\\lsass.exe\" at 00000000-00007272-00000C17-1661940973","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"lsass.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"lsass.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\LSASS.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Environment Awareness","name":"References to WMI query strings used for process discovery","description":"Found string \"SELECT * FROM Win32_Processor\" (Indicator: \" Win32_Process\"; Source: \"00000000-00007272.00000000.170294.05600000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-513","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Environment Awareness","name":"Tries to retrieve device driver information","description":"\"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\SANDBOXFLTR\"; Key: \"\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1652","relevance":1,"id":"registry-174","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"General","name":"Able to execute application (.NET)","description":"Observed function \"System.Diagnostics.ProcessStartInfo.UseShellExecute\" in \"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c\"\n Observed function \"System.Diagnostics.ProcessStartInfo.UseShellExecute\" in \"lsass.exe.bin\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":3,"id":"static-108","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"General","name":"Able to execute applications using .NET process API","description":"Found string \"ProcessStartInfo\" (Source: \"00000000-00007272.00000000.170294.008C2000.00000002.mdmp\")\n Found string \"set_UseShellExecute\" (Source: \"00000000-00007272.00000000.170294.008C2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-934","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"General","name":"Able to use GrayString API for text rendering","description":"Found reference to API \"GrayStringA\" (Indicator: \"GrayStringA\"; Source: \"00000000-00007272.00000000.170294.1DD00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-900","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"General","name":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)","description":"\"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00000364)\n \"lsass.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00007272)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":1,"id":"api-179","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"General","name":"Calls an API typically used to copy file from one location to another","description":"\"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe\" called \"CopyFileW\" to copy C:\\da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe to new location C:\\Recovery\\tor.exe (UID: 00000000-00000364)\n \"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe\" called \"CopyFileW\" to copy C:\\da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe to new location C:\\TorService\\tor\\lsass.exe (UID: 00000000-00000364)\n \"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe\" called \"CopyFileW\" to copy C:\\da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe to new location C:\\Recovery\\ApplicationFrameHost.exe (UID: 00000000-00000364)","origin":"API Call","mitre_attack_id":"T1005","relevance":3,"id":"api-123","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe\" called \"CreateProcessW\" with parameter \"\"C:\\TorService\\tor\\lsass.exe\"\" - (UID: 00000000-00000364)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2d","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2e","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"General","name":"Can load assembly that contains the code that is currently executing (Dotnet)","description":"Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; Source: \"00000000-00000364.00000000.169808.04BF0000.00000004.mdmp\")\n Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; Source: \"00000000-00007272.00000000.170294.008C2000.00000002.mdmp, 00000000-00007272.00000000.170294.03160000.00000004.mdmp, 00000000-00007272.00000000.170294.03180000.00000004.mdmp, 00000000-00007272.00000000.170294.05600000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1620","relevance":1,"id":"string-615","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"141.8.197.42:80\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"SELECT * FROM Win32_Processor\" (Source: 00000000-00007272.00000000.170294.05600000.00000004.mdmp, Indicator: \"select * from win32_processor\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; File: \"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c\")\n Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00007272.00000000.170294.008C2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"General","name":"Contains ability to download files with network (Dotnet)","description":"Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadFile\" in \"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadData\" in \"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadString\" in \"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadFile\" in \"lsass.exe.bin\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadData\" in \"lsass.exe.bin\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadString\" in \"lsass.exe.bin\"","origin":"Static Parser","mitre_attack_id":"T1105","relevance":1,"id":"static-99","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"set_UseShellExecute\" (Indicator: \"ShellExecute\"; File: \"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c\")\n Found reference to API \"set_UseShellExecute\" (Indicator: \"ShellExecute\"; Source: \"00000000-00007272.00000000.170294.008C2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; File: \"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c\")\n Found reference to API \"OpenThread\" (Indicator: \"OpenThread\"; File: \"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c\")\n Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; Source: \"00000000-00007272.00000000.170294.008C2000.00000002.mdmp\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00007272.00000000.170294.008C2000.00000002.mdmp\")\n Found reference to API \"OpenThread\" (Indicator: \"OpenThread\"; Source: \"00000000-00007272.00000000.170294.008C2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"General","name":"Contains ability to set file attributes (Dotnet)","description":"$30","origin":"Static Parser","mitre_attack_id":"T1222","relevance":1,"id":"static-155","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"General","name":"Contains ability to start a process (Dotnet)","description":"Observed function \"Process.Start\" in \"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c\"\n Observed function \"Process.Start\" in \"lsass.exe.bin\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-111","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$31","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$32","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"General","name":"Dotnet code contains ability to modify/delete registry","description":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"SetValue\" in \"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"DeleteValue\" in \"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"CreateSubKey\" in \"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"SetValue\" in \"lsass.exe.bin\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"DeleteValue\" in \"lsass.exe.bin\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"CreateSubKey\" in \"lsass.exe.bin\"","origin":"Static Parser","mitre_attack_id":"T1112","relevance":1,"id":"static-139","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$33","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"lsass.exe.bin\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"General","name":"Found Native API in Dotnet file","description":"$34","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-101","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$35","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll\" at BC2F0000\n \"lsass.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll\" at BC2F0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at E30F0000\n \"lsass.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at E30D0000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at EB640000\n \"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at EA0A0000\n \"lsass.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at EB640000\n \"lsass.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at EA0A0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at BD8F0000\n \"lsass.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at BD8F0000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at EE090000\n \"lsass.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at EE090000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a000000000040c7c0eaff7f0000@ntdll.dll\"\n \"220023000000000018c7c0eaff7f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c\" was detected as \".NET Reactor\" and name: \"Protector\"\n \"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c\" was detected as \".NET\" and name: \"Library\"\n \"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c\" was detected as \"VB.NET\" and name: \"Compiler\"\n \"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"lsass.exe.bin\" was detected as \".NET Reactor\" and name: \"Protector\"\n \"lsass.exe.bin\" was detected as \".NET\" and name: \"Library\"\n \"lsass.exe.bin\" was detected as \"VB.NET\" and name: \"Compiler\"\n \"lsass.exe.bin\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$36","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"\n \"lsass.exe.bin\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","relevance":1,"id":"static-144","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c\" has an executable section named \".text\"\n \"lsass.exe.bin\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c\" has an writable section named \".sdata\"\n \"lsass.exe.bin\" has an writable section named \".sdata\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$37","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x101c00\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x101a94\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$38","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"a0950024.xsph.ru\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$39","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"lsass.exe\" (UID: 00000000-00007272)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"lsass.exe\" (UID: 00000000-00007272)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"General","name":"The input sample contains the RDTSCP instruction","description":"Found VM detection artifact \"RDTSCP trick\" in \"sample.bin\" (Offset: 971262)","origin":"Binary File","mitre_attack_id":"T1497","relevance":5,"id":"binary-26","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"lsass.exe.bin\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Installation/Persistence","name":"Attempts remote code execution into another process memory space","description":"\"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe\" called \"NtWriteVirtualMemory\" with parameters {\"ProcessHandle\": \"1760\"\n \"BaseAddress\": \"00D20000\"\n \"Buffer\": \"1DDB8220\"\n \"NumberOfBytesToWrite\": \"00000FB8\"\n \"$name\": \"C:\\\\TorService\\\\tor\\\\lsass.exe\"}\n \"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe\" called \"NtWriteVirtualMemory\" with parameters {\"ProcessHandle\": \"1760\"\n \"BaseAddress\": \"00B6D2D8\"\n \"Buffer\": \"1E4FD6F8\"\n \"NumberOfBytesToWrite\": \"00000008\"\n \"$name\": \"C:\\\\TorService\\\\tor\\\\lsass.exe\"}","origin":"API Call","mitre_attack_id":"T1055.002","relevance":1,"id":"api-315","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create a service (API string)","description":"Found reference to API \"CreateServiceW\" (Indicator: \"CreateService\"; Source: \"00000000-00007272.00000000.170294.1DD00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-199","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"lsass.