26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 5e:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4a3,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious IL:Trojan.NanoCore Sample ec2687f0e226… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample ec2687f0e226…. Malware family: IL:Trojan.NanoCore. Threat score 100/100. 14/27 AV engines flagged this file. 21 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6","keywords":["Malicious","IL:Trojan.NanoCore","malware analysis","sandbox report","threat intelligence","ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6"],"about":{"@type":"SoftwareApplication","name":"tmp1zrigkxm","applicationCategory":["peexe","assembly","executable"],"identifier":"ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"IL:Trojan.NanoCore","antivirusDetections":{"malicious":14,"total":27},"behavioralIndicators":{"malicious":21,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T8cc,Found reference to API "System.Runtime.InteropServices" (Indicator: "time"; Source: "sample.bin"), Found reference to API "RuntimeMethodHandle" (Indicator: "time"; Source: "sample.bin"), Found reference to API "System.Threading" (Indicator: "read"; Source: "sample.bin"), Found reference to API "set_ServerStatus" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "set_TabIndex" (Indicator: "bind"; Source: "sample.bin"), Found reference to API "btn_Close_Click" (Indicator: "close"; Source: "sample.bin"), Found reference to API "set_AccountStatus" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "EditorBrowsableState" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "get_AccountStatus" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "k__BackingField" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "lbl_Status" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "System.Runtime.Versioning" (Indicator: "time"; Source: "sample.bin"), Found reference to API "k__BackingField" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "RuntimeCompatibilityAttribute" (Indicator: "time"; Source: "sample.bin"), Found reference to API "Synchronized" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "DebuggerBrowsableState" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "RuntimeFieldHandle" (Indicator: "time"; Source: "sample.bin"), Found reference to API "AData Source=TIMMEH;Initial Catalog=MMODB;Integrated Security=True" (Indicator: "security"; Source: "sample.bin"), Found reference to API "Close" (Indicator: "close"; Source: "sample.bin"), Found reference to API "add_SelectedIndexChanged" (Indicator: "select"; Source: "sample.bin"), Found reference to API "btn_Close" (Indicator: "close"; Source: "sample.bin"), Found reference to API "Thread" (Indicator: "read"; Source: "sample.bin"), Found reference to API "btn_Exit_Click" (Indicator: "exit"; Source: "sample.bin"), Found reference to API "get_MMODBConnectionString" (Indicator: "connect"; Source: "sample.bin"), Found reference to API "System.Runtime.CompilerServices" (Indicator: "time"; Source: "sample.bin")28:T4e6,Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00004084.00000001.83492.00381000.00000020.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00004084.00000001.83492.00381000.00000020.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004084.00000001.83492.00381000.00000020.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004084.00000001.83492.00381000.00000020.mdmp")29:T4ae,Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6") Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; File: "00004116.00001014.16849967.00402000.wprm") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004084.00000001.83492.00381000.00000020.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00004084.00000001.83492.00381000.00000020.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004084.00000001.83492.00381000.00000020.mdmp") Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00004116.00000001.81497.00400000.00000040.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004116.00000001.81497.00400000.00000040.mdmp")2a:Teb9,Found reference to "TripleDES" (Indicator: "TripleDES"; File: "00004116.00001014.16849967.00402000.wprm") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; File: "00004116.00001014.16849967.00402000.wprm") Found reference to "CryptoStream" (Indicator: "CryptoStream"; File: "00004116.00001014.16849967.00402000.wprm") Found reference to "AesGcm" (Indicator: "Aes"; File: "00004116.00001014.16849967.00402000.wprm") Found reference to "AesGcm" (Indicator: "AesGcm"; File: "00004116.00001014.16849967.00402000.wprm") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; File: "00004116.00001014.16849967.00402000.wprm") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; File: "00004116.00001014.16849967.00402000.wprm") Found reference to "CryptographicException" (Indicator: "CryptographicException"; File: "00004116.00001014.16849967.00402000.wprm") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; File: "00004116.00001014.16849967.00402000.wprm") Found reference to "TripleDESCryptoServiceProvider" (Indicator: "DESCryptoServiceProvider"; File: "00004116.00001014.16849967.00402000.wprm") Found reference to "TripleDESCryptoServiceProvider" (Indicator: "TripleDES"; File: "00004116.00001014.16849967.00402000.wprm") Found reference to "TripleDESCryptoServiceProvider" (Indicator: "TripleDESCryptoServiceProvider"; File: "00004116.00001014.16849967.00402000.wprm") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00004116-00000CC3-262428152") Found reference to "TripleDES" (Indicator: "TripleDES"; Source: "00000000-00004116.00000001.81497.00400000.00000040.mdmp") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; Source: "00000000-00004116.00000001.81497.00400000.00000040.mdmp") Found reference to "CryptoStream" (Indicator: "CryptoStream"; Source: "00000000-00004116.00000001.81497.00400000.00000040.mdmp") Found reference to "AesGcm" (Indicator: "Aes"; Source: "00000000-00004116.00000001.81497.00400000.00000040.mdmp") Found reference to "AesGcm" (Indicator: "AesGcm"; Source: "00000000-00004116.00000001.81497.00400000.00000040.mdmp") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; Source: "00000000-00004116.00000001.81497.00400000.00000040.mdmp") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00004116.00000001.81497.00400000.00000040.mdmp") Found reference to "CryptographicException" (Indicator: "CryptographicException"; Source: "00000000-00004116.00000001.81497.00400000.00000040.mdmp") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; Source: "00000000-00004116.00000001.81497.00400000.00000040.mdmp") Found reference to "TripleDESCryptoServiceProvider" (Indicator: "DESCryptoServiceProvider"; Source: "00000000-00004116.00000001.81497.00400000.00000040.mdmp") Found reference to "TripleDESCryptoServiceProvider" (Indicator: "TripleDES"; Source: "00000000-00004116.00000001.81497.00400000.00000040.mdmp") Found reference to "TripleDESCryptoServiceProvider" (Indicator: "TripleDESCryptoServiceProvider"; Source: "00000000-00004116.00000001.81497.00400000.00000040.mdmp") Found reference to "CryptCNGInitHMAC" (Indicator: "HMAC"; Source: "00000000-00004116.00000001.81497.004E0000.00000004.mdmp, 00000000-00004116.00000002.83420.004E0000.00000004.mdmp") Found reference to "SA/SHA384" (Indicator: "SHA384"; Source: "00000000-00004116.00000001.81497.04948000.00000004.mdmp, 00000000-00004116.00000002.83420.04948000.00000004.mdmp") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00004116.00000001.81497.04948000.00000004.mdmp, 00000000-00004116.00000002.83420.04948000.00000004.mdmp")2b:T6eb,"ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\NET FRAMEWORK SETUP\NDP\V4\FULL") "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32") "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32") "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IME COMPATIBILITY") "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\.NETFRAMEWORK") "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK") "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY") "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION") "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\EC2687F0E226016D1CEC0764216B00675B8BDA746AA9606053F62F3ED799F3D6.EXE") "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION") "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\FUSION")2c:T1503,Found api reference "CryptUnprotectData" (Indicator: "CryptUnprotectData"; File: "00004116.00001014.16849967.00402000.wprm") Found api reference "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; File: "00004116.00001014.16849967.00402000.wprm") Found api reference "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; File: "00004116.00001014.16849967.00402000.wprm") Found api reference "BCryptDecrypt" (Indicator: "BCryptDecrypt"; File: "00004116.00001014.16849967.00402000.wprm") Found api reference "BCryptDecrypt" (Indicator: "CryptDecrypt"; File: "00004116.00001014.16849967.00402000.wprm") Found api reference "BCryptEncrypt" (Indicator: "BCryptEncrypt"; File: "00004116.00001014.16849967.00402000.wprm") Found