24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 38:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T47f,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Mikey.Generic Sample e92d3a6d96b7… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample e92d3a6d96b7…. Malware family: Mikey.Generic. Threat score 100/100. 19/24 AV engines flagged this file. 7 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99","keywords":["Malicious","Mikey.Generic","malware analysis","sandbox report","threat intelligence","e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99"],"about":{"@type":"SoftwareApplication","name":"file.exe","applicationCategory":["peexe","executable"],"identifier":"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Mikey.Generic","antivirusDetections":{"malicious":19,"total":24},"behavioralIndicators":{"malicious":7,"suspicious":14},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T1d8e,"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000048d81601ecd71601226e11750000ef04000000002d6e1175ea0c02ac2d000000ecb7517670d8160100002803f8dd470338b046031400000080000000b0d716010000280334d8160170c81275feaa03d8feffffff2d000000d0cc60762700000004d81601856a13751c23187544d81601f85f137508000000bb691275b2691275420302ac2d000000ecb7517627000000d0cc607618d816012d000000d0cc60762700000048d81601856a13751c23187590d816017e8a5f76ee8c5f76738a5f763170d2742d000000ecb7517627000000d0cc60762c11ef04c010ef043170d27458d81601fc529d7644d91601e0845f7699595f03feffffff738a5f76 (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff0000000068c2590538cfe47774254603d4c2590501000000282546037425460328254603040000000400000000e0c97400100000d4c259050100000028254603cd97e4779c97e477572d3cfbb50fc074282546030000e477000000002420706f0000000080eec6740100000000000000f8e2c974000000000400000080a979744840c874f8e2c974d8c2590580e85575a00b470380e85575d4c259050000000080e8557500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000be174f03d4174f03 (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000aea84f03c6a84f03 (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000007eb54f0392b54f03 (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000009eba4f03b6ba4f03 (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000beb94f03d4b94f03 (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000009ec64f03b6c64f03 (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000046e74f035ee74f03 (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007684)26:T649,"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\cmd.exe" /C mkdir %WINDIR%\SysWOW64\pualhduo\" - (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\cmd.exe" /C move /Y "%TEMP%\bexiirss.exe" %WINDIR%\SysWOW64\pualhduo\" - (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\sc.exe" create pualhduo binPath= "%WINDIR%\SysWOW64\pualhduo\bexiirss.exe /d\"C:\e92d3a6d96b7eecbd2d2bc94c7" - (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\sc.exe" description pualhduo "wifi internet conection"" - (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\sc.exe" start pualhduo" - (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow prog" - (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "CreateProcessA" with parameter ""%USERPROFILE%\krupoiic.exe" /d"C:\e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe"" - (UID: 00000000-00007684)27:T12f3,"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "LoadLibrary" with a parameter msimg32.dll (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "LoadLibrary" with a parameter dbghelp.dll (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "LoadLibrary" with a parameter msvcr100.dll (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00007684) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007864) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007864) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007864) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007864) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005496) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005496) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005496) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005496) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005272) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005272) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005272) "sc.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005272) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005080) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005080) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005080) "sc.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005080) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000680) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000680) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000680) "sc.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000680) "krupoiic.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008768) "krupoiic.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008768) "krupoiic.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008768) "krupoiic.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008768) "krupoiic.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00008768) "krupoiic.exe" called "LoadLibrary" with a parameter msimg32.dll (UID: 00000000-00008768)28:Td1ad,"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter IsProcessorFeaturePresent (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter GlobalAlloc (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter Module32First (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter VirtualFree (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter GetVersionExA (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter TerminateProcess (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter SetErrorMode (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter StackWalk64 (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter GetVolumeInformationA (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter GetComputerNameA (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter GetTickCount (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter GetModuleHandleA (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter lstrcmpiA (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter lstrlenA (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter lstrcpynA (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter InterlockedExchange (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter GetOverlappedResult (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter DisconnectNamedPipe (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter ConnectNamedPipe (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter CreateNamedPipeA (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableA (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter DeleteFileA (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter IsBadWritePtr (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter IsBadCodePtr (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter lstrcpyA (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter lstrcmpA (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter IsBadReadPtr (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter WriteProcessMemory (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter VirtualAllocEx (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter SetFileAttributesA (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter GetDiskFreeSpaceA (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter GetWindowsDirectoryA (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter GetFileAttributesExA (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter CreateProcessA (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter GetTempPathA (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter SystemTimeToFileTime (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter GetSystemTime (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter DeviceIoControl (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter GetModuleFileNameA (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter SetThreadContext (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter lstrcatA (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter CreateThread (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter GetDriveTypeA (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter GetCommandLineA (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter SetUnhandledExceptionFilter (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter InterlockedIncrement (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter GetLocalTime (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter FileTimeToLocalFileTime (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter FileTimeToSystemTime (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter InterlockedDecrement (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter HeapSize (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter GetSystemTimeAsFileTime (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter MultiByteToWideChar (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter lstrlenW (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter GetStartupInfoW (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter GetProcessHeap (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter HeapAlloc (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter HeapReAlloc (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter HeapFree (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter CreateEventA (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter GetSystemDirectoryA (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter wsprintfA (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter CharToOemA (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidA (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter CreateProcessWithLogonW (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter RegCreateKeyExA (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter StartServiceCtrlDispatcherA (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter RegisterServiceCtrlHandlerA (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter SetServiceStatus (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter RegDeleteValueA (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter RegGetKeySecurity (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter RegSetKeySecurity (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter RegSetValueExA (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter GetLengthSid (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter GetFileSecurityA (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter GetSecurityDescriptorOwner (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorOwner (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter SetFileSecurityA (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter GetSecurityDescriptorDacl (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter GetAce (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter DeleteAce (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter RegEnumKeyA (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter RegOpenKeyExA (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter RegEnumValueA (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter LookupAccountNameW (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter LookupAccountNameA (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter GetUserNameA (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter ShellExecuteA (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter ShellExecuteExW (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter atexit (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter GetSystemWow64DirectoryA (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "GetProcAddress" with a parameter _allmul (UID: 00000000-00007684) "cmd.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007864) "cmd.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007864) "cmd.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007864) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007864) "cmd.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007864) "cmd.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007864) "cmd.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007864) "cmd.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007864) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007864) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007864) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007864) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007864) "cmd.