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$3b","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$3c","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe\" queries basic process information of the \"C:\\da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe\" (UID: 364)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$3d","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"lsass.exe\" called \"NtQueueApcThread\" (UID: 00000000-00007272)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$3e","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)\n Matched sigs: The input sample contains the RDTSCP instruction","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$3f","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$40","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$41","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"$42","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe.log\"\n \"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe\" writes a file \"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0\\UsageLogs\\da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe.log\"\n \"lsass.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\lsass.exe.log\"\n \"lsass.exe\" writes a file \"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0\\UsageLogs\\lsass.exe.log\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00007272-00000C2B-1668946093\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate via sockets (Dotnet)","description":"$43","origin":"Static Parser","mitre_attack_id":"T1095","relevance":1,"id":"static-159","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00007272-00000C2B-1668945969\")\n Found reference to API \"WinHttpOpen\" (Indicator: \"WinHttpOpen\"; Source: \"00000000-00007272-00000C2B-1669150052\")\n Found reference to API \"WinHttpOpenW\" (Indicator: \"WinHttpOpen\"; Source: \"00000000-00007272-00000C2B-1669150081\")\n Found reference to API \"WinHttpConnect\" (Indicator: \"WinHttpConnect\"; Source: \"00000000-00007272.00000000.170294.1DD00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (Dotnet)","description":"$44","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-158","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Network Related","name":"Contains ability to provide interface for network protocols (Dotnet)","description":"Observed namespace \"System.Net\" in \"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c\"\n Observed namespace \"System.Net.Sockets\" in \"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c\"","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-110","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows HTTP services (API string)","description":"Found reference to API \"GetRequestStream\" (Indicator: \"GetRequestStream\"; File: \"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c\")\n Found reference to API \"GetRequestStream\" (Indicator: \"GetRequestStream\"; Source: \"00000000-00007272.00000000.170294.008C2000.00000002.mdmp\")\n Found reference to API \"WinHttpConnect\" (Indicator: \"WinHttpConnect\"; Source: \"00000000-00007272.00000000.170294.1DD00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-323","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"wsastartup\"; Source: \"00000000-00007272-00000C2B-1668945969\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"5.15.2.0\"\n \"192.168.0.2\"\n Potential IP \"4.0.0.0\" found in string \"ystem.Windows.Forms,4.0.0.0,,b77a5c561934e089\"\n Potential IP \"4.0.0.0\" found in string \"ion=4.0.0.0, Cul\"\n Potential IP \"4.0.0.0\" found in string \"=4.0.0.0\"\n \"2.5.29.10\"\n \"2.5.29.19\"\n \"2.5.29.14\"\n \"2.5.29.15\"\n \"2.5.29.37\"\n Potential IP \"10.0.0.0\" found in string \"cript,10.0.0.0,,\"\n \"0.0.0.0\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$45","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$46","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"a0950024.xsph.ru\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on process \"00000000-00007272\"\n YARA signature for AES encryption matched on process \"00000000-00000364\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Medium entropy File","description":"YARA signature to detect medium entropy file process \"00000000-00007272\"\n YARA signature to detect medium entropy file file \"sample.bin\"\n YARA signature to detect medium entropy file file \"lsass.exe.3680282933\"\n YARA signature to detect medium entropy file file \"ApplicationFrameHost.exe.bin\"\n YARA signature to detect medium entropy file file \"lsass.exe.bin\"\n YARA signature to detect medium entropy file file \"tor.exe.3967087168\"\n YARA signature to detect medium entropy file file \"tor.exe.bin\"\n YARA signature to detect medium entropy file file \"ApplicationFrameHost.exe.931681614\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":5,"id":"yara-606","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Remote Access Related","name":"Able to modify Remote Configuration","description":"Found string \"System.Runtime.Remoting\" (Source: \"00000000-00007272.00000000.170294.008C2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1021","relevance":1,"id":"string-940","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLE2BE3691352DD3DBEE7AC599D90F9]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00000364.00000000.169808.02A80000.00000004.mdmp\")\n