api reference "BCryptEncrypt" (Indicator: "CryptEncrypt"; File: "00004116.00001014.16849967.00402000.wprm") Found api reference "BCryptImportKey" (Indicator: "BCryptImportKey"; File: "00004116.00001014.16849967.00402000.wprm") Found api reference "BCryptImportKey" (Indicator: "CryptImportKey"; File: "00004116.00001014.16849967.00402000.wprm") Found api reference "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; File: "00004116.00001014.16849967.00402000.wprm") Found api reference "BCryptDestroyKey" (Indicator: "CryptDestroyKey"; File: "00004116.00001014.16849967.00402000.wprm") Found api reference "BCryptGetProperty" (Indicator: "BCryptGetProperty"; File: "00004116.00001014.16849967.00402000.wprm") Found api reference "BCryptSetProperty" (Indicator: "BCryptSetProperty"; File: "00004116.00001014.16849967.00402000.wprm") Found api reference "Crypt.BCryptDecrypt() (get size) failed with status code: {0}" (Indicator: "BCryptDecrypt"; Source: "00000000-00004116.00000001.81497.00400000.00000040.mdmp") Found api reference "Crypt.BCryptDecrypt() (get size) failed with status code: {0}" (Indicator: "CryptDecrypt"; Source: "00000000-00004116.00000001.81497.00400000.00000040.mdmp") Found api reference "Crypt.BCryptDecrypt(): authentication tag mismatch" (Indicator: "BCryptDecrypt"; Source: "00000000-00004116.00000001.81497.00400000.00000040.mdmp") Found api reference "Crypt.BCryptDecrypt(): authentication tag mismatch" (Indicator: "CryptDecrypt"; Source: "00000000-00004116.00000001.81497.00400000.00000040.mdmp") Found api reference "Crypt.BCryptDecrypt() failed with status code:{0}" (Indicator: "BCryptDecrypt"; Source: "00000000-00004116.00000001.81497.00400000.00000040.mdmp") Found api reference "Crypt.BCryptDecrypt() failed with status code:{0}" (Indicator: "CryptDecrypt"; Source: "00000000-00004116.00000001.81497.00400000.00000040.mdmp") Found api reference "Crypt.BCryptOpenAlgorithmProvider() failed with status code:{0}" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00004116.00000001.81497.00400000.00000040.mdmp") Found api reference "Crypt.BCryptImportKey() failed with status code:{0}" (Indicator: "BCryptImportKey"; Source: "00000000-00004116.00000001.81497.00400000.00000040.mdmp") Found api reference "Crypt.BCryptImportKey() failed with status code:{0}" (Indicator: "CryptImportKey"; Source: "00000000-00004116.00000001.81497.00400000.00000040.mdmp") Found api reference "Crypt.BCryptGetProperty() (get size) failed with status code:{0}" (Indicator: "BCryptGetProperty"; Source: "00000000-00004116.00000001.81497.00400000.00000040.mdmp") Found api reference "Crypt.BCryptGetProperty() failed with status code:{0}" (Indicator: "BCryptGetProperty"; Source: "00000000-00004116.00000001.81497.00400000.00000040.mdmp") Found api reference "CryptUnprotectData" (Indicator: "CryptUnprotectData"; Source: "00000000-00004116.00000001.81497.00400000.00000040.mdmp") Found api reference "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00004116.00000001.81497.00400000.00000040.mdmp") Found api reference "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00004116.00000001.81497.00400000.00000040.mdmp") Found api reference "BCryptDecrypt" (Indicator: "BCryptDecrypt"; Source: "00000000-00004116.00000001.81497.00400000.00000040.mdmp") Found api reference "BCryptDecrypt" (Indicator: "CryptDecrypt"; Source: "00000000-00004116.00000001.81497.00400000.00000040.mdmp") Found api reference "BCryptEncrypt" (Indicator: "BCryptEncrypt"; Source: "00000000-00004116.00000001.81497.00400000.00000040.mdmp") Found api reference "BCryptEncrypt" (Indicator: "CryptEncrypt"; Source: "00000000-00004116.00000001.81497.00400000.00000040.mdmp") Found api reference "BCryptImportKey" (Indicator: "BCryptImportKey"; Source: "00000000-00004116.00000001.81497.00400000.00000040.mdmp") Found api reference "BCryptImportKey" (Indicator: "CryptImportKey"; Source: "00000000-00004116.00000001.81497.00400000.00000040.mdmp") Found api reference "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; Source: "00000000-00004116.00000001.81497.00400000.00000040.mdmp") Found api reference "BCryptDestroyKey" (Indicator: "CryptDestroyKey"; Source: "00000000-00004116.00000001.81497.00400000.00000040.mdmp") Found api reference "BCryptGetProperty" (Indicator: "BCryptGetProperty"; Source: "00000000-00004116.00000001.81497.00400000.00000040.mdmp") Found api reference "BCryptSetProperty" (Indicator: "BCryptSetProperty"; Source: "00000000-00004116.00000001.81497.00400000.00000040.mdmp")2d:Ta86,Found reference to API "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; File: "00004116.00001014.16849967.00402000.wprm") Found reference to API "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; File: "00004116.00001014.16849967.00402000.wprm") Found reference to API "BCryptDecrypt" (Indicator: "BCryptDecrypt"; File: "00004116.00001014.16849967.00402000.wprm") Found reference to API "BCryptEncrypt" (Indicator: "BCryptEncrypt"; File: "00004116.00001014.16849967.00402000.wprm") Found reference to API "BCryptImportKey" (Indicator: "BCryptImportKey"; File: "00004116.00001014.16849967.00402000.wprm") Found reference to API "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; File: "00004116.00001014.16849967.00402000.wprm") Found reference to API "BCryptImportKeyPair" (Indicator: "BCryptImportKey"; Source: "00000000-00004116-00000C2C-262427284") Found reference to API "Crypt.BCryptDecrypt() (get size) failed with status code: {0}" (Indicator: "BCryptDecrypt"; Source: "00000000-00004116.00000001.81497.00400000.00000040.mdmp") Found reference to API "Crypt.BCryptDecrypt(): authentication tag mismatch" (Indicator: "BCryptDecrypt"; Source: "00000000-00004116.00000001.81497.00400000.00000040.mdmp") Found reference to API "Crypt.BCryptDecrypt() failed with status code:{0}" (Indicator: "BCryptDecrypt"; Source: "00000000-00004116.00000001.81497.00400000.00000040.mdmp") Found reference to API "Crypt.BCryptOpenAlgorithmProvider() failed with status code:{0}" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00004116.00000001.81497.00400000.00000040.mdmp") Found reference to API "Crypt.BCryptImportKey() failed with status code:{0}" (Indicator: "BCryptImportKey"; Source: "00000000-00004116.00000001.81497.00400000.00000040.mdmp") Found reference to API "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00004116.00000001.81497.00400000.00000040.mdmp") Found reference to API "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00004116.00000001.81497.00400000.00000040.mdmp") Found reference to API "BCryptDecrypt" (Indicator: "BCryptDecrypt"; Source: "00000000-00004116.00000001.81497.00400000.00000040.mdmp") Found reference to API "BCryptEncrypt" (Indicator: "BCryptEncrypt"; Source: "00000000-00004116.00000001.81497.00400000.00000040.mdmp") Found reference to API "BCryptImportKey" (Indicator: "BCryptImportKey"; Source: "00000000-00004116.00000001.81497.00400000.00000040.mdmp") Found reference to API "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; Source: "00000000-00004116.00000001.81497.00400000.00000040.mdmp")2e:T12ec,"powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIbVQYJKoZIhvcNAQcCoIIbRjCCG0ICAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNRAgEAAgEAAgEAAgEAAgEAMCEwCQYFKw4DAhoFAAQU+zz3vaNz0s6W8CREgPojmh03NLSgghYqMIIEEjCCAvqgAwIBAgIPAMEAizw8iBHRPvZj7N9AMA0GCSqGSIb3DQ" "cchString": "9628" "dwFlags": "1" "pbBinary": "30821b5506092a864886f70d010702a0821b4630821b42020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414fb3cf7bda373d2ce96f0244480fa239a1d3734b4a082162a30820412308202faa003020102020f00c1008b3c3c8811d13ef663ecdf40300d06092a864886f70d01010405003070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f72697479301e170d3937303131303037303030305a170d3230313233313037303030305a3070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100a902bdc170e63bf24e1b289f97785e30eaa2a98d255ff8fe954ca3b7fe9da2203e7c51a29ba28f60326bd1426479eeac76c954daf2eb9c861c8f9f8466b3c56b7a6223d61d3cde0f0192e896c4bf2d669a9a682699d03a2cbf0cb55826c146e70a3e38962ca92839a8ec498342e3840fbb9a6c5561ac827ca1602d774ce999b4643b9a501c310824149fa9e7912b18e63d986314605805659f1d375287f7a7ef9402c61bd3bf5545b38980bf3aec54944eaefda77a6d744eaf18cc96092821005790606937bb4b12073c56ff5bfba4660a08a6d2815657efb63b5e16817704daf6beae8095feb0cd7fd6a71a725c3ccabcf008a32230b30685c9b320771385df0203010001a381a83081a53081a20603551d0104819a30819780105bd070ef69729e23517e14b24d8effcba1723070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f72697479820f00c1008b3c3c8811d13ef663ecdf40300d06092a864886f70d0101040500038201010095e80bc08df3971835edb80124d87711f35c60329f9e0bcb3e0591888fc93ae621f2f057932cb5a047c862effcd7cc3b3b5aa9365469fe246d3fc9ccaade057cdd318d3d9f10706abbfe124f1869c0fcd043e311" "pcbBinary": "591b0000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIbVQYJKoZIhvcNAQcCoIIbRjCCG0ICAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNR" "cchString": "9628" "dwFlags": "1" "pbBinary": "30821b5506092a864886f70d010702a0821b4630821b42020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414fb3cf7bda373d2ce96f0244480fa239a1d3734b4a082162a30820412308202faa003020102020f00c1008b3c3c8811d13ef663ecdf40300d06092a864886f70d01010405003070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f72697479301e170d3937303131303037303030305a170d3230313233313037303030305a3070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100a902bdc170e63bf24e1b289f97785e30eaa2a98d255ff8fe954ca3b7fe9da2203e7c51a29ba28f60326bd1426479eeac76c954daf2eb9c861c8f9f8466b3c56b7a6223d61d3cde0f0192e896c4bf2d669a9a682699d03a2cbf0cb55826c146e70a3e38962ca92839a8ec498342e3840fbb9a6c5561ac827ca1602d774ce999b4643b9a501c310824149fa9e7912b18e63d986314605805659f1d375287f7a7ef9402c61bd3bf5545b38980bf3aec54944eaefda77a6d744eaf18cc96092821005790606937bb4b12073c56ff5bfba4660a08a6d2815657efb63b5e16817704daf6beae8095feb0cd7fd6a71a725c3ccabcf008a32230b30685c9b320771385df0203010001a381a83081a53081a20603551d0104819a30819780105bd070ef69729e23517e14b24d8effcba1723070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f72697479820f00c1008b3c3c8811d13ef663ecdf40300d06092a864886f70d0101040500038201010095e80bc08df3971835edb80124d87711f35c60329f9e0bcb3e0591888fc93ae621f2f057932cb5a047c862effcd7cc3b3b5aa9365469fe246d3fc9ccaade057cdd318d3d9f10706abbfe124f1869c0fcd043e311" "pcbBinary": "591b0000" "pdwFlags": "01000000"}2f:T76a,Assembly