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007864) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007864) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007864) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007864) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007864) "cmd.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007864) "cmd.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007864) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007864) "cmd.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007864) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007864) "cmd.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007864) "cmd.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007864) "cmd.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007864) "cmd.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007864) "cmd.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007864) "cmd.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007864) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007864) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007864) "cmd.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007864) "cmd.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007864) "cmd.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007864) "cmd.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007864) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007864) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007864) "cmd.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007864) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007864) "cmd.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007864) "cmd.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007864) "cmd.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007864) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007864) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007864) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007864) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007864) "cmd.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005496) "cmd.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005496) "cmd.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005496) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005496) "cmd.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005496) "cmd.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005496) "cmd.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005496) "cmd.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005496) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005496) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005496) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005496) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005496) "cmd.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005496) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005496) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005496) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005496) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005496) "cmd.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005496) "cmd.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005496) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005496) "cmd.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005496) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005496) "cmd.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005496) "cmd.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005496) "cmd.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005496) "cmd.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005496) "cmd.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005496) "cmd.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005496) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005496) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005496) "cmd.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005496) "cmd.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005496) "cmd.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005496) "cmd.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005496) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005496) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005496) "cmd.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005496) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005496) "cmd.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005496) "cmd.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005496) "cmd.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005496) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005496) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005496) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005496) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005496) "sc.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005272) "sc.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005272) "sc.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005272) "sc.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005272) "sc.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005272) "sc.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005272) "sc.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005272) "sc.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005272) "sc.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005272) "sc.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005272) "sc.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005272) "sc.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005272) "sc.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005272) "sc.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005272) "sc.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005272) "sc.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005272) "sc.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005272) "sc.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005272) "sc.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005272) "sc.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005272) "sc.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005272) "sc.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005272) "sc.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005272) "sc.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005272) "sc.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005272) "sc.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005272) "sc.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005272) "sc.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005272) "sc.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005272) "sc.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005272) "sc.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005272) "sc.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005272) "sc.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005272) "sc.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005272) "sc.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005272) "sc.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005272) "sc.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005272) "sc.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005272) "sc.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005272) "sc.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005272) "sc.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005272) "sc.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005272) "sc.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005272) "sc.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005272) "sc.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005272) "sc.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005080) "sc.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005080) "sc.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005080) "sc.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005080) "sc.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005080) "sc.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005080) "sc.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005080) "sc.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005080) "sc.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005080) "sc.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005080) "sc.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005080) "sc.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005080) "sc.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005080) "sc.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005080) "sc.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005080) "sc.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005080) "sc.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005080) "sc.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005080) "sc.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005080) "sc.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005080) "sc.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005080) "sc.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005080) "sc.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005080) "sc.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005080) "sc.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005080) "sc.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005080) "sc.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005080) "sc.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005080) "sc.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005080) "sc.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005080) "sc.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005080) "sc.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005080) "sc.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005080) "sc.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005080) "sc.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005080) "sc.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005080) "sc.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005080) "sc.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005080) "sc.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005080) "sc.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005080) "sc.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005080) "sc.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005080) "sc.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005080) "sc.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005080) "sc.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005080) "sc.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00000680) "sc.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00000680) "sc.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00000680) "sc.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000680) "sc.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00000680) "sc.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00000680) "sc.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00000680) "sc.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00000680) "sc.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00000680) "sc.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00000680) "sc.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00000680) "sc.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00000680) "sc.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00000680) "sc.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00000680) "sc.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00000680) "sc.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00000680) "sc.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00000680) "sc.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00000680) "sc.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00000680) "sc.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00000680) "sc.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00000680) "sc.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00000680) "sc.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00000680) "sc.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00000680) "sc.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00000680) "sc.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00000680) "sc.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00000680) "sc.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00000680) "sc.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00000680) "sc.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00000680) "sc.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00000680) "sc.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00000680) "sc.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00000680) "sc.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00000680) "sc.