Found string \"ncalrpc\" (Indicator: \"ncalrpc\"; Source: \"00000000-00007272.00000000.170294.02E28000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00000364.00000000.169808.02A80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to perform SQL operations","description":"Found string \"\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00000364.00000000.169808.04BF0000.00000004.mdmp\")\n Found string \"System.Data.SqlClient\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00000364.00000000.169808.04BF0000.00000004.mdmp\")\n Found string \"\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00007272.00000000.170294.05600000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve running process details (.NET)","description":"Found string \"GetProcessById\" (Source: \"00000000-00007272.00000000.170294.008C2000.00000002.mdmp\")\n Found string \"get_ProcessName\" (Source: \"00000000-00007272.00000000.170294.008C2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-931","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$47","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"lsass.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe\" called \"GetComputerNameW\" (UID: 00000000-00000364)\n \"lsass.exe\" called \"GetComputerNameW\" (UID: 00000000-00007272)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}\n \"lsass.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe\" called \"GetUserNameW\" (UID: 00000000-00000364)\n \"lsass.exe\" called \"GetUserNameW\" (UID: 00000000-00007272)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$48","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$49","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen information (Dotnet)","description":"Observed Namespace \"System.Windows.Forms::Screen\" and MemberReference \"get_AllScreens\" in \"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c\"\n Observed Namespace \"System.Windows.Forms::Screen\" and MemberReference \"get_PrimaryScreen\" in \"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c\"\n Observed Namespace \"System.Windows.Forms::Screen\" and MemberReference \"get_AllScreens\" in \"lsass.exe.bin\"\n Observed Namespace \"System.Windows.Forms::Screen\" and MemberReference \"get_PrimaryScreen\" in \"lsass.exe.bin\"","origin":"Static Parser","mitre_attack_id":"T1113","relevance":1,"id":"static-164","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to collect clipboard information (Dotnet)","description":"Observed Namespace \"System.Windows.Forms::Clipboard\" and MemberReference \"GetText\" in \"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c\"\n Observed Namespace \"System.Windows.Forms::Clipboard\" and MemberReference \"GetText\" in \"lsass.exe.bin\"","origin":"Static Parser","mitre_attack_id":"T1056.001","relevance":1,"id":"static-163","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to gather process details (Dotnet)","description":"Observed function \"GetProcessById\" in \"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c\"\n Observed function \"get_ProcessName\" in \"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c\"\n Observed function \"GetProcessesByName\" in \"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c\"\n Observed function \"GetProcessById\" in \"lsass.exe.bin\"\n Observed function \"get_ProcessName\" in \"lsass.exe.bin\"\n Observed function \"GetProcessesByName\" in \"lsass.exe.bin\"","origin":"Static Parser","mitre_attack_id":"T1057","relevance":1,"id":"static-100","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to register/read input devices (API string)","description":"Found reference to API \"mouse_event\" (Indicator: \"mouse_event\"; File: \"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c\")\n Found reference to API \"mouse_event\" (Indicator: \"mouse_event\"; Source: \"00000000-00007272.00000000.170294.008C2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056","relevance":1,"id":"string-403","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetTempPath\" (Indicator: \"GetTempPath\"; File: \"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c\")\n Found reference to API \"GetTempFileName\" (Indicator: \"GetTempFileName\"; Source: \"00000000-00000364.00000000.169808.04BF0000.00000004.mdmp\")\n Found reference to API \"GetTempPath\" (Indicator: \"GetTempPath\"; Source: \"00000000-00007272.00000000.170294.008C2000.00000002.mdmp\")\n Found reference to API \"GetTempFileName\" (Indicator: \"GetTempFileName\"; Source: \"00000000-00007272.00000000.170294.03160000.00000004.mdmp, 00000000-00007272.00000000.170294.05600000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve user privileges (API string)","description":"Found reference to API \"IsInRole\" (Indicator: \"IsInRole\"; File: \"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c\")\n Found reference to API \"IsInRole\" (Indicator: \"IsInRole\"; Source: \"00000000-00007272.00000000.170294.008C2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-217","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"passwordFormat\" (Indicator: \"password\"; Source: \"00000000-00000364.00000000.169808.04BF0000.00000004.mdmp\")\n Found string \"passwordAttemptWindow\" (Indicator: \"password\"; Source: \"00000000-00000364.00000000.169808.04BF0000.00000004.mdmp\")\n Found string \"passwordStrengthRegularExpression\" (Indicator: \"password\"; Source: \"00000000-00000364.00000000.169808.04BF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"lsass.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0000\"; Key: \"HARDWAREINFORMATION.ADAPTERSTRING\")\n \"lsass.