shows XOR instruction xor byte ptr [ecx] al in Stream UID: 00000000-00004116-15326-1-004438AE Assembly shows XOR instruction xor byte ptr [0000FF00h] al in Stream UID: 00000000-00004116-15326-1-004438AE Assembly shows XOR instruction xor al byte ptr [eax] in Stream UID: 00000000-00004116-15326-1-004438AE Assembly shows XOR instruction xor eax 140A0000h in Stream UID: 00000000-00004116-15326-1-004438AE Assembly shows XOR instruction xor eax 6F0A0000h in Stream UID: 00000000-00004116-15326-1-004438AE Assembly shows XOR instruction xor eax 730A0000h in Stream UID: 00000000-00004116-15326-1-004438AE Assembly shows XOR instruction xor dword ptr [ecx+02000000h] ecx in Stream UID: 00000000-00004116-15326-1-004438AE Assembly shows XOR instruction xor byte ptr [edx] al in Stream UID: 00000000-00004116-15326-1-004438AE Assembly shows XOR instruction xor byte ptr [eax] al in Stream UID: 00000000-00004116-15326-1-004438AE Assembly shows XOR instruction xor al 00h in Stream UID: 00000000-00004116-15326-1-004438AE Assembly shows XOR instruction xor dword ptr [edx] eax in Stream UID: 00000000-00004116-15326-1-004438AE Assembly shows XOR instruction xor dword ptr [eax] eax in Stream UID: 00000000-00004116-15326-1-004438AE Assembly shows XOR instruction xor eax dword ptr [eax] in Stream UID: 00000000-00004116-15326-1-004438AE Assembly shows XOR instruction xor byte ptr [eax+eax] 00h in Stream UID: 00000000-00004116-15326-1-004438AE Assembly shows XOR instruction xor eax 72040000h in Stream UID: 00000000-00004116-15326-1-004438AE Assembly shows XOR instruction xor dword ptr [edi] eax in Stream UID: 00000000-00004116-15326-1-004438AE Assembly shows XOR instruction xor al byte ptr [edx] in Stream UID: 00000000-00004116-15326-418-0042BF8C Assembly shows XOR instruction xor eax dword ptr [edx] in Stream UID: 00000000-00004116-15326-418-0042BF8C30:T4ca,Found reference to API "CryptUnprotectData" (Indicator: "CryptUnprotectData"; File: "00004116.00001014.16849967.00402000.wprm") Found reference to API "BCryptDecrypt" (Indicator: "BCryptDecrypt"; File: "00004116.00001014.16849967.00402000.wprm") Found reference to API "BCryptDecrypt" (Indicator: "CryptDecrypt"; File: "00004116.00001014.16849967.00402000.wprm") Found reference to API "BCryptEncrypt" (Indicator: "BCryptEncrypt"; File: "00004116.00001014.16849967.00402000.wprm") Found reference to API "BCryptEncrypt" (Indicator: "CryptEncrypt"; File: "00004116.00001014.16849967.00402000.wprm") Found reference to API "BCryptImportKey" (Indicator: "CryptImportKey"; File: "00004116.00001014.16849967.00402000.wprm") Found reference to API "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; File: "00004116.00001014.16849967.00402000.wprm") Found reference to API "BCryptDestroyKey" (Indicator: "CryptDestroyKey"; File: "00004116.00001014.16849967.00402000.wprm") Found reference to API "BCryptGetProperty" (Indicator: "BCryptGetProperty"; File: "00004116.00001014.16849967.00402000.wprm") Found reference to API "BCryptSetProperty" (Indicator: "BCryptSetProperty"; File: "00004116.00001014.16849967.00402000.wprm")31:T72c,Found reference to API "CryptUnprotectData" (Indicator: "CryptUnprotectData"; File: "00004116.00001014.16849967.00402000.wprm") Found reference to API "BCryptDecrypt" (Indicator: "BCryptDecrypt"; File: "00004116.00001014.16849967.00402000.wprm") Found reference to API "BCryptDecrypt" (Indicator: "CryptDecrypt"; File: "00004116.00001014.16849967.00402000.wprm") Found reference to API "Crypt.BCryptDecrypt() (get size) failed with status code: {0}" (Indicator: "BCryptDecrypt"; Source: "00000000-00004116.00000001.81497.00400000.00000040.mdmp") Found reference to API "Crypt.BCryptDecrypt() (get size) failed with status code: {0}" (Indicator: "CryptDecrypt"; Source: "00000000-00004116.00000001.81497.00400000.00000040.mdmp") Found reference to API "Crypt.BCryptDecrypt(): authentication tag mismatch" (Indicator: "BCryptDecrypt"; Source: "00000000-00004116.00000001.81497.00400000.00000040.mdmp") Found reference to API "Crypt.BCryptDecrypt(): authentication tag mismatch" (Indicator: "CryptDecrypt"; Source: "00000000-00004116.00000001.81497.00400000.00000040.mdmp") Found reference to API "Crypt.BCryptDecrypt() failed with status code:{0}" (Indicator: "BCryptDecrypt"; Source: "00000000-00004116.00000001.81497.00400000.00000040.mdmp") Found reference to API "Crypt.BCryptDecrypt() failed with status code:{0}" (Indicator: "CryptDecrypt"; Source: "00000000-00004116.00000001.81497.00400000.00000040.mdmp") Found reference to API "CryptUnprotectData" (Indicator: "CryptUnprotectData"; Source: "00000000-00004116.00000001.81497.00400000.00000040.mdmp") Found reference to API "BCryptDecrypt" (Indicator: "BCryptDecrypt"; Source: "00000000-00004116.00000001.81497.00400000.00000040.mdmp") Found reference to API "BCryptDecrypt" (Indicator: "CryptDecrypt"; Source: "00000000-00004116.00000001.81497.00400000.00000040.mdmp")32:T681,Contains base64 string in header "MSIE" in header "GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive" Contains base64 string in header "CLR1" in header "GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive" Contains base64 string in header "3705" in header "GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive" Contains base64 string in header "Host" in header "GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive" Contains base64 string in header "Keep" in header "GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive" Contains base64 string in header "MSIE" in header "GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org" Contains base64 string in header "CLR1" in header "GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org" Contains base64 string in header "3705" in header "GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org" Contains base64 string in header "Host" in header "GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org"33:T791,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Able to access crypto-related API (String) Matched sigs: Contains key cryptographic functions (API string) Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains ability to decode base64 data Matched sigs: Able to decrypt/decode data Matched sigs: Contains ability to encrypt/decrypt data using TripleDES Matched sigs: Able to utilize the Windows bcrypt cryptographic API Matched sigs: Contains asymmetric cryptographic functions (API string) Matched sigs: Able to import cryptographic keys (seen in ransomware) Matched sigs: Contains reference to crypto DLLs Matched sigs: Contains reference to cryptographic keys Matched sigs: Reads the cryptographic machine GUID Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Calls an API typically used to decrypt data Matched sigs: Calls an API typically used to encrypt data Matched sigs: HTTP requests contain Base64 strings Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: YARA signature match – Encryption algorithm Matched sigs: YARA signature match - Customized RC4 encryption for MSIL34:T16b8,Found XOR loop in file "HmnCSybE.exe" at offset 24943; code bytes = 30d0 Found XOR loop in file "HmnCSybE.exe" at offset 68893; code bytes = 30d0 Found XOR loop in file "HmnCSybE.exe" at offset 165200; code bytes = 30d0 Found XOR loop in file "HmnCSybE.exe" at offset 170384; code bytes = 30d0 Found XOR loop in file "HmnCSybE.exe" at offset 189158; code bytes = 30d0 Found XOR loop in file "HmnCSybE.exe" at offset 193269; code bytes = 30d0 Found XOR loop in file "HmnCSybE.exe" at offset 212594; code bytes = 30d0 Found XOR loop in file "HmnCSybE.exe" at offset 216172; code bytes = 30d0 Found XOR loop in file "HmnCSybE.exe" at offset 233892; code bytes = 30d0 Found XOR loop in file "HmnCSybE.exe" at offset 297284; code bytes = 30d0 Found XOR loop in file "HmnCSybE.exe" at offset 306475; code bytes = 30d0 Found XOR loop in file "HmnCSybE.exe" at offset 392774; code bytes = 30d0 Found XOR loop in file "HmnCSybE.exe" at