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00000680) "sc.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00000680) "sc.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00000680) "sc.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00000680) "sc.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00000680) "sc.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00000680) "sc.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00000680) "sc.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00000680) "sc.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00000680) "sc.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00000680) "sc.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00000680) "krupoiic.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00008768) "krupoiic.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00008768) "krupoiic.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00008768) "krupoiic.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00008768) "krupoiic.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00008768) "krupoiic.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00008768) "krupoiic.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00008768) "krupoiic.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00008768) "krupoiic.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00008768) "krupoiic.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00008768) "krupoiic.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00008768) "krupoiic.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00008768) "krupoiic.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00008768) "krupoiic.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00008768) "krupoiic.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00008768) "krupoiic.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00008768) "krupoiic.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00008768) "krupoiic.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00008768) "krupoiic.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00008768) "krupoiic.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00008768) "krupoiic.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00008768) "krupoiic.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00008768) "krupoiic.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00008768) "krupoiic.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00008768) "krupoiic.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00008768) "krupoiic.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00008768) "krupoiic.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00008768) "krupoiic.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00008768) "krupoiic.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00008768) "krupoiic.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00008768) "krupoiic.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00008768) "krupoiic.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00008768) "krupoiic.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00008768) "krupoiic.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00008768) "krupoiic.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00008768) "krupoiic.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00008768) "krupoiic.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00008768) "krupoiic.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00008768) "krupoiic.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00008768) "krupoiic.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00008768) "krupoiic.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00008768) "krupoiic.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00008768) "krupoiic.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00008768) "krupoiic.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00008768) "krupoiic.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00008768) "krupoiic.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00008768) "krupoiic.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00008768) "krupoiic.exe" called "GetProcAddress" with a parameter IsProcessorFeaturePresent (UID: 00000000-00008768) "krupoiic.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00008768)29:T7a3d,Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "FindNextFileA"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "GetFileType"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "SetLastError"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "OpenFileMappingW"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "TlsFree"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "AddConsoleAliasW"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "AddAtomW"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "RaiseException"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "FoldStringA"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "GetSystemWindowsDirectoryA"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "ReadConsoleInputA"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "IsDebuggerPresent"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "GetTickCount"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "EnumSystemCodePagesW"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "BeginUpdateResourceA"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "HeapAlloc"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "SetStdHandle"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "IsValidCodePage"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "DeleteCriticalSection"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "HeapReAlloc"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "GetCommandLineA"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "GetProcAddress"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "AssignProcessToJobObject"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "TlsAlloc"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "GetStringTypeW"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "GetEnvironmentStrings"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "LCMapStringA"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "FreeEnvironmentStringsA"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "WriteConsoleA"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "RemoveDirectoryA"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "GetCommMask"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "ReadConsoleOutputCharacterW"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "EndUpdateResourceW"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "EnterCriticalSection"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "LCMapStringW"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "PeekNamedPipe"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "GetCompressedFileSizeA"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "CloseHandle"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "HeapSize"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "WriteFile"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "GlobalAlloc"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "GetStringTypeA"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "SetVolumeMountPointA"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "LoadResource"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "ReadFile"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "VirtualAlloc"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "GetOEMCP"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "SetFilePointer"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "FillConsoleOutputCharacterA"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "GetStartupInfoA"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "RtlUnwind"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "GetLastError"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "SetEndOfFile"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "GetWindowsDirectoryW"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "SetHandleCount"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "TlsSetValue"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "GetCPInfo"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "GetFileAttributesW"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "CreateActCtxA"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "GlobalFindAtomW"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "GetLocaleInfoA"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "GetConsoleMode"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "FindNextVolumeW"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "GetProcessHeap"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "TlsGetValue"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "VirtualFree"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "GetModuleHandleA"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "ExitProcess"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "HeapFree"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "WriteConsoleW"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "GetACP"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "MultiByteToWideChar"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "FlushFileBuffers"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "CreateHardLinkW"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "GlobalFree"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "InterlockedIncrement"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "InterlockedCompareExchange"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "InterlockedDecrement"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "WideCharToMultiByte"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "PeekConsoleInputA"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "SetComputerNameA"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "TerminateProcess"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "GetNumberFormatA"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "Sleep"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "SetProcessPriorityBoost"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "GetConsoleCP"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "GetStdHandle"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "LeaveCriticalSection"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "BeginUpdateResourceW"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "HeapCreate"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "GetModuleFileNameA"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "CreateFileA"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "LoadLibraryW"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "LoadMenuW"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "CharToOemBuffA"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "GetWindowTextLengthW"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "EncodePointer"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "DecodePointer"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "FlsFree"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "FlsSetValue"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "FlsGetValue"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "FlsAlloc"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "GetProcessWindowStation"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "GetUserObjectInformationA"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "GetLastActivePopup"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "GetActiveWindow"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "MessageBoxA"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "GetProcessWindowStation"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "GetUserObjectInformationA"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "GetActiveWindow"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "FillConsoleOutputCharacterA"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "PeekNamedPipe"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "EndUpdateResourceW"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "InterlockedCompareExchange"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "AddConsoleAliasW"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "GetNumberFormatA"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "SetProcessPriorityBoost"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "ReadConsoleInputA"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "AssignProcessToJobObject"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "SetVolumeMountPointA"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "GetSystemWindowsDirectoryA"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "FindNextVolumeW"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "GetCompressedFileSizeA"