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0000\"; Key: \"HARDWAREINFORMATION.QWMEMORYSIZE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"Found string \"SELECT * FROM Win32_Processor\" (Indicator: \" Win32_Process\"; Source: \"00000000-00007272.00000000.170294.05600000.00000004.mdmp\")\n Found string \"SELECT * FROM Win32_Processor\" (Indicator: \" Win32_Processor\"; Source: \"00000000-00007272.00000000.170294.05600000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00000364-00000C2B-1653852388\")\n Found string \"OpenProcessTokenW\" (Indicator: \"OpenProcess\"; Source: \"00000000-00000364-00000C2B-1656007442\")\n Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00000364-00000C2B-1656679700\")\n Found string \"OpenProcessW\" (Indicator: \"OpenProcess\"; Source: \"00000000-00000364-00000C2B-1656679723\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00000364)\n \"lsass.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00007272)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\HarddiskVolume2\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll\" (Indicator: \"\\Device\\\"; Source: \"00000000-00000364.00000000.169808.02A80000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00000364.00000000.169808.02A80000.00000004.mdmp\")\n Found string \"\\device\\mup\\\" (Indicator: \"\\Device\\\"; Source: \"00000000-00000364.00000000.169808.02A80000.00000004.mdmp\")\n Found string \"C:\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00007272.00000000.170294.02EDF000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00000364.00000000.169808.04BF0000.00000004.mdmp\")\n Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00007272.00000000.170294.05600000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00007272-00000C2B-1670036539","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"lsass.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe\" opened \"\\Device\\KsecDD\"\n \"lsass.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$4b","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; Source: \"00000000-00007272.00000000.170294.1DD00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to multiple windows system processes","description":"Found strings \"smss.exe,lsass.exe,csrss.exe,wininit.exe,winlogon.exe\" (Source: \"00000000-00007272.00000000.170294.05600000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":3,"id":"string-455","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe.log\" - Location: [%LOCALAPPDATA%\\Microsoft\\CLR_v4.0\\UsageLogs\\da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe.log]- [targetUID: 00000000-00000364]\n Dropped file: \"lsass.exe.log\" - Location: [%LOCALAPPDATA%\\Microsoft\\CLR_v4.0\\UsageLogs\\lsass.exe.log]- [targetUID: 00000000-00007272]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"\n \"lsass.exe.bin\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"\"RuntimeBroker.exe\" (Indicator: \"runtimebroker.exe\")\n \"backgroundTaskHost.exe\" (Indicator: \"backgroundtaskhost.exe\")","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"lsass.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 364)\n \"lsass.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 7272)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c\" has section name .text with entropy \"6.711162761394533\"\n \"lsass.exe.bin\" has section name .text with entropy \"6.711162761394533\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"suspicious","category":"Environment Awareness","name":"Able to retrieve open application windows","description":"Observed API \"GetForegroundWindow\" in \"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c\"\n Observed API \"GetWindowText\" in \"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c\"\n Observed API \"GetForegroundWindow\" in \"lsass.exe.bin\"\n Observed API \"GetWindowText\" in \"lsass.exe.bin\"","origin":"Static Parser","mitre_attack_id":"T1010","relevance":1,"id":"static-222","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"suspicious","category":"Environment Awareness","name":"Executes WMI queries known to be used for VM detection","description":"\"lsass.exe\" issued a query \"SELECT * FROM Win32_Processor\"\n \"lsass.exe\" issued a query \"SELECT * FROM Win32_VideoController\"\n \"lsass.exe\" issued a query \"SELECT * FROM Win32_BaseBoard\"\n \"lsass.exe\" issued a query \"SELECT * FROM Win32_BIOS\"\n \"lsass.exe\" issued a query \"SELECT * FROM Win32_ComputerSystem\"","origin":"API Call","mitre_attack_id":"T1047","relevance":10,"id":"api-57","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a reference to a WMI query string known to be used for VM detection","description":"\"SELECT * FROM Win32_Processor\" (Indicator: \" win32_process\"; Source: \"00000000-00007272.00000000.170294.05600000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-55","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"17/26 Antivirus vendors marked sample as malicious (65% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe\" reads file \"C:\\Users\\%OSUSER%\\Documents\\desktop.ini\"\n \"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe\" reads file \"C:\\Users\\%OSUSER%\\Music\\desktop.ini\"\n \"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe\" reads file \"C:\\Users\\%OSUSER%\\Pictures\\desktop.ini\"\n \"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe\" reads file \"C:\\Users\\%OSUSER%\\Videos\\desktop.ini\"\n \"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe\" reads file \"C:\\Users\\%OSUSER%\\Downloads\\desktop.ini\"\n \"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe\" reads file \"C:\\Users\\%OSUSER%\\OneDrive\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"lsass.exe.bin\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows 4 sections\"- [targetUID: N/A]\n \"tor.exe.bin\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows 4 sections\"- [targetUID: N/A]\n \"lsass.