offset 403993; code bytes = 30d0 Found XOR loop in file "HmnCSybE.exe" at offset 421424; code bytes = 30d0 Found XOR loop in file "HmnCSybE.exe" at offset 435117; code bytes = 30d0 Found XOR loop in file "HmnCSybE.exe" at offset 442377; code bytes = 30d0 Found XOR loop in file "HmnCSybE.exe" at offset 545038; code bytes = 30d0 Found XOR loop in file "HmnCSybE.exe" at offset 606020; code bytes = 30d0 Found XOR loop in file "HmnCSybE.exe" at offset 683175; code bytes = 30d0 Found XOR loop in file "HmnCSybE.exe" at offset 687664; code bytes = 30d0 Found XOR loop in file "HmnCSybE.exe" at offset 101444; code bytes = 33c1 Found XOR loop in file "HmnCSybE.exe" at offset 148199; code bytes = 33c1 Found XOR loop in file "HmnCSybE.exe" at offset 217730; code bytes = 33c1 Found XOR loop in file "HmnCSybE.exe" at offset 224377; code bytes = 33c1 Found XOR loop in file "HmnCSybE.exe" at offset 293488; code bytes = 33c1 Found XOR loop in file "HmnCSybE.exe" at offset 401105; code bytes = 33c1 Found XOR loop in file "HmnCSybE.exe" at offset 458748; code bytes = 33c1 Found XOR loop in file "HmnCSybE.exe" at offset 479505; code bytes = 33c1 Found XOR loop in file "HmnCSybE.exe" at offset 503271; code bytes = 33c1 Found XOR loop in file "HmnCSybE.exe" at offset 90916; code bytes = 8030 Found XOR loop in file "HmnCSybE.exe" at offset 176390; code bytes = 8030 Found XOR loop in file "HmnCSybE.exe" at offset 238530; code bytes = 8030 Found XOR loop in file "HmnCSybE.exe" at offset 256300; code bytes = 8030 Found XOR loop in file "HmnCSybE.exe" at offset 426057; code bytes = 8030 Found XOR loop in file "HmnCSybE.exe" at offset 428584; code bytes = 8030 Found XOR loop in file "HmnCSybE.exe" at offset 461348; code bytes = 8030 Found XOR loop in file "HmnCSybE.exe" at offset 477488; code bytes = 8030 Found XOR loop in file "DISMHOST.EXE.6AA9DA9A.bin" at offset 76665; code bytes = 30d0 Found XOR loop in file "DISMHOST.EXE.6AA9DA9A.bin" at offset 77648; code bytes = 8030 Found XOR loop in file "DISMHOST.EXE.6AA9DA9A.bin" at offset 77788; code bytes = 8030 Found XOR loop in file "DISMHOST.EXE.6AA9DA9A.bin" at offset 78978; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 24943; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 68893; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 165200; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 170384; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 189158; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 193269; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 212594; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 216172; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 233892; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 297284; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 306475; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 392774; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 403993; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 421424; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 435117; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 442377; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 545038; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 606020; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 683175; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 687664; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 101444; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 148199; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 217730; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 224377; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 293488; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 401105; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 458748; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 479505; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 503271; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 90916; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 176390; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 238530; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 256300; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 426057; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 428584; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 461348; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 477488; code bytes = 803035:Taf8,Found string "\Sputnik\Sputnik\User Data\Default\History" (File: "00004116.00001014.16849967.00402000.wprm") Found string "rf\User Data\Default\History" (File: "00004116.00001014.16849967.00402000.wprm") Found string "Star\User Data\Default\History" (File: "00004116.00001014.16849967.00402000.wprm") Found string "Chrome SxS\User Data\Default\History" (File: "00004116.00001014.16849967.00402000.wprm") Found string "won\Coowon\User Data\Default\History" (File: "00004116.00001014.16849967.00402000.wprm") Found string "Media\Uran\User Data\Default\History" (File: "00004116.00001014.16849967.00402000.wprm") Found string "\User Data\Default\History" (File: "00004116.00001014.16849967.00402000.wprm") Found string "um\User Data\Default\History" (File: "00004116.00001014.16849967.00402000.wprm") Found string "Browser\User Data\Default\History" (File: "00004116.00001014.16849967.00402000.wprm") Found string "\Comodo\Dragon\User Data\Default\History" (File: "00004116.00001014.16849967.00402000.wprm") Found string "y Browser\User Data\Default\History" (File: "00004116.00001014.16849967.00402000.wprm") Found string "\Amigo\User Data\Default\History" (File: "00004116.00001014.16849967.00402000.wprm") Found string "\Xpom\User Data\Default\History" (File: "00004116.00001014.16849967.00402000.wprm") Found string "Kinza\User Data\Default\History" (Source: "00000000-00004116.00000001.81497.00400000.00000040.mdmp") Found string "Sputnik\Sputnik\User Data\Default\History" (Source: "00000000-00004116.00000001.81497.00400000.00000040.mdmp") Found string "MapleStudio\ChromePlus\User Data\Default\History" (Source: "00000000-00004116.00000001.81497.00400000.00000040.mdmp") Found string "QIP Surf\User Data\Default\History" (Source: "00000000-00004116.00000001.81497.00400000.00000040.mdmp") Found string "BlackHawk\User Data\Default\History" (Source: "00000000-00004116.00000001.81497.00400000.00000040.mdmp") Found string "7Star\7Star\User Data\Default\History" (Source: "00000000-00004116.00000001.81497.00400000.00000040.mdmp") Found string "CatalinaGroup\Citrio\User Data\Default\History" (Source: "00000000-00004116.00000001.81497.00400000.00000040.mdmp") Found string "Google\Chrome SxS\User Data\Default\History" (Source: "00000000-00004116.00000001.81497.00400000.00000040.mdmp") Found string "Google\Chrome\User Data\Default\History" (Source: "00000000-00004116.00000001.81497.00400000.00000040.mdmp") Found string "Coowon\Coowon\User Data\Default\History" (Source: "00000000-00004116.00000001.81497.00400000.00000040.mdmp") Found string "CocCoc\Browser\User Data\Default\History" (Source: "00000000-00004116.00000001.81497.00400000.00000040.mdmp") Found string "uCozMedia\Uran\User Data\Default\History" (Source: "00000000-00004116.00000001.81497.00400000.00000040.mdmp")36:T80e,"ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005768) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005768) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000014000000000000000000000000000000000000000000000002000002183610009b0300980000000000000000000000008000000000000000716c001d887710000100000000000000020000000c000000c82e1000c82e1000c32e1000000000000000000000000b0000000001c8ef310000000000e8f5310095e19e7702081a00feffffff435ca2775059a27794000000a0000000c22e1000c02e1000940000006cf13100fdfe3d764cea310001000000e8f5310092e07b6ac06814abfeffffff04f131004c9c7b6a5c0c000018f131005f9c7b6a0000000000000000 (UID: 00000000-00005768)37:T14e0,"ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000001005c00530020f90f000f00010e19ea000e63006f006e00660069006700750072006100740069006f006e00000055004200570053005c0041000b00000b63ea00001836100068a30f006f00630061006c005c00500072006f0067007200 (UID: 00000000-00005768) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310076f5f6a277e2f28977f42e0d7240400f00a0350d72b2f28977f0e83100b0190f00b2f4a27782f2897700e931000000067200000672000000005ce83100f0000000f0000672000000006ce831005300000000ea31000000000001000000d0e8310040f5a2770000000000000000bce83100 (UID: 00000000-00005768) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031007f02000000000000008c473674604616008c4736740000000060461600ecdb3100086da2771881aa7700000000a0dc310000000000de5450642cdc310095e19e77ea0b1a00feffffff6b2ca3773119a47502100000000000000000010000dc3100c89fa2778c4736740000000000000000 (UID: 00000000-00005768) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005768) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eb7577389816000060fd7f9a5ca37700f0fd7f9cdd31004460fd7f00000000400000003f0000001d0000000060fd7f90dd3100c15ca3776082aa771d0000000060fd7f9a5ca37700f0fd7fb4dd31005789a2778083aa771317a475d8eb7577 (UID: 00000000-00005768) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005768) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000220000000000000000000000240000000d00000000000000010000008ca713008000000000000000000000002200000000000000000000002400000002000000000000000000000090a81300180000000000000000000000220000000000000000000000240000000d00000000000000 (UID: 00000000-00006100) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000095e19e77015d1a00fefffffff5f6a277634da377d81d12001015896c88088900b2f4a27725bb157724efad000000886c0000886c804da37701bb1577f0000000f000886c0000000090eead005c00430024f0ad000000000001000000f4eead0040f5a2770000000000000000e0eead00 (UID: 00000000-00006100) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031006a90eead0001000000000000000000b377000000007ceead0000000000000000000000000090eead00000000000000000000000000087453d584eead000300000000000000880000000000b37790eead00459de475000078000000000080000000020000000000ae00dc1a886ca4eead00 (UID: 00000000-00006100) "powershell.