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "CreateActCtxA"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "BeginUpdateResourceW"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "RemoveDirectoryA"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "EnumSystemCodePagesW"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "SetComputerNameA"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "CreateHardLinkW"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "AddAtomW"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "BeginUpdateResourceA"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "GetCommMask"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "FoldStringA"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "GlobalFindAtomW"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "OpenFileMappingW"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "PeekConsoleInputA"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryW"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "ReadConsoleOutputCharacterW"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "LoadMenuW"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "CharToOemBuffA"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "GetWindowTextLengthW"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "GetStartupInfoA"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "SetHandleCount"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "InterlockedIncrement"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "InterlockedDecrement"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsA"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "GetEnvironmentStrings"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "HeapCreate"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "GetConsoleCP"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "LCMapStringA"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "GetStringTypeA"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "GetLocaleInfoA"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "WriteConsoleA"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "SetEndOfFile"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API (Indicator: "CryptEncrypt"; Source: "00000000-00008768.00000000.88853.02960000.00000004.mdmp") Found reference to API (Indicator: "CryptExportKey"; Source: "00000000-00008768.00000000.88853.02960000.00000004.mdmp") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00008768.00000000.88853.02960000.00000004.mdmp") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00008768.00000000.88853.02960000.00000004.mdmp")2a:T15cc,"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74af0000 "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74af0000 "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74af0000 "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" loaded module "KERNEL32" at base 75a10000 "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73a50000 "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" loaded module "KERNEL32.DLL" at base 75a10000 "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" loaded module "MSIMG32.DLL" at base 739c0000 "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" loaded module "WS2_32.DLL" at base 76220000 "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 75a10000 "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" loaded module "API-MS-WIN-CORE-FILE-L1-2-1.DLL" at base 74af0000 "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" loaded module "DBGHELP.DLL" at base 73830000 "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" loaded module "USER32.DLL" at base 77ba0000 "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" loaded module "ADVAPI32.DLL" at base 74da0000 "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" loaded module "SHELL32.DLL" at base 764f0000 "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" loaded module "OLEAUT32.DLL" at base 74e30000 "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" loaded module "MSVCR100.DLL" at base 73770000 "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" loaded module "NTDLL.DLL" at base 77e00000 "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 742d0000 "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" loaded module "RPCRT4.DLL" at base 76290000 "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" loaded module "%WINDIR%\SYSWOW64\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 73490000 "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 75440000 "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73d70000 "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 73360000 "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 764f0000 "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 74110000 "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" loaded module "MSISO.DLL" at base 73300000 "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" loaded module "SSPICLI.DLL" at base 74820000 "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 74af0000 "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74770000 "cmd.exe" loaded module "KERNEL32" at base 75a10000 "cmd.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 74af0000 "cmd.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 74af0000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 74af0000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 751e0000 "cmd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74af0000 "cmd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74af0000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74af0000 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73a50000 "sc.exe" loaded module "KERNEL32" at base 75a10000 "sc.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 74af0000 "sc.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 74af0000 "sc.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 74af0000 "sc.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 751e0000 "sc.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74af0000 "sc.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74af0000 "sc.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74af0000 "sc.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73a50000 "sc.exe" loaded module "RPCRT4.DLL" at base 76290000 "krupoiic.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74af0000 "krupoiic.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74af0000 "krupoiic.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74af0000 "krupoiic.exe" loaded module "KERNEL32" at base 75a10000 "krupoiic.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73a50000 "krupoiic.exe" loaded module "KERNEL32.DLL" at base 75a10000 "krupoiic.exe" loaded module "MSIMG32.DLL" at base 739700002b:T17e8,"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" touched "Removable Drives" (Path: "HKCU\WOW6432NODE\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\INSTANCE") "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" touched "Computer" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\INPROCSERVER32") "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" touched "Sync root manager" (Path: "HKCU\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" touched "ExecuteAssociation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{1649D1CF-DEAF-4A68-ABE8-5C9F68572FD1}\INPROCSERVER32") "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}") "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" touched "Security Manager" (Path: "HKCU\WOW6432NODE\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}") "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\PROGID") "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\PROGID") "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" touched "Network" (Path: "HKCU\WOW6432NODE\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" touched "Recycle Bin" (Path: "HKCU\WOW6432NODE\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" touched "Control Panel" (Path: "HKCU\WOW6432NODE\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" touched "UsersFiles" (Path: "HKCU\WOW6432NODE\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" touched "UsersLibraries" (Path: "HKCU\WOW6432NODE\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" touched "CLSID_SearchFolder" (Path: "HKCU\WOW6432NODE\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\WOW6432NODE\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" touched "Public Folder" (Path: "HKCU\WOW6432NODE\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\WOW6432NODE\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" touched "This Device" (Path: "HKCU\WOW6432NODE\CLSID\{5B934B42-522B-4C34-BBFE-37A3EF7B9C90}\SHELLFOLDER") "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" touched "CLSID_AppInstanceFolder" (Path: "HKCU\WOW6432NODE\CLSID\{64693913-1C21-4F30-A98F-4E52906D3B56}\SHELLFOLDER") "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\WOW6432NODE\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" touched "CLSID_SearchHome" (Path: "HKCU\WOW6432NODE\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" touched "CLSID_StartMenuLauncherProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{98F275B4-4FFF-11E0-89E2-7B86DFD72085}\SHELLFOLDER") "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" touched "CLSID_StartMenuCommandingProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{A00EE528-EBD9-48B8-944A-8942113D46AC}\SHELLFOLDER") "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" touched "Other Users Folder" (Path: "HKCU\WOW6432NODE\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\WOW6432NODE\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" touched "Games Explorer" (Path: "HKCU\WOW6432NODE\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER") "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" touched "StreamBackedFolder" (Path: "HKCU\WOW6432NODE\CLSID\{EDC978D6-4D53-4B2F-A265-5805674BE568}\SHELLFOLDER") "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" touched "Computers and Devices" (Path: "HKCU\WOW6432NODE\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" touched "Private Profile Object" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{75847177-F077-4171-BD2C-A6BB2164FBD0}\INPROCSERVER32")2c:T8b0,Observed system executable string:"%WINDIR%\SysWOW64\cmd.exe" [Source: 00000000-00007684-00000BC0-394592936] Observed system executable string:"%WINDIR%\SysWOW64\sc.exe" [Source: 00000000-00007684-00000BC0-394937774] Observed system executable string:"%WINDIR%\SysWOW64\netsh.exe" [Source: 00000000-00007684-00000BC0-395991624] Observed system executable string:"%WINDIR%\System32\cmd.exe" [Source: 00000000-00007684-00000C45-74414852083] Observed system executable string:""%WINDIR%\System32\cmd.exe" /C mkdir %WINDIR%\SysWOW64\pualhduo\" [Source: 00000000-00007684-00000C45-74414852083] Observed system executable string:""%WINDIR%\System32\cmd.exe" /C move /Y "%TEMP%\bexiirss.exe" %WINDIR%\SysWOW64\pualhduo\" [Source: 00000000-00007684-00000C45-75325971011] Observed system executable string:"%WINDIR%\System32\sc.exe" [Source: 00000000-00007684-00000C45-76170334607] Observed system executable string:""%WINDIR%\System32\sc.exe" create pualhduo binPath= "%WINDIR%\SysWOW64\pualhduo\bexiirss.exe /d\"C:\e92d3a6d96b7eecbd2d2bc94c7" [Source: 00000000-00007684-00000C45-76170334607] Observed system executable string:"create pualhduo binPath= "%WINDIR%\SysWOW64\pualhduo\bexiirss.exe /d\"C:\e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\"" type= own start= auto DisplayName= "wifi support"" [Source: 00000000-00007684-00000C6F-76180574074] Observed system executable string:""%WINDIR%\System32\sc.exe" description pualhduo "wifi internet conection"" [Source: 00000000-00007684-00000C45-76910438342] Observed system executable string:""%WINDIR%\System32\sc.exe" start pualhduo" [Source: 00000000-00007684-00000C45-77746718904] Observed system executable string:"%WINDIR%\System32\netsh.exe" [Source: 00000000-00007684-00000C45-78692057566] Observed system executable string:""%WINDIR%\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow prog" [Source: 00000000-00007684-00000C45-78692057566] Observed system executable string:"advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul" [Source: 00000000-00007684-00000C6F-78701856867]2d:Tb0d,"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE"; Key: ""; Value: "") "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" (Access type: "OPEN"; Path: "HKCU\DELEGATEFOLDERS"; Key: ""; Value: "") "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\DELEGATEFOLDERS"; Key: ""; Value: "") "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE"; Key: ""; Value: "") "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\DELEGATEFOLDERS"; Key: ""; Value: "") "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\DELEGATEFOLDERS"; Key: ""; Value: "") "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SESSIONINFO\1"; Key: ""; Value: "") "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SESSIONINFO\1\DESKTOP\NAMESPACE"; Key: ""; Value: "") "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SESSIONINFO\1\DESKTOP\NAMESPACE\DELEGATEFOLDERS"; Key: ""; Value: "") "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\INSTANCE"; Key: ""; Value: "") "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\INSTANCE"; Key: ""; Value: "") "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\INPROCSERVER32"; Key: ""; Value: "") "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\INPROCSERVER32"; Key: ""; Value: "") "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MYCOMPUTER\NAMESPACE"; Key: ""; Value: "")2e:T120e,"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE"; Key: "VALIDATEREGITEMS"; Value: "") "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE"; Key: "MONITORREGISTRY"; Value: "") "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\DELEGATEFOLDERS"; Key: "STORAGEDELEGATESUPPRESSIONPOLICY"; Value: "") "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\DELEGATEFOLDERS"; Key: "STORAGEDELEGATE"; Value: "") "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\INPROCSERVER32"; Key: ""; Value: "") "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\INSTANCE"; Key: "CLSID"; Value: "") "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\INPROCSERVER32"; Key: ""; Value: "") "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\INPROCSERVER32"; Key: "LOADWITHOUTCOM"; Value: "") "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MYCOMPUTER\NAMESPACE"; Key: "VALIDATEREGITEMS"; Value: "") "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MYCOMPUTER\NAMESPACE"; Key: "MONITORREGISTRY"; Value: "") "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\INSTANCE\INITPROPERTYBAG"; Key: "HIDENONREMOVABLEDRIVES"; Value: "") "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\INSTANCE\INITPROPERTYBAG"; Key: "ALLOWCHILDALIASREGISTRATION"; Value: "") "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\INSTANCE\INITPROPERTYBAG"; Key: "USEREMOVABLESTORAGEREGPATH"; Value: "") "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\INSTANCE\INITPROPERTYBAG"; Key: "USEREMOVABLEDRIVESREGPATH"; Value: "") "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\INSTANCE\INITPROPERTYBAG"; Key: "NODELEGATESEARCHROOT"; Value: "") "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\INSTANCE\INITPROPERTYBAG"; Key: "HIDENONSTORAGESERVICEMOUNTEDDRIVES"; Value: "") "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\INSTANCE\INITPROPERTYBAG"; Key: "FORCEALLDRIVESREMOVABLE"; Value: "") "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\INSTANCE\INITPROPERTYBAG"; Key: "SHOWALLOPTICALDEVICES"; Value: "") "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-501F00000000}"; Key: "GENERATION"; Value: "")2f:T69d,"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" trying to touch file "C:\Windows\System32\WOW64LOG.DLL" "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" trying to touch file "C:\Windows\SysWOW64\apphelp.dll" "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" trying to touch file "C:\e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" trying to touch file "C:\Windows\SysWOW64\ntdll.dll" "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" trying to touch file "C:\Windows\SysWOW64\kernel32.dll" "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" trying to touch file "C:\Windows\SysWOW64\KernelBase.dll" "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" trying to touch file "C:\Windows\SysWOW64\win32u.dll" "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" trying to touch file "C:\Windows\SysWOW64\ucrtbase.dll" "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" trying to touch file "C:\Windows\SysWOW64\msvcp_win.dll" "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" trying to touch file "C:\Windows\SysWOW64\gdi32full.dll" "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" trying to touch file "C:\Windows\SysWOW64\gdi32.dll" "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" trying to touch file "C:\Windows\SysWOW64\user32.dll"30:Tb49,"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" trying to access non-existent file "C:\FLTLIB.DLL" "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" trying to access non-existent file "C:\MSIMG32.DLL" "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" trying to access non-existent file "C:\msimg32.dll" "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" trying to access non-existent file "C:\DBGHELP.DLL" "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" trying to access non-existent file "C:\dbghelp.dll" "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" trying to access non-existent file "C:\MSVCR100.DLL" "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" trying to access non-existent file "C:\msvcr100.dll" "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" trying to access non-existent file "C:\PROPSYS.DLL" "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" trying to access non-existent file "C:\PROPSYS.dll" "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" trying to access non-existent file "C:\CLDAPI.DLL" "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" trying to access non-existent file "C:\CLDAPI.dll" "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" trying to access non-existent file "C:\AEPIC.DLL" "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" trying to access non-existent file "C:\AEPIC.dll" "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" trying to access non-existent file "C:\BCRYPT.DLL" "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" trying to access non-existent file "C:\bcrypt.dll" "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" trying to access non-existent file "C:\EDPUTIL.DLL" "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" trying to access non-existent file "C:\edputil.dll" "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" trying to access non-existent file "C:\URLMON.DLL" "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" trying to access non-existent file "C:\urlmon.dll"31:T41e,"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" trying to access non-existent file "\Device\NamedPipe\lqwhdzqk" "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" trying to access non-existent file "C:\Windows\SysWOW64\cmd.exe:ZONE.IDENTIFIER" "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" trying to access non-existent file "C:\Windows\System32\cmd.exe:Zone.Identifier" "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" trying to access non-existent file "C:\Windows\SysWOW64\sc.exe:ZONE.IDENTIFIER" "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" trying to access non-existent file "C:\Windows\System32\sc.exe:Zone.Identifier" "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" trying to access non-existent file "C:\Windows\SysWOW64\netsh.exe:ZONE.IDENTIFIER" "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" trying to access non-existent file "C:\Windows\System32\netsh.exe:Zone.Identifier"32:Ta98,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007684.00000000.86637.03460000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007684.00000000.86637.03460000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00007684.00000000.86637.03460000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007684.00000000.86637.03460000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007684.00000000.86637.03460000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00007684.00000000.86637.03460000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00007684.00000000.86637.03460000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00007684.00000000.86637.03460000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00008768.00000000.88853.02960000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00008768.00000000.88853.02960000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00008768.00000000.88853.02960000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00008768.00000000.88853.02960000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00008768.00000000.88853.02960000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00008768.00000000.88853.02960000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00008768.00000000.88853.02960000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00008768.00000000.88853.02960000.00000004.mdmp")33:T71a,Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00007684.00000000.86637.00401000.00000020.mdmp")34:T5f4,"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\SC.EXE"; Value: "") "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\CMD.EXE"; Value: "") "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\NETSH.EXE"; Value: "") "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\KRUPOIIC.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "sc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "")35:T554,"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\cmd.exe" /C mkdir %WINDIR%\SysWOW64\pualhduo\" - (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\cmd.exe" /C move /Y "%TEMP%\bexiirss.exe" %WINDIR%\SysWOW64\pualhduo\" - (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\sc.exe" create pualhduo binPath= "%WINDIR%\SysWOW64\pualhduo\bexiirss.exe /d\"C:\e92d3a6d96b7eecbd2d2bc94c7" - (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\sc.exe" description pualhduo "wifi internet conection"" - (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\sc.exe" start pualhduo" - (UID: 00000000-00007684) "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow prog" - (UID: 00000000-00007684)36:T4b8,Spawned process "e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe" (UID: 00000000-00007684) Spawned process "cmd.exe" with commandline "/C mkdir %WINDIR%\\SysWOW64\\pualhduo\\" (UID: 00000000-00007864) Spawned process "cmd.exe" with commandline "/C move /Y "%TEMP%\\bexiirss.exe" %WINDIR%\\SysWOW64\\pualhduo\\" (UID: 00000000-00005496) Spawned process "sc.exe" with commandline "create pualhduo binPath= "%WINDIR%\\SysWOW64\\pualhduo\\bexiirss.exe /d\\"C:\\e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\\"" type= own start= auto DisplayName= "wifi support"" (UID: 00000000-00005272) Spawned process "sc.exe" with commandline "description pualhduo "wifi internet conection"" (UID: 00000000-00005080) Spawned process "sc.exe" with commandline "start pualhduo" (UID: 00000000-00000680) Spawned process "netsh.exe" with commandline "advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\\SysWOW64\\svchost.exe" enable=yes>nul" (UID: 00000000-00004308) Spawned process "krupoiic.exe" with commandline "/d"C:\\e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe"" (UID: 00000000-00008768)37:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAA3MAAAAAAAAAAAAAAAAAAAdzAAAAB3d3d3AAAAAHdwAHcwAHd3cAAAAAAAAAB3d3d3d3d3d3d3d3d3d3cAh3d3d3d3d3d3d3d3d3d3AAAHd3d3d3d3d3d3d3d3dwAAB3d3d3d3d3d3d3d3d3cAAAd3d3d3d3d3d3d3d3d3AAB3d3d3d3d3d3d3d3d3dwAAB3d3d3d3d3d3d3d3d3cAAHd3d3d3d3d3d3d3d3d3AAB3d3d3d3d3d3d3d3d3dwAAd3d3d3d3d3d3d3d3d3ewAAd3d3d3d3d3d3d3dwB3sAAHd3d3d3d3d3d3d3d3d7AAd3d3d3d3d3d3d3d3d3cAAHd3d3d3d3d3d3d3d3d3cAB3d3d3d3d3d3d3d3d3d3AAAHd3d3d3d3d3d3d3d3cAAHd3d3d3d3d3d3d3d3d3AAAHd3d3d3d3d3d3d3d3dwAAd3d3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAB3d3d3d3d3d3d3d3d3dwAAd3d3d3d3d3d3d3d3d3cAAAd3d3d3d3d3d3d3d3d3AAAHd3d3d3d3d3d3d3d3dwAAd3d3d3d3d3d3d3d3d3cAAAd3d3d3d3d3d3d3d3d3AAB3d3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAHd3d3d3d3d3d3d3d3d3D/f////n+Af454P/+AAAABwAAAAfAAAAHwAAAB8AAAAeAAAAHwAAAB4AAAAeAAAAHgAAAB8AAAGfAAAAHgAAAB4AAAAOAAAAD4AAAB4AAAAfAAAAHgAAAB+AAAAeAAAAHgAAAB8AAAAfAAAAHgAAAB8AAAAeAAAAH4AAAB4AAAAQ==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790923566405,"unified_at":"2026-10-02T06:46:06.405Z","metadata":{"hashes":{"sha256":"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99","sha1":"25eae6059c4a6697c4c3b73c3696e62f7e42e83f","md5":"1b4b7ae3663328ee843f0f4c96d8590e","sha512":"96b3519238735bec3de26d77dcbd65762c7e70ad7f7c362b681493805d52d65ebef7e5e120e1637d7f573a79673f6399b3eae155756d9bc09ace34f6e9c74a9e","ssdeep":"3072:XVHX9kXm0WCxK8imXRJqhzdsAcTv1AtUXvSXI2I5OoU:5mX2CFisRovsAcokSXIU","ssdeep_chunks":["3072:XVHX9kX","3072:VHX9kXm","3072:HX9kXm0","3072:X9kXm0W","3072:9kXm0WC","3072:kXm0WCx","3072:Xm0WCxK","3072:m0WCxK8","3072:0WCxK8i","3072:WCxK8im","3072:CxK8imX","3072:xK8imXR","3072:K8imXRJ","3072:8imXRJq","3072:imXRJqh","3072:mXRJqhz","3072:XRJqhzd","3072:RJqhzds","3072:JqhzdsA","3072:qhzdsAc","3072:hzdsAcT","3072:zdsAcTv","3072:dsAcTv1","3072:sAcTv1A","3072:AcTv1At","3072:cTv1AtU","3072:Tv1AtUX","3072:v1AtUXv","3072:1AtUXvS","3072:AtUXvSX","3072:tUXvSXI","3072:UXvSXI2","3072:XvSXI2I","3072:vSXI2I5","3072:SXI2I5O","3072:XI2I5Oo","3072:I2I5OoU","6144:XVHX9kX","6144:VHX9kXm","6144:HX9kXm0","6144:X9kXm0W","6144:9kXm0WC","6144:kXm0WCx","6144:Xm0WCxK","6144:m0WCxK8","6144:0WCxK8i","6144:WCxK8im","6144:CxK8imX","6144:xK8imXR","6144:K8imXRJ","6144:8imXRJq","6144:imXRJqh","6144:mXRJqhz","6144:XRJqhzd","6144:RJqhzds","6144:JqhzdsA","6144:qhzdsAc","6144:hzdsAcT","6144:zdsAcTv","6144:dsAcTv1","6144:sAcTv1A","6144:AcTv1At","6144:cTv1AtU","6144:Tv1AtUX","6144:v1AtUXv","6144:1AtUXvS","6144:AtUXvSX","6144:tUXvSXI","6144:UXvSXI2","6144:XvSXI2I","6144:vSXI2I5","6144:SXI2I5O","6144:XI2I5Oo","6144:I2I5OoU","3072:5mX2CFi","3072:mX2CFis","3072:X2CFisR","3072:2CFisRo","3072:CFisRov","3072:FisRovs","3072:isRovsA","3072:sRovsAc","3072:RovsAco","3072:ovsAcok","3072:vsAcokS","3072:sAcokSX","3072:AcokSXI","3072:cokSXIU"],"imphash":"7ff534efbc2040b4418e0537898f73b1"},"file_info":{"file_name":"file.