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows 4 sections\"- Location: [C:\\TorService\\tor\\lsass.exe]- [targetUID: 00000000-00007272]\n \"ApplicationFrameHost.exe.bin\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows 4 sections\"- [targetUID: N/A]\n \"tor.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows 4 sections\"- Location: [C:\\Recovery\\tor.exe]- [targetUID: 00000000-00000364]\n \"ApplicationFrameHost.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows 4 sections\"- Location: [C:\\Recovery\\ApplicationFrameHost.exe]- [targetUID: 00000000-00000364]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"$4c","origin":"Registry Access","mitre_attack_id":"T1547.001","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 141.8.197.42 on port 80 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – Anomalous PE file structure","description":"YARA signature for invalid number of Rva and Size of PE file \"sample.bin\"\n YARA signature for invalid number of Rva and Size of PE file \"lsass.exe.3680282933\"\n YARA signature for invalid number of Rva and Size of PE file \"ApplicationFrameHost.exe.bin\"\n YARA signature for invalid number of Rva and Size of PE file \"lsass.exe.bin\"\n YARA signature for invalid number of Rva and Size of PE file \"tor.exe.3967087168\"\n YARA signature for invalid number of Rva and Size of PE file \"tor.exe.bin\"\n YARA signature for invalid number of Rva and Size of PE file \"ApplicationFrameHost.exe.931681614\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":1,"id":"yara-153","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"WmiPrvSE.exe\" (Indicator: \"wmiprvse.exe\"; in Source: \"00000000-00007272.00000000.170294.05600000.00000004.mdmp\")\n Found string \"root\\CIMV2\" (Indicator: \"root\\cimv2\"; in Source: \"00000000-00007272.00000000.170294.05600000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops a text file that contains suspicious strings (e.g. shell/ActiveX/DOM related)","description":"\"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe.log\" contains indicator \".Run\" (Line: 10; Offset: 9)","origin":"Binary File","mitre_attack_id":"T1105","relevance":8,"id":"binary-4","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops binary executable file with an unexpected extension","description":"\"lsass.exe.bin\" has unusual extension\n \"tor.exe.bin\" has unusual extension\n \"ApplicationFrameHost.exe.bin\" has unusual extension","origin":"Binary File","mitre_attack_id":"T1036.008","relevance":3,"id":"binary-75","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"Delete\" (Source: da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c, API is part of module: WMINET_UTILS.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a fake system process","description":"Process \"lsass.exe\" at non-system pathway \"C:\\TorService\\tor\\lsass.exe\" (UID: 00000000-00007272)\n Process \"lsass.exe\" at non-system pathway \"C:\\TorService\\tor\\lsass.exe\" (UID: 00000000-00004668)","origin":"Monitored Target","mitre_attack_id":"T1036.005","relevance":10,"id":"target-33","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe\" called \"CreateProcessW\" with parameter \"\"C:\\TorService\\tor\\lsass.exe\"\" - (UID: 00000000-00000364)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Found a system process name at an unusual pathway","description":"Process \"lsass.exe\" has a system process name but is not located in a Windows (sub-)directory (UID: 00000000-00007272)\n Process \"lsass.exe\" has a system process name but is not located in a Windows (sub-)directory (UID: 00000000-00004668)","origin":"Monitored Target","mitre_attack_id":"T1036.005","relevance":3,"id":"target-94","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Script loads executable in memory (Antimalware Scan Interface)","description":"$4d","origin":"Windows Antimalware Scan Interface","mitre_attack_id":"T1055.001","relevance":10,"id":"amsi-3","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"malicious","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET MALWARE DCRAT Activity (GET)\" (SID: 2034194, Rev: 5, Severity: 1) categorized as \"A Network Trojan was detected\" (PUA/PUP/Adware)","origin":"Suricata Alerts","relevance":10,"id":"suricata-2","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"17/26 Antivirus vendors marked sample as malicious (65% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"17/26 Antivirus vendors marked dropped file \"lsass.exe.bin\" as malicious (classified as \"MSIL.Stealer\" with 65% detection rate)\n 17/26 Antivirus vendors marked dropped file \"tor.exe.bin\" as malicious (classified as \"MSIL.Stealer\" with 65% detection rate)\n 17/26 Antivirus vendors marked dropped file \"lsass.exe\" as malicious (classified as \"MSIL.Stealer\" with 65% detection rate)\n 17/26 Antivirus vendors marked dropped file \"ApplicationFrameHost.exe.bin\" as malicious (classified as \"MSIL.Stealer\" with 65% detection rate)\n 17/26 Antivirus vendors marked dropped file \"tor.exe\" as malicious (classified as \"MSIL.Stealer\" with 65% detection rate)\n 17/26 Antivirus vendors marked dropped file \"ApplicationFrameHost.exe\" as malicious (classified as \"MSIL.Stealer\" with 65% detection rate)","origin":"Binary File","mitre_attack_id":"T1204.002","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"17/26 Antivirus vendors marked spawned process \"lsass.exe\" (PID: 7272) as malicious (classified as \"MSIL.Stealer\" with 65% detection rate)","origin":"Monitored Target","mitre_attack_id":"T1204.002","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe\" wrote 00000FB8 bytes to a remote process \"C:\\TorService\\tor\\lsass.exe\" (Handle: 1760)\n \"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe\" wrote 00000008 bytes to a remote process \"C:\\TorService\\tor\\lsass.exe\" (Handle: 1760)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Opens a handle of credential dumping utility","description":"\"lsass.exe\" opens a process \"C:\\TorService\\tor\\lsass.exe\" (UID: 00000000-00007272)\n \"lsass.exe\" opens a process \"C:\\Windows\\System32\\lsass.exe\" (UID: 00000000-00007272)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-300","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"malicious","category":"System Security","name":"Executes WMI queries in order to detect local security applications","description":"\"lsass.exe\" issued a query \"SELECT * FROM AntivirusProduct\"\n \"lsass.exe\" issued a query \"SELECT * FROM FirewallProduct\"","origin":"API Call","mitre_attack_id":"T1518.001","relevance":7,"id":"api-80","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe\" (UID: 00000000-00000364)\n Spawned process \"lsass.exe\" (UID: 00000000-00007272)\n Spawned process \"tor.exe\" (UID: 00000000-00005520)\n Spawned process \"ApplicationFrameHost.exe\" (UID: 00000000-00007180)\n Spawned process \"lsass.exe\" (UID: 00000000-00004668)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"name":"Persistence","details_count":5,"details":[{"detail":"Writes data to a remote process"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Spawns a lot of processes"},{"detail":"Creates a fake system process"},{"detail":"Tries to modify winlogon helper dll registry key to achieve persistence"}],"sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"name":"Fingerprint","details_count":5,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Executes WMI queries in order to detect local security applications"},{"detail":"Queries process information"},{"detail":"Queries sensitive IE security settings"},{"detail":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"name":"Evasive","details_count":3,"details":[{"detail":"Executes WMI queries known to be used for VM detection"},{"detail":"Found a reference to a WMI query string known to be used for VM detection"},{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]}]},"activity":{"stats":{"process_count":5,"spawned_processes_count":5,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":23,"imported_dlls_count":98,"dropped_files_count":0,"extracted_files_count":14,"files_written_count":18,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["windows-server-utility","evasive"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","TOR analysis"],"sandbox_reports":[{"id":"68a9b2ed1760ef2db803b894","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["RUS"],"submit_name":"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c","analysis_start_time":"2025-08-23T12:24:14+00:00","indicators_count":{"informative":183,"suspicious":52,"malicious":14},"tags":["Multi-Process","Network Traffic","Extracted Files","TOR analysis"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"141.8.197.42","port":80,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]}],"dns_resolutions":[{"domain":"a0950024.xsph.ru","address":"141.8.197.42","ttl":7200,"country":"Russian Federation","registrar_name":"REGTIME-RU","registrar_organization":"SPRINTHOST.RU LLC","registrar_name_servers":"ns2.sprinthost.ru.","registrar_creation_date":"2008-07-30T20:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}],"processes":[{"pid":364,"ppid":0,"name":"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe","command_line":"","sha256":"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c","normalized_path":"C:\\da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe","uid":"00000000-00000364","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":7272,"ppid":364,"name":"lsass.exe","command_line":"","sha256":"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c","normalized_path":"C:\\TorService\\tor\\lsass.exe","parent_uid":"00000000-00000364","uid":"00000000-00007272"},{"pid":5520,"ppid":0,"name":"tor.exe","command_line":"","sha256":"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c","normalized_path":"C:\\Recovery\\tor.exe","uid":"00000000-00005520","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":7180,"ppid":0,"name":"ApplicationFrameHost.exe","command_line":"","sha256":"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c","normalized_path":"C:\\Recovery\\ApplicationFrameHost.exe","uid":"00000000-00007180","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":4668,"ppid":0,"name":"lsass.exe","command_line":"","sha256":"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c","normalized_path":"C:\\TorService\\tor\\lsass.exe","uid":"00000000-00004668","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="}],"all_imported_dlls":["userenv.dll","rpcrt4.dll","wldp.dll","V5n6b23u.dll","fastprox.dll","msIso.dll","kernel.appcore.dll","vcruntime140_clr0400.dll","ucrtbase_clr0400.dll","System.Windows.Forms.ni.dll","System.Management.ni.dll","WMINet_Utils.dll","System.Runtime.Serialization.ni.dll","iertutil.dll","advapi32.dll","shlwapi.dll","cryptsp.dll","psapi.dll","System.Core.ni.dll","powrprof.dll","gpapi.dll","wbemprox.dll","apphelp.dll","bcryptprimitives.dll","cfgmgr32.dll","MpOAV.dll","sppc.dll","wbemcomn.dll","dnsapi.dll","nsi.dll","System.Drawing.ni.dll","crypt32.dll","urlmon.dll","rasman.dll","rtutils.dll","kernel32.dll","ws2_32.dll","msvcrt.dll","oleaut32.dll","shell32.dll","Windows.StateRepositoryPS.dll","dhcpcsvc6.dll","winhttp.dll","combase.dll","clr.dll","clbcatq.dll","MpClient.dll","rasadhlp.dll","FWPUCLNT.DLL","ucrtbase.dll","user32.dll","gdi32full.dll","profapi.dll","ntmarta.dll","wmiutils.dll","rasapi32.dll","System.Configuration.ni.dll","System.Xml.ni.dll","windows.storage.dll","msasn1.dll","mscoreei.dll","mscoree.dll","clrjit.dll","System.ni.dll","msvcp_win.dll","cldapi.dll","aepic.dll","winsta.dll","fltLib.dll","ole32.dll","cryptbase.dll","propsys.dll","edputil.dll","imagehlp.dll","dhcpcsvc.dll","KernelBase.dll","imm32.dll","mscorlib.ni.dll","win32u.dll","gdi32.dll","sechost.dll","uxtheme.dll","sspicli.dll","slc.dll","IPHLPAPI.DLL","winnsi.dll","VxSSL64.dll","wintrust.dll","wbemsvc.dll","wtsapi32.dll","mswsock.dll","OnDemandConnRouteHelper.dll","ntdll.dll","version.dll","SHCore.dll","bcrypt.dll","rsaenh.dll","amsi.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"ApplicationFrameHost.exe","sha256":"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"name":"tor.exe","sha256":"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"name":"lsass.exe","sha256":"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"name":"lsass.exe.bin","sha256":"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"name":"tor.exe.bin","sha256":"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"name":"ApplicationFrameHost.exe.bin","sha256":"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"name":"da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe.log","sha256":"474a0a6e58ed53804bba5e3adc1131ed83871f52cdbab0d9523de1fb9bdc006b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"name":"lsass.exe.log","sha256":"b1b73ccf12809fce2d976a8ac2b9ae0770a5fd7f70e7e93da8695381eb70e295","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"name":"6dd19aba3e2428","sha256":"b181ac3ae442a15ecd635e46006f79a716d4da16a697d1100f8d0995fb516394","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"name":"d2afed7e6d557d","sha256":"37928f142e72b3001b4193d645b59c48a7a712bbf50c0b91c3ae8571e800bd0c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"name":"6203df4a6bafc7","sha256":"0f81f39d10adf335c203cf622f2ebfa04d250372adb5c516dcc9c0caf88d7ac4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"name":"ApplicationFrameHost.exe%3AZone.Identifier","sha256":"1409cc4125f7e08d09a731da789dc35c09afa8e716c00ad22d9f3f1b17a2cb33","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"name":"lsass.exe%3AZone.Identifier","sha256":"1409cc4125f7e08d09a731da789dc35c09afa8e716c00ad22d9f3f1b17a2cb33","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"name":"tor.exe%3AZone.Identifier","sha256":"1409cc4125f7e08d09a731da789dc35c09afa8e716c00ad22d9f3f1b17a2cb33","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"path":"C:\\Recovery\\tor.exe","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"path":"C:\\Recovery\\tor.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"path":"C:\\Recovery\\d2afed7e6d557d","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"path":"C:\\TorService\\tor\\lsass.exe","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"path":"C:\\TorService\\tor\\lsass.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"path":"C:\\TorService\\tor\\6203df4a6bafc7","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"path":"C:\\Recovery\\ApplicationFrameHost.exe","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"path":"C:\\Recovery\\ApplicationFrameHost.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"path":"C:\\Recovery\\6dd19aba3e2428","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0\\UsageLogs\\da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c.exe.log","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D03DB0C1-2729-4674-A875-8625DD784300}","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{3FC98E00-C370-43D9-A2DC-B067CC06FAD9}","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0\\UsageLogs\\lsass.exe.log","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:364:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:364:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\8fb4c81bf54f650e17fea326f5282c40e7fb0e47","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"name":"SM0:364:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"name":"Local\\SM0:364:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"name":"Local\\SM0:364:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"name":"8fb4c81bf54f650e17fea326f5282c40e7fb0e47","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"name":"SM0:364:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:364:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"name":"\\BaseNamedObjects\\SyncRootManager","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:364:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7272:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"name":"Local\\SM0:7272:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"name":"Global\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"name":"SM0:7272:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"name":"SM0:7272:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7272:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7272:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"68a9b2ed1760ef2db803b894"}]}]}},"report_ids":{"sandbox_job_ids":["68a9b2ed1760ef2db803b894"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Ransom.Prometheus.Generic Sample da0812e23452… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample da0812e23452…. Malware family: Ransom.Prometheus.Generic. Threat score 100/100. 18/27 AV engines flagged this file. 12 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c"}],["$","meta","4",{"property":"og:title","content":"Malicious Ransom.Prometheus.Generic Sample da0812e23452… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample da0812e23452…. Malware family: Ransom.Prometheus.Generic. Threat score 100/100. 18/27 AV engines flagged this file. 12 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/da0812e23452fddd5fdd646d72a9558bed67337dbac56701e4558d0cad39fc4c"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Ransom.Prometheus.Generic Sample da0812e23452… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample da0812e23452…. Malware family: Ransom.Prometheus.Generic. Threat score 100/100. 18/27 AV engines flagged this file. 12 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L4e","11",{}]]