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006100) "powershell.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eb7577e090200100f0fd7f9a5ca37700f0fa7f60d4ce0444f0fd7f00000000400000003f0000002500000000f0fd7f54d4ce04c15ca3776082aa772500000000f0fd7f9a5ca37700f0fa7f78d4ce045789a2778083aa771317a475d8eb7577 (UID: 00000000-00006100) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000001005c005300600d52001100001170b00000589a5300e0b05200b1080000aaa8640000200000b0080000580f00000d004200a2000000b1080000a1000000a1080000c9570000000000000000000036a8ffff5c00500000000000b1080000 (UID: 00000000-00004116) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000f5f6a277f1b79377f42e0d72684a5a00a0350d7221b79377d0eb2b00d0175200b2f4a277d1b79377e0eb2b000000067200000672000000003ceb2b00f0000000f0000672000000004ceb2b0053000000e0ec2b000000000001000000b0eb2b0040f5a27700000000000000009ceb2b00 (UID: 00000000-00004116)38:T44e,Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; File: "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; File: "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; File: "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; File: "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00004084.00000001.83492.00381000.00000020.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00004084.00000001.83492.00381000.00000020.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00004084.00000001.83492.00381000.00000020.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00004084.00000001.83492.00381000.00000020.mdmp")39:Td34,"ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "ENABLEDHCP"; Value: "") "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTRATIONENABLED"; Value: "") "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTERADAPTERNAME"; Value: "") "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DOMAIN"; Value: "") "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPDOMAIN"; Value: "") "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "NAMESERVER"; Value: "") "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPNAMESERVER"; Value: "") "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "NAMESERVER"; Value: "") "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPNAMESERVER"; Value: "")3a:T1006,"ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" queries volume information of "C:\ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" at 00000000-00005768-0000010C-3461979 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00006100-0000010C-2287832 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00006100-0000010C-3473187 "powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00006100-0000010C-4595978 "powershell.exe" queries volume information of "C:\share" at 00000000-00006100-0000010C-4599033 "powershell.exe" queries volume information of "C:\share" at 00000000-00006100-0000010C-4784485 "powershell.exe" queries volume information of "C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.dll" at 00000000-00006100-0000010C-7088577 "powershell.exe" queries volume information of "C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.dll" at 00000000-00006100-0000010C-7097234 "powershell.exe" queries volume information of "C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.dll" at 00000000-00006100-0000010C-7737421 "powershell.exe" queries volume information of "C:\Windows\assembly\GAC_32\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.dll" at 00000000-00006100-0000010C-7741490 "powershell.exe" queries volume information of "C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.dll" at 00000000-00006100-0000010C-7745073 "powershell.exe" queries volume information of "C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll" at 00000000-00006100-0000010C-8265105 "powershell.exe" queries volume information of "C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll" at 00000000-00006100-0000010C-8495861 "powershell.exe" queries volume information of "C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll" at 00000000-00006100-0000010C-12383091 "powershell.exe" queries volume information of "C:\Windows\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.SDEngine.dll" at 00000000-00006100-0000010C-12389875 "powershell.exe" queries volume information of "C:\Program Files\AutoIt3\AutoItX\AutoItX3.PowerShell.dll" at 00000000-00006100-0000010C-12448270 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" queries volume information of "C:\ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" at 00000000-00004116-0000010C-3568826 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll" at 00000000-00004116-0000010C-27172531 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll" at 00000000-00004116-0000010C-271805673b:T5a7,"powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\2E4916B07F3DE90C8DDE2566FD9B9B400D89BBBA"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\E6A3B45B062D509B3382282D196EFE97D5956CCB"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\F5AD0BCC1AD56CD150725B1C866C30AD92EF21B0"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB")3c:T410,"ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00005768) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00005768) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00005768) "powershell.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00006100) "powershell.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00006100) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00004116) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00004116)3d:T9d98,"ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005768) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005768) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005768) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005768) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005768) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00005768) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005768) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00005768) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00005768) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00005768) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00005768) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005768) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00005768) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00005768) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00005768) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00005768) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00005768) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00005768) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00005768) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005768) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00005768) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00005768) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00005768) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00005768) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll (UID: 00000000-00005768) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll (UID: 00000000-00005768) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005768) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005768) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00005768) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00005768) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00005768) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00005768) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00005768) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00005768) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00005768) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005768) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005768) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00005768) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00005768) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00005768) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00005768) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00005768) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00005768) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00005768) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00005768) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter %WINDIR%\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\gdiplus.dll (UID: 00000000-00005768) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00005768) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00005768) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00005768) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00005768) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter WindowsCodecs.dll (UID: 00000000-00005768) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00005768) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\IconCodecService.dll (UID: 00000000-00005768) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\a891970b44db9e340c3ef3efa95b793c\Microsoft.VisualBasic.ni.dll (UID: 00000000-00005768) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00005768) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00005768) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00005768) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00005768) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00005768) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00005768) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00005768) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00005768) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00005768) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00005768) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00005768) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Pb378ec07#\d254c63bedcb76c81c3125bd527b7d1a\Microsoft.PowerShell.ConsoleH (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Manaa57fc8cc#\73a1a80aed03e789a49cec899b7505dd\System.Management.Automation. (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automatio (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter MSISIP.DLL (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CRYPT32.dll (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\wshext.dll (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\WindowsPowerShell\v1.0\pwrshsip.dll (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Data\df2dd09ed7c341842a104e1e668f184e\System.Data.ni.dll (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Management\e114780fd3ea5727401c06ea4f22ef35\System.Management.ni.dll (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Dired13b18a9#\2e76676fbd265f70be92c82bbf76b8e5\System.DirectoryServices.ni.d (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.P6f792626#\05765f777020deeddc8ad54b48343b9c\Microsoft.PowerShell.Security (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Mf49f6405#\f0821980bfe2fc8375ccfc37dbe6e9d8\Microsoft.Management.Infrastr (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Transactions\3d760b4a3260a41ef84a3fd866780980\System.Transactions.ni.dll (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Numerics\e7d6ed984300c7212c6e682c4f730b1e\System.Numerics.ni.dll (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.CSharp\f73f48afb5512225dedaee9c88ac5050\Microsoft.CSharp.ni.dll (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter WINTRUST.dll (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.M870d558a#\7ceb6b903321c16b12386a8df1be50f9\Microsoft.Management.Infrastr (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Pae3498d9#\8dcf1daed985f481eed5cca9d2945c18\Microsoft.PowerShell.Commands (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Confe64a9051#\1561b93d6d25c4a9c3e2659ab29a5e73\System.Configuration.Install. (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter ncrypt.dll (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\bcryptprimitives.dll (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter WINTRUST.DLL (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\cryptnet.dll (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter cryptnet.dll (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter SensApi.dll (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter profapi.dll (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00006100) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00006100) "schtasks.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00006132) "schtasks.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00006132) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004116) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004116) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004116) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004116) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004116) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00004116) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00004116) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00004116) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00004116) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00004116) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00004116) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004116) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00004116) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00004116) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00004116) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00004116) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00004116) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00004116) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00004116) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004116) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00004116) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00004116) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00004116) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00004116) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll (UID: 00000000-00004116) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll (UID: 00000000-00004116) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00004116) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\a891970b44db9e340c3ef3efa95b793c\Microsoft.VisualBasic.ni.dll (UID: 00000000-00004116) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004116) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004116) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00004116) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004116) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00004116) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00004116) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00004116) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00004116) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00004116) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00004116) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00004116) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00004116) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00004116) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00004116) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00004116) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll (UID: 00000000-00004116) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter rasapi32.dll (UID: 00000000-00004116) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00004116) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00004116) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter RASMAN.DLL (UID: 00000000-00004116) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter rtutils.dll (UID: 00000000-00004116) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-winsvc-L1-1-0.dll (UID: 00000000-00004116) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L1-1-0.dll (UID: 00000000-00004116) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll (UID: 00000000-00004116) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00004116) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00004116) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00004116) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00004116) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00004116) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter NSI.dll (UID: 00000000-00004116) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter CFGMGR32.dll (UID: 00000000-00004116) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00004116) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00004116) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00004116) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00004116) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L2-1-0.dll (UID: 00000000-00004116) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll (UID: 00000000-00004116) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00004116) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00004116) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00004116) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter ncrypt.dll (UID: 