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":208384,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1696826709000,"last_seen":1745415477000,"last_multi_scan":1745415477000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["criminal","spambot","tofsee"]},"stats":{"av":{"malicious_count":19,"suspicious_count":0,"total_engines":24},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":55},"sandbox_signatures":{"informative_count":102,"suspicious_count":14,"malicious_count":7,"total":123},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Kryptik.huyn","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1366056","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Mikey.154985","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Packer.pkr_ce1a-9980177-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Mikey.154985 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/Tofsee.BJ trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Ransom.Win32.STOP.bot!n","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005690671 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Tofsee.kcageh","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Krypt-VK","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Kryptik.KUU.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.GenusB.DSXD","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.Backdoor.Tofsee","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware_43.7","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Backdoor.Tofsee.Win32.6750","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Mikey.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Imports GetCommandLine API"},{"type":"malicious","value":"Calls an API typically used to execute an application"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"suspicious","value":"Contains ability to retrieve the command-line string for the current process"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"}],"sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"malicious","value":"Starts service using SC.exe"}],"sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"},{"type":"suspicious","value":"Contains ability to retrieve the contents of the STARTUPINFO structure"}],"sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Contains ability to inject code into another process (API string)"},{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"}],"sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"}],"sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify System Firewall","attack_id":"T1562.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/004","identifiers":[{"type":"malicious","value":"Modifies firewall settings"},{"type":"informative","value":"Detects NETSH process execution"}],"sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Marks file for deletion"},{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Contains ability to enumerate volumes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Contains ability to query system locale (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"}],"sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"tactic":"Discovery","technique":"Internet Connection Discovery","attack_id":"T1016.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1016/001","identifiers":[{"type":"informative","value":"Contains ability to check internet connectivity"}],"sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Process launched with changed environment"},{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Spawns new processes"}],"sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Reads information about supported languages"},{"type":"suspicious","value":"Calls an API typically used to find and list the Windows drive types"},{"type":"suspicious","value":"Contains ability to retrieve a module handle"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Queries volume information of an entire harddrive"}],"sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Opens registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Loads the debugger/analysis tool module"}],"sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Tries to move files"}],"sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"suspicious","value":"Tries to access/write temporary files"}],"sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"suspicious","value":"Drops executable files"},{"type":"suspicious","value":"Writes a PE file header to disc"}],"sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to load a resource in memory","description":"\"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '0'}\" (UID: 00000000-00007684)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"00000000-00007684.00000000.86637.00401000.00000020.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00007684.00000000.86637.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00007684.00000000.86637.00401000.00000020.mdmp\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; Source: \"00000000-00007684.00000000.86637.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007684.00000000.86637.00401000.00000020.mdmp\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007684.00000000.86637.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00007684.00000000.86637.03460000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00008768.00000000.88853.02960000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Loads the debugger/analysis tool module","description":"\"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\" loaded module \"%WINDIR%\\SysWOW64\\dbghelp.dll\" at 73830000","origin":"Loaded Module","mitre_attack_id":"T1518.001","relevance":3,"id":"module-16","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 16730-680-00409EA5\n SetUnhandledExceptionFilter@KERNEL32.dll at 16730-1480-0040AA16","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"Assembly shows XOR instruction xor eax\n ebp in Stream UID: 16730-153-0040B151\n Assembly shows XOR instruction xor ecx\n ebp in Stream UID: 16730-153-0040B151\n Assembly shows XOR instruction xor eax\n ebp in Stream UID: 16730-217-00407F4B\n Assembly shows XOR instruction xor ecx\n ebp in Stream UID: 16730-217-00407F4B\n Assembly shows XOR instruction xor eax\n ebp in Stream UID: 16730-680-00409EA5","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00008768.00000000.88853.02960000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.152532843136195","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to import cryptographic keys (seen in ransomware)\n Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Contains ability to perform decryption (API string)\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Found potential IP address in binary/memory","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00007684.00000000.86637.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"PostMessageW\" (Indicator: \"postmessage\"; File: \"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\")\n Found reference to API \"PostMessageW\" (Indicator: \"postmessage\"; Source: \"00000000-00007684.00000000.86637.00401000.00000020.mdmp\")\n Found reference to API \"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00007684.00000000.86637.03460000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00008768.00000000.88853.02960000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\" called \"GetForegroundWindow\" (UID: 00000000-00007684)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007684)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$25","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\" called \"GetVersionExA\" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff0c0000000000000010e21601000000000400000000000000000000000000000028c7bd74bf2465700c00000014e21601f1c6bd74ffffffff0c00000010e2160104000000000400000100000024e21601210ee30400000000 (UID: 00000000-00007684)\n \"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\" called \"GetVersionExA\" with parameter 9c0000000600000002000000f02300000200000000ffffff34eb1601a34440720600000080dba77598ef1601b3444072296a40000000000000000000000000000000000000000000000000002402000000000000000000000000000068eb1601c72f65702402000068eb1601616b400024020000f8224100c07ca67598ef1601000090010066b200000200000800000084848f00 (UID: 00000000-00007684)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate volumes (API string)","description":"Found reference to API \"SetVolumeMountPointA\" (Indicator: \"SetVolumeMountPoint\"; File: \"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\")\n Found reference to API \"FindNextVolumeW\" (Indicator: \"FindNextVolume\"; File: \"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\")\n Found reference to API \"SetVolumeMountPointA\" (Indicator: \"SetVolumeMountPoint\"; Source: \"00000000-00007684.00000000.86637.00401000.00000020.mdmp\")\n Found reference to API \"FindNextVolumeW\" (Indicator: \"FindNextVolume\"; Source: \"00000000-00007684.00000000.86637.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1006","relevance":1,"id":"string-194","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00007684.00000000.86637.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; File: \"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\")\n Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00007684.00000000.86637.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"sc.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"krupoiic.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00007684.00000000.86637.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"GetUserObjectInformationA\" (Indicator: \"GetUserObjectInformation\"; File: \"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\")\n Found reference to API \"GetUserObjectInformationA\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00007684.00000000.86637.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00007684.00000000.86637.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetWindowTextLengthW\" (Indicator: \"GetWindowText\"; File: \"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\")\n Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; File: \"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\")\n Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; Source: \"00000000-00007684.00000000.86637.00401000.00000020.mdmp\")\n Found reference to API \"GetWindowTextLengthW\" (Indicator: \"GetWindowText\"; Source: \"00000000-00007684.00000000.86637.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; File: \"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\")\n Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00007684.00000000.86637.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; File: \"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\" queries volume information of \"C:\\\" at 00000000-00007684-00000C16-393026902\n \"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\" queries volume information of \"C:\\\" at 00000000-00007684-00000C16-393027281\n \"cmd.exe\" queries volume information of \"C:\\\" at 00000000-00005496-00000C16-397440087","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\" queries volume information of \"C:\\\" at 00000000-00007684-00000C16-393026902\n \"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\" queries volume information of \"C:\\\" at 00000000-00007684-00000C16-393027281\n \"cmd.exe\" queries volume information of \"C:\\\" at 00000000-00005496-00000C16-397440087","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"sc.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\SC.EXE\")\n \"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")\n \"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\NETSH.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"$26","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$27","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$28","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"C:\\mic17 ke.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; File: \"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\")\n Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"00000000-00007684.00000000.86637.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$29","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; File: \"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00007684.00000000.86637.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00007684.00000000.86637.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00007684.00000000.86637.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00007684.00000000.86637.00401000.00000020.mdmp\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00007684.00000000.86637.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"Local\\SM0:7684:168:WilStaging_02\"\n \"Local\\SM0:7684:64:WilError_01\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"SM0:7684:64:WilError_01\"\n \"SM0:7684:168:WilStaging_02\"","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$2a","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 753D0000\n \"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73BA0000\n \"cmd.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 753D0000\n \"sc.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 753D0000\n \"netsh.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 753D0000\n \"netsh.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73BA0000\n \"krupoiic.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 753D0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76290000\n \"cmd.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76290000\n \"sc.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76290000\n \"netsh.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76290000\n \"krupoiic.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76290000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"\n \"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$2b","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\" file has an entrypoint instructions - \"call\t0x40af1d,jmp\t0x405e15,mov\tedi, edi,push\tebp,mov\tebp, esp,push\tecx,push\tesi,mov\tesi, dword ptr [ebp + 0xc],push\tesi,call\t0x406e73,mov\tdword ptr [ebp + 0xc], eax,mov\teax, dword ptr [esi + 0xc],pop\tecx,test\tal, 0x82,jne\t0x405fcf,call\t0x4062a0,mov\tdword ptr [eax], 9,or\tdword ptr [esi + 0xc], 0x20,or\teax, 0xffffffff,jmp\t0x4060fe,test\tal, 0x40,je\t0x405fe0,call\t0x4062a0,mov\tdword ptr [eax], 0x22,jmp\t0x405fc3,push\tebx,xor\tebx, ebx,test\tal, 1,je\t0x405ffd,mov\tdword ptr [esi + 4], ebx,test\tal, 0x10,je\t0x406079,mov\tecx, dword ptr [esi + 8],\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".data\" is \"0x176264\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"$2c","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"cmd.exe\" (UID: 00000000-00007864) was launched with new environment variables: \"USERDNSDOMAIN=\"DESKTOP-FVVF82A\", PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"cmd.exe\" (UID: 00000000-00007864) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"sc.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"krupoiic.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"cmd.exe\" with commandline \"/C mkdir %WINDIR%\\\\SysWOW64\\\\pualhduo\\\\\" (UID: 00000000-00007864)\n Spawned process \"cmd.exe\" with commandline \"/C move /Y \"%TEMP%\\\\bexiirss.exe\" %WINDIR%\\\\SysWOW64\\\\pualhduo\\\\\" (UID: 00000000-00005496)\n Spawned process \"sc.exe\" with commandline \"create pualhduo binPath= \"%WINDIR%\\\\SysWOW64\\\\pualhduo\\\\bexiirss ...\" (UID: 00000000-00005272), Spawned process \"sc.exe\" with commandline \"description pualhduo \"wifi internet conection\"\" (UID: 00000000-00005080), Spawned process \"sc.exe\" with commandline \"start pualhduo\" (UID: 00000000-00000680), Spawned process \"netsh.exe\" with commandline \"advfirewall firewall add rule name=\"Host-process for services of ...\" (UID: 00000000-00004308)\n Spawned process \"krupoiic.exe\" with commandline \"/d\"C:\\\\e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a ...\" (UID: 00000000-00008768)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"cmd.exe\" with commandline \"/C mkdir %WINDIR%\\\\SysWOW64\\\\pualhduo\\\\\" (UID: 00000000-00007864)\n Spawned process \"cmd.exe\" with commandline \"/C move /Y \"%TEMP%\\\\bexiirss.exe\" %WINDIR%\\\\SysWOW64\\\\pualhduo\\\\\" (UID: 00000000-00005496)\n Spawned process \"sc.exe\" with commandline \"create pualhduo binPath= \"%WINDIR%\\\\SysWOW64\\\\pualhduo\\\\bexiirss ...\" (UID: 00000000-00005272), Spawned process \"sc.exe\" with commandline \"description pualhduo \"wifi internet conection\"\" (UID: 00000000-00005080), Spawned process \"sc.exe\" with commandline \"start pualhduo\" (UID: 00000000-00000680), Spawned process \"netsh.exe\" with commandline \"advfirewall firewall add rule name=\"Host-process for services of ...\" (UID: 00000000-00004308)\n Spawned process \"krupoiic.exe\" with commandline \"/d\"C:\\\\e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a ...\" (UID: 00000000-00008768)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"General","name":"Tries to move files","description":"Process \"cmd.exe\" with commandline \"/C move /Y \"%TEMP%\\\\bexiirss.exe\" %WINDIR%\\\\SysWOW64\\\\pualhduo\\\\\" (UID: 00000000-00005496)","origin":"Monitored Target","mitre_attack_id":"T1570","relevance":3,"id":"target-302","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\bexiirss.exe\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007684.00000000.86637.00401000.00000020.mdmp\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007684.00000000.86637.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"krupoiic.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [%USERPROFILE%\\krupoiic.exe]- [targetUID: 00000000-00008768]\n \"irxigvn.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- [targetUID: N/A]\n \"bexiirss.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [%TEMP%\\bexiirss.exe]- [targetUID: 00000000-00007684]\n \"5405.bat\" has type \"DOS batch file ASCII text with CRLF line terminators\"- [targetUID: N/A]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$2d","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\" queries basic process information of the \"C:\\e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\" (UID: 7684)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$2e","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\" reads file \"c:\\e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\"\n \"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\" reads file \"c:\\users\\%osuser%\\desktop\\desktop.ini\"\n \"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\" reads file \"c:\\users\\%osuser%\\documents\\desktop.ini\"\n \"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\" reads file \"c:\\users\\%osuser%\\music\\desktop.ini\"\n \"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\" reads file \"c:\\users\\%osuser%\\pictures\\desktop.ini\"\n \"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\" reads file \"c:\\users\\%osuser%\\videos\\desktop.ini\"\n \"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\" reads file \"c:\\users\\%osuser%\\downloads\\desktop.ini\"\n \"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\" reads file \"c:\\users\\%osuser%\\onedrive\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$2f","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$30","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$31","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\bexiirss.exe\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"Network Related","name":"Contains ability to check internet connectivity","description":"Found string \"@echo off:next_trydel \"C:\\Users\\HAPUBWS\\krupoiic.exe\">nulif exist \"C:\\Users\\HAPUBWS\\krupoiic.exe\" (ping 127.0.0.1 >nulgoto next_trydel %0\" (Indicator: \"ping 127.0.0.1\"; File: \"5405.bat\")","origin":"File/Memory","mitre_attack_id":"T1016.001","relevance":1,"id":"string-573","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; File: \"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\")\n Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; Source: \"00000000-00007684.00000000.86637.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"Network Related","name":"Detects NETSH process execution","description":"Process \"netsh.exe\" with commandline \"advfirewall firewall add rule name=\"Host-process for services of Windows\" dir=in action=allow program=\"%WINDIR%\\\\SysWOW64\\\\svchost.exe\" enable=yes>nul\" (UID: 00000000-00004308)","origin":"Monitored Target","mitre_attack_id":"T1562.004","relevance":2,"id":"target-186","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"23.24.5.55\"\n Potential IP \"127.0.0.1\" found in string \"@echo off:next_trydel \"C:\\Users\\HAPUBWS\\krupoiic.exe\">nulif exist \"C:\\Users\\HAPUBWS\\krupoiic.exe\" (ping 127.0.0.1 >nulgoto next_trydel %0\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \":*.np\"\n Pattern match: \"http://www.w3.org/2001/xmlschema-instance\"\n Heuristic match: \"local\\temp\\sslkey.tw\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"8\"\n \"th32ProcessID\": \"0\"}\n \"cmd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"sc.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"krupoiic.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindNextFileA\" (Indicator: \"FindNextFile\"; File: \"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\")\n Found reference to API \"FindNextFileA\" (Indicator: \"FindNextFile\"; Source: \"00000000-00007684.00000000.86637.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00007684.00000000.86637.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00007684.00000000.86637.00401000.00000020.mdmp\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00007684.00000000.86637.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00007684.00000000.86637.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; File: \"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\")\n Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; Source: \"00000000-00007684.00000000.86637.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00007684.00000000.86637.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00007684.00000000.86637.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; File: \"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\")\n Found reference to API \"GetUserObjectInformationA\" (Indicator: \"GetUserObjectInformation\"; File: \"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\")\n Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; Source: \"00000000-00007684.00000000.86637.00401000.00000020.mdmp\")\n Found reference to API \"GetUserObjectInformationA\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00007684.00000000.86637.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetCommandLine API","description":"Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"RemoveDirectoryA\" (Indicator: \"RemoveDirectory\"; File: \"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\")\n Found reference to API \"RemoveDirectoryA\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00007684.00000000.86637.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\")\n Found reference to API \"?CorExitProcess\" (Indicator: \"ExitProcess\"; File: \"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; File: \"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\")\n Found reference to API \"?CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00007684.00000000.86637.00401000.00000020.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00007684.00000000.86637.00401000.00000020.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00007684.00000000.86637.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00007684.00000000.86637.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$34","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"bexiirss.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [%TEMP%\\bexiirss.exe]- [targetUID: 00000000-00007684]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"sc.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"krupoiic.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\" has section name .text with entropy \"7.569094283450767\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve a module handle","description":"GetModuleHandleA@KERNEL32.dll at 16730-677-0040D540","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-121","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure","description":"GetStartupInfoA@KERNEL32.dll at 16730-1-00405F93","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1543","relevance":5,"id":"stream-133","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\" reads file \"C:\\Users\\%OSUSER%\\Documents\\desktop.ini\"\n \"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\" reads file \"C:\\Users\\%OSUSER%\\Music\\desktop.ini\"\n \"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\" reads file \"C:\\Users\\%OSUSER%\\Pictures\\desktop.ini\"\n \"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\" reads file \"C:\\Users\\%OSUSER%\\Videos\\desktop.ini\"\n \"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\" reads file \"C:\\Users\\%OSUSER%\\Downloads\\desktop.ini\"\n \"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\" reads file \"C:\\Users\\%OSUSER%\\OneDrive\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"krupoiic.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [%USERPROFILE%\\krupoiic.exe]- [targetUID: 00000000-00008768]\n \"irxigvn.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- [targetUID: N/A]\n \"bexiirss.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [%TEMP%\\bexiirss.exe]- [targetUID: 00000000-00007684]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"QVBMIEVP\"; Value: \"\"%USERPROFILE%\\krupoiic.exe\"\")","origin":"Registry Access","mitre_attack_id":"T1547.001","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"\"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\" wrote 1024 bytes starting with PE header signature to file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\bexiirss.exe\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to find and list the Windows drive types","description":"\"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\" called \"GetDriveTypeA\" with parameter C:\\ (UID: 00000000-00007684)","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-110","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the command-line string for the current process","description":"GetCommandLineA@KERNEL32.dll at 16730-1-00405F93","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-118","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Tries to access/write temporary files","description":"Process \"%WINDIR%\\SysWOW64\\cmd.exe\" with commandline \"/C move /Y \"%TEMP%\\\\bexiirss.exe\" %WINDIR%\\\\SysWOW64\\\\pualhduo\\\\\" (UID: 00000000-00005496)","origin":"Monitored Target","mitre_attack_id":"T1074.001","relevance":5,"id":"target-423","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\bexiirss.exe\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\bexiirss.exe\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"UnhandledExceptionFilter\n FindNextFileA\n OpenFileMappingW\n IsDebuggerPresent\n GetTickCount\n LoadLibraryA\n GetCommandLineA\n GetProcAddress\n GetModuleHandleW\n WriteFile\n VirtualAlloc\n GetStartupInfoA\n GetFileAttributesW\n GetModuleHandleA\n TerminateProcess\n Sleep\n GetModuleFileNameA\n CreateFileA\n LoadLibraryW","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a process in suspended mode (likely for process injection)","description":"$35","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"malicious","category":"General","name":"Calls an API typically used to execute an application","description":"\"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\" called \"ShellExecuteA\" with parameter cmd (UID: 00000000-00007684)\n \"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\" called \"ShellExecuteA\" with parameter 7363 (UID: 00000000-00007684)\n \"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\" called \"ShellExecuteA\" with parameter netsh (UID: 00000000-00007684)","origin":"API Call","mitre_attack_id":"T1106","relevance":10,"id":"api-117","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\" wrote 00000004 bytes to a remote process \"C:\\Windows\\SysWOW64\\sc.exe\" (Handle: 632)\n \"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\" wrote 00000004 bytes to a remote process \"C:\\Windows\\SysWOW64\\sc.exe\" (Handle: 1168)\n \"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\" wrote 00000004 bytes to a remote process \"C:\\Windows\\SysWOW64\\sc.exe\" (Handle: 768)\n \"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\" wrote 00000004 bytes to a remote process \"C:\\Windows\\SysWOW64\\netsh.exe\" (Handle: 944)\n \"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\" wrote 00000004 bytes to a remote process \"C:\\Users\\%OSUSER%\\krupoiic.exe\" (Handle: 776)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"malicious","category":"System Security","name":"Modifies firewall settings","description":"Process \"netsh.exe\" with commandline \"advfirewall firewall add rule name=\"Host-process for services of Windows\" dir=in action=allow program=\"%WINDIR%\\\\SysWOW64\\\\svchost.exe\" enable=yes>nul\" (UID: 00000000-00004308)","origin":"Monitored Target","mitre_attack_id":"T1562.004","relevance":8,"id":"target-15","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"malicious","category":"System Security","name":"Starts service using SC.exe","description":"Process \"sc.exe\" with commandline \"start pualhduo\" (UID: 00000000-00000680)","origin":"Monitored Target","mitre_attack_id":"T1569.002","relevance":10,"id":"target-303","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$36","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"name":"Persistence","details_count":4,"details":[{"detail":"Writes data to a remote process"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Spawns a lot of processes"},{"detail":"Modifies firewall settings"}],"sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"name":"Fingerprint","details_count":4,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Queries sensitive IE security settings"},{"detail":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]}]},"activity":{"stats":{"process_count":8,"spawned_processes_count":8,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":6,"imported_dlls_count":120,"dropped_files_count":0,"extracted_files_count":4,"files_written_count":3,"files_deleted_count":0,"registry_keys_created_count":3,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":3,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["criminal","spambot","tofsee"],"sample_flags":["Multi-Process","Extracted Files","TOR analysis"],"sandbox_reports":[{"id":"6808ed340cee4bead405b57d","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"submit_name":"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe","analysis_start_time":"2025-04-23T13:37:57+00:00","indicators_count":{"informative":102,"suspicious":32,"malicious":7},"tags":["Multi-Process","Extracted Files","TOR analysis"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}],"processes":[{"pid":7684,"ppid":0,"name":"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe","command_line":"","sha256":"e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99","normalized_path":"C:\\e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe","uid":"00000000-00007684","icon":"$37"},{"pid":7864,"ppid":7684,"name":"cmd.exe","command_line":"/C mkdir %WINDIR%\\SysWOW64\\pualhduo\\","sha256":"4c3ea4c44aab74350355c419826b8c9e6172c3bd8f0bb5817ecf7be50b629051","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00007684","uid":"00000000-00007864"},{"pid":5496,"ppid":7684,"name":"cmd.exe","command_line":"/C move /Y \"%TEMP%\\bexiirss.exe\" %WINDIR%\\SysWOW64\\pualhduo\\","sha256":"4c3ea4c44aab74350355c419826b8c9e6172c3bd8f0bb5817ecf7be50b629051","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00007684","uid":"00000000-00005496"},{"pid":5272,"ppid":7684,"name":"sc.exe","command_line":"create pualhduo binPath= \"%WINDIR%\\SysWOW64\\pualhduo\\bexiirss.exe /d\\\"C:\\e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\\\"\" type= own start= auto DisplayName= \"wifi support\"","sha256":"4d1668fb5d66a972ac0fb7e3fea69003d7fa50116b8f21e5f277972f0177c042","normalized_path":"%WINDIR%\\SysWOW64\\sc.exe","parent_uid":"00000000-00007684","uid":"00000000-00005272"},{"pid":5080,"ppid":7684,"name":"sc.exe","command_line":"description pualhduo \"wifi internet conection\"","sha256":"4d1668fb5d66a972ac0fb7e3fea69003d7fa50116b8f21e5f277972f0177c042","normalized_path":"%WINDIR%\\SysWOW64\\sc.exe","parent_uid":"00000000-00007684","uid":"00000000-00005080"},{"pid":680,"ppid":7684,"name":"sc.exe","command_line":"start pualhduo","sha256":"4d1668fb5d66a972ac0fb7e3fea69003d7fa50116b8f21e5f277972f0177c042","normalized_path":"%WINDIR%\\SysWOW64\\sc.exe","parent_uid":"00000000-00007684","uid":"00000000-00000680"},{"pid":4308,"ppid":7684,"name":"netsh.exe","command_line":"advfirewall firewall add rule name=\"Host-process for services of Windows\" dir=in action=allow program=\"%WINDIR%\\SysWOW64\\svchost.exe\" enable=yes>nul","sha256":"6b22dd9817e7fb63d45f675c08121d7051ed626efe65304603de8bf4b93b32cb","normalized_path":"%WINDIR%\\SysWOW64\\netsh.exe","parent_uid":"00000000-00007684","uid":"00000000-00004308"},{"pid":8768,"ppid":7684,"name":"krupoiic.exe","command_line":"/d\"C:\\e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99.exe\"","sha256":"73a67f18d603f9659c50bf499233272703c9a9b4173fe5974596b42894bdf072","normalized_path":"%USERPROFILE%\\krupoiic.exe","parent_uid":"00000000-00007684","uid":"00000000-00008768"}],"all_imported_dlls":["dot3api.dll","slc.dll","sppc.dll","msvcp_win.dll","crypt32.dll","nshwfp.dll","wlanapi.dll","KernelBase.dll","powrprof.dll","dhcpcsvc.dll","cfgmgr32.dll","ntdll.dll","win32u.dll","mprapi.dll","eappprxy.dll","ole32.dll","ucrtbase.dll","msvcrt.dll","wshelper.dll","apphelp.dll","gdi32full.dll","advapi32.dll","uxtheme.dll","activeds.dll","bcryptprimitives.dll","aepic.dll","fwpolicyiomgr.dll","kernel32.dll","imagehlp.dll","FirewallAPI.dll","onex.dll","SHCore.dll","urlmon.dll","whhelper.dll","sspicli.dll","ntmarta.dll","eappcfg.dll","winipsec.dll","fwcfg.dll","netshell.dll","PeerDistSh.dll","clbcatq.dll","user32.dll","msimg32.dll","nsi.dll","hnetmon.dll","sechost.dll","fwbase.dll","imm32.dll","dot3cfg.dll","atl.dll","nlaapi.dll","ktmw32.dll","windows.storage.dll","profapi.dll","propsys.dll","bcrypt.dll","IPHLPAPI.DLL","wlancfg.dll","dmcmnutils.dll","rpcrt4.dll","ws2_32.dll","VxSSL32.dll","dhcpcmonitor.dll","P2P.dll","ifmon.dll","rasapi32.dll","FWPUCLNT.DLL","p2pnetsh.dll","mswsock.dll","wcmapi.dll","iertutil.dll","winnsi.dll","winhttp.dll","mprmsg.dll","gdi32.dll","rasmontr.dll","WiFiDisplay.dll","msvcp110_win.dll","oleaut32.dll","dbghelp.dll","mfc42u.dll","ncrypt.dll","polstore.dll","wevtapi.dll","cryptsp.dll","Windows.StateRepositoryPS.dll","gpapi.dll","nshhttp.dll","fltLib.dll","dhcpcsvc6.dll","userenv.dll","edputil.dll","ntasn1.dll","mdmregistration.dll","shell32.dll","shlwapi.dll","msvcr100.dll","msIso.dll","msasn1.dll","wow64.dll","rmclient.dll","dnsapi.dll","httpapi.dll","cldapi.dll","cryptbase.dll","kernel.appcore.dll","OneCoreUAPCommonProxyStub.dll","netiohlp.dll","Wldap32.dll","adsldpc.dll","wow64win.dll","combase.dll","rasman.dll","authfwcfg.dll","nshipsec.dll","cabinet.dll","rpcnsh.dll","devobj.dll","wow64cpu.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"bexiirss.exe","sha256":"567113ca69db0ea67a130aa040e7aa4f827abe297d0b104bd74d226fe869a87c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"name":"krupoiic.exe","sha256":"53ae4b72a0838166cc8962255db3a3ca9e9c9b92db663a316120d2a3c261dab3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"name":"irxigvn.exe","sha256":"da971ae87f25fd70cabce8a82e4d0a87f34cf7cda4a1835343c31ae386442027","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"name":"5405.bat","sha256":"97524bfd6f907d0758e26bfe700dc22ab472b94776782a9edd536fe88883695a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]}],"files_written":[{"path":"%TEMP%\\bexiirss.exe","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"path":"%USERPROFILE%\\krupoiic.exe","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\DESKTOP\\NAMESPACE\\\\","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\DESKTOP\\NAMESPACE\\\\","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\DESKTOP\\NAMESPACE\\DELEGATEFOLDERS\\\\","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"Local\\SM0:7684:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"name":"Local\\SM0:7684:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"name":"SM0:7684:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]},{"name":"SM0:7684:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6808ed340cee4bead405b57d"}]}]}},"report_ids":{"sandbox_job_ids":["6808ed340cee4bead405b57d"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Mikey.Generic Sample e92d3a6d96b7… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample e92d3a6d96b7…. Malware family: Mikey.Generic. Threat score 100/100. 19/24 AV engines flagged this file. 7 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99"}],["$","meta","4",{"property":"og:title","content":"Malicious Mikey.Generic Sample e92d3a6d96b7… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample e92d3a6d96b7…. Malware family: Mikey.Generic. Threat score 100/100. 19/24 AV engines flagged this file. 7 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/e92d3a6d96b7eecbd2d2bc94c7e966402328586e814e32e89c876754a9eb3d99"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Mikey.Generic Sample e92d3a6d96b7… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample e92d3a6d96b7…. Malware family: Mikey.Generic. Threat score 100/100. 19/24 AV engines flagged this file. 7 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L38","11",{}]]