00000000-00004116) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\bcryptprimitives.dll (UID: 00000000-00004116) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00004116) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00004116) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll (UID: 00000000-00004116) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00004116) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00004116) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00004116) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00004116) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe (UID: 00000000-00004116) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll (UID: 00000000-00004116) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00004116) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00004116) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00004116) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Security\93d03eb9812405fa70e89d4efd5f7e14\System.Security.ni.dll (UID: 00000000-00004116) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00004116) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00004116) "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00004116)3e:T5e8,"Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00004116.00001014.16849967.00402000.wprm "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00004084.00000001.83492.00381000.00000020.mdmp "BraveSoftware\Brave-Browser\User Data\Default\Network\Cookies" in Source: 00000000-00004116.00000001.81497.00400000.00000040.mdmp "raveSoftware\Brave-Browser" in Source: 00000000-00004116.00000001.81497.00400000.00000040.mdmp "BraveSoftware\Brave-Browser\User Data\Default\Web Data" in Source: 00000000-00004116.00000001.81497.00400000.00000040.mdmp "BraveSoftware\Brave-Browser\User Data\Default\Login Data" in Source: 00000000-00004116.00000001.81497.00400000.00000040.mdmp "AVAST Software\Browser\User Data\Default\Login Data" in Source: 00000000-00004116.00000001.81497.00400000.00000040.mdmp "BraveSoftware\Brave-Browser\User Data\Default\Top Sites" in Source: 00000000-00004116.00000001.81497.00400000.00000040.mdmp "BraveSoftware\Brave-Browser\User Data\Default\History" in Source: 00000000-00004116.00000001.81497.00400000.00000040.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00005768.00000001.79279.000B0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00005768.00000001.79279.000B0000.00000004.mdmp3f:T1e2c,"ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" failed to load missing module "amsi.dll" - [base:0; Status:c0000135] "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll" - [base:0; Status:c0000135] "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll" - [base:0; Status:c0000135] "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" - [base:0; Status:c0000135] "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135]40:T558,"Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00004084.00000001.83492.00381000.00000020.mdmp "BraveSoftware\Brave-Browser\User Data\Default\Network\Cookies" in Source: 00000000-00004116.00000001.81497.00400000.00000040.mdmp "raveSoftware\Brave-Browser" in Source: 00000000-00004116.00000001.81497.00400000.00000040.mdmp "BraveSoftware\Brave-Browser\User Data\Default\Web Data" in Source: 00000000-00004116.00000001.81497.00400000.00000040.mdmp "BraveSoftware\Brave-Browser\User Data\Default\Login Data" in Source: 00000000-00004116.00000001.81497.00400000.00000040.mdmp "AVAST Software\Browser\User Data\Default\Login Data" in Source: 00000000-00004116.00000001.81497.00400000.00000040.mdmp "BraveSoftware\Brave-Browser\User Data\Default\Top Sites" in Source: 00000000-00004116.00000001.81497.00400000.00000040.mdmp "BraveSoftware\Brave-Browser\User Data\Default\History" in Source: 00000000-00004116.00000001.81497.00400000.00000040.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00005768.00000001.79279.000B0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00005768.00000001.79279.000B0000.00000004.mdmp41:Tf4d,"GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Date: Mon 14 Sep 2026 19:49:39 GMT Content-Type: text/html Content-Length: 105 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Access-Control-Allow-Origin: * with response body ==>3C68746D6C3E3C686561643E3C7469746C653E43757272656E7420495020436865636B3C2F7469746C653E3C2F686561643E3C626F64793E43757272656E7420....... "GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org" Response ==> HTTP/1.1 200 OK Date: Mon 14 Sep 2026 19:49:39 GMT Content-Type: text/html Content-Length: 105 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Access-Control-Allow-Origin: * with response body ==>3C68746D6C3E3C686561643E3C7469746C653E43757272656E7420495020436865636B3C2F7469746C653E3C2F686561643E3C626F64793E43757272656E7420....... "GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org" Response ==> HTTP/1.1 200 OK Date: Mon 14 Sep 2026 19:49:43 GMT Content-Type: text/html Content-Length: 105 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Access-Control-Allow-Origin: * with response body ==>3C68746D6C3E3C686561643E3C7469746C653E43757272656E7420495020436865636B3C2F7469746C653E3C2F686561643E3C626F64793E43757272656E7420....... "GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org" Response ==> HTTP/1.1 200 OK Date: Mon 14 Sep 2026 19:49:45 GMT Content-Type: text/html Content-Length: 105 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Access-Control-Allow-Origin: * with response body ==>3C68746D6C3E3C686561643E3C7469746C653E43757272656E7420495020436865636B3C2F7469746C653E3C2F686561643E3C626F64793E43757272656E7420....... "GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org" Response ==> HTTP/1.1 200 OK Date: Mon 14 Sep 2026 19:49:46 GMT Content-Type: text/html Content-Length: 105 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Access-Control-Allow-Origin: * with response body ==>3C68746D6C3E3C686561643E3C7469746C653E43757272656E7420495020436865636B3C2F7469746C653E3C2F686561643E3C626F64793E43757272656E7420....... "GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org" Response ==> HTTP/1.1 200 OK Date: Mon 14 Sep 2026 19:49:47 GMT Content-Type: text/html Content-Length: 105 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Access-Control-Allow-Origin: * with response body ==>3C68746D6C3E3C686561643E3C7469746C653E43757272656E7420495020436865636B3C2F7469746C653E3C2F686561643E3C626F64793E43757272656E7420....... "GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org" Response ==> HTTP/1.1 200 OK Date: Mon 14 Sep 2026 19:49:48 GMT Content-Type: text/html Content-Length: 105 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Access-Control-Allow-Origin: * with response body ==>3C68746D6C3E3C686561643E3C7469746C653E43757272656E7420495020436865636B3C2F7469746C653E3C2F686561643E3C626F64793E43757272656E7420....... "GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org" Response ==> HTTP/1.1 200 OK Date: Mon 14 Sep 2026 19:49:50 GMT Content-Type: text/html Content-Length: 105 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Access-Control-Allow-Origin: * with response body ==>3C68746D6C3E3C686561643E3C7469746C653E43757272656E7420495020436865636B3C2F7469746C653E3C2F686561643E3C626F64793E43757272656E7420.......42:T5049,"ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 712e0000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "KERNEL32" at base 76390000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "ADVAPI32.DLL" at base 76a00000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 6be20000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "SHLWAPI.DLL" at base 77820000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "VERSION.DLL" at base 74d70000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 64410000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "USER32.DLL" at base 77b50000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "MSCOREE.DLL" at base 6beb0000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "PSAPI.DLL" at base 77b20000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "RPCRT4.DLL" at base 77770000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "KERNEL32.DLL" at base 76390000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 63000000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "OLE32.DLL" at base 768a0000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "CRYPTBASE.DLL" at base 757d0000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 743b0000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 743a0000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 6a800000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 625a0000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DRAWING\F7568D7F1B9D356F64779B4C0927CFB3\SYSTEM.DRAWING.NI.DLL" at base 6a020000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.WINDOWS.FORMS\C9A4CBC00F690A9E3CDDFC400F6E85BB\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 61730000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "UXTHEME.DLL" at base 743b0000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 60f10000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 6a670000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 60790000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 6d0d0000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "NTDLL.DLL" at base 779d0000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "SHELL32.DLL" at base 76ab0000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 77700000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "PROFAPI.DLL" at base 758f0000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "BCRYPT.DLL" at base 753f0000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "CRYPTSP.DLL" at base 752e0000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 75070000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "IMM32.DLL" at base 77b30000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "COMCTL32.DLL" at base 72060000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "GDI32.DLL" at base 75f30000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "GDIPLUS.DLL" at base 741f0000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "%WINDIR%\WINSXS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.7601.23894_NONE_5C0BE957A009922E\GDIPLUS.DLL" at base 741f0000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 76390000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "WINDOWSCODECS.DLL" at base 73c80000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "%WINDIR%\SYSTEM32\ICONCODECSERVICE.DLL" at base 700c0000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.V9921E851#\A891970B44DB9E340C3EF3EFA95B793C\MICROSOFT.VISUALBASIC.NI.DLL" at base 69da0000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "NTDLL" at base 779d0000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "NTMARTA.DLL" at base 74d40000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "SSPICLI.DLL" at base 75760000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "PROPSYS.DLL" at base 744a0000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "COMCTL32.DLL" at base 747d0000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "OLEAUT32.DLL" at base 766b0000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "APPHELP.DLL" at base 75780000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "CLBCATQ.DLL" at base 75c10000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "%WINDIR%\SYSTEM32\IEFRAME.DLL" at base 6ae00000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 744a0000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base 75bb0000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 77880000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "SETUPAPI.DLL" at base 75ca0000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "SECUR32.DLL" at base 75600000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 75910000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75780000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 77700000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "RPCRTREMOTE.DLL" at base 75870000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 69f90000 "powershell.exe" loaded module "USER32.DLL" at base 77b50000 "powershell.exe" loaded module "MSCOREE.DLL" at base 6beb0000 "powershell.exe" loaded module "PSAPI.DLL" at base 77b20000 "powershell.exe" loaded module "RPCRT4.DLL" at base 77770000 "powershell.exe" loaded module "KERNEL32.DLL" at base 76390000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSCOREE.DLL" at base 6beb0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 63000000 "powershell.exe" loaded module "OLE32.DLL" at base 768a0000 "powershell.exe" loaded module "CRYPTBASE.DLL" at base 757d0000 "powershell.exe" loaded module "OLEAUT32.DLL" at base 766b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 625a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 60f10000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.PB378EC07#\D254C63BEDCB76C81C3125BD527B7D1A\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 69d10000 "powershell.exe" loaded module "CRYPTSP.DLL" at base 752e0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 75070000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 76a00000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.MANAA57FC8CC#\73A1A80AED03E789A49CEC899B7505DD\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 5eca0000 "powershell.exe" loaded module "NTDLL.DLL" at base 779d0000 "powershell.exe" loaded module "VERSION.DLL" at base 74d70000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 6d0d0000 "powershell.exe" loaded module "SHELL32.DLL" at base 76ab0000 "powershell.exe" loaded module "WINTRUST.DLL" at base 75be0000 "powershell.exe" loaded module "MSISIP.DLL" at base 74390000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 75a80000 "powershell.exe" loaded module "IMM32.DLL" at base 77b30000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 6c880000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWSPOWERSHELL\V1.0\PWRSHSIP.DLL" at base 6cfd0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DATA\DF2DD09ED7C341842A104E1E668F184E\SYSTEM.DATA.NI.DLL" at base 5e480000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 5e120000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 60790000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.MANAGEMENT\E114780FD3EA5727401C06EA4F22EF35\SYSTEM.MANAGEMENT.NI.DLL" at base 69be0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DIRED13B18A9#\2E76676FBD265F70BE92C82BBF76B8E5\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 699e0000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 743a0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 6a800000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.P6F792626#\05765F777020DEEDDC8AD54B48343B9C\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 6bc60000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.MF49F6405#\F0821980BFE2FC8375CCFC37DBE6E9D8\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 6a5f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.TRANSACTIONS\3D760B4A3260A41EF84A3FD866780980\SYSTEM.TRANSACTIONS.NI.DLL" at base 69920000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 698d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.NUMERICS\E7D6ED984300C7212C6E682C4F730B1E\SYSTEM.NUMERICS.NI.DLL" at base 69880000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 6a670000 "powershell.exe" loaded module "SECUR32.DLL" at base 75600000 "powershell.exe" loaded module "SSPICLI.DLL" at base 75760000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 77820000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.CSHARP\F73F48AFB5512225DEDAEE9C88AC5050\MICROSOFT.CSHARP.NI.DLL" at base 69df0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 743b0000 "powershell.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 77700000 "powershell.exe" loaded module "RPCRTREMOTE.DLL" at base 75870000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.M870D558A#\7CEB6B903321C16B12386A8DF1BE50F9\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.NI.DLL" at base 6a140000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.PAE3498D9#\8DCF1DAED985F481EED5CCA9D2945C18\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 67b60000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFE64A9051#\1561B93D6D25C4A9C3E2659AB29A5E73\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 6a110000 "powershell.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base 75bb0000 "powershell.exe" loaded module "URLMON.DLL" at base 77880000 "powershell.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 75910000 "powershell.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L2-1-0.DLL" at base 71b00000 "powershell.exe" loaded module "NCRYPT.DLL" at base 75410000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 74fb0000 "powershell.exe" loaded module "USERENV.DLL" at base 759b0000 "powershell.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 77700000 "powershell.exe" loaded module "GPAPI.DLL" at base 74eb0000 "powershell.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL" at base 77700000 "powershell.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL" at base 77700000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 71f50000 "powershell.exe" loaded module "CRYPTNET.DLL" at base 71f50000 "powershell.exe" loaded module "SENSAPI.DLL" at base 6a0f0000 "powershell.exe" loaded module "PROFAPI.DLL" at base 758f0000 "powershell.exe" loaded module "CRYPT32.DLL" at base 75a80000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\DIASYMREADER.DLL" at base 695c0000 "powershell.exe" loaded module "GDI32.DLL" at base 75f30000 "powershell.exe" loaded module "BCRYPT.DLL" at base 753f0000 "schtasks.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 69f90000 "schtasks.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 743b0000 "schtasks.exe" loaded module "RPCRT4.DLL" at base 77770000 "schtasks.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 77700000 "schtasks.exe" loaded module "ADVAPI32.DLL" at base 76a00000 "schtasks.exe" loaded module "CLBCATQ.DLL" at base 75c10000 "schtasks.exe" loaded module "%WINDIR%\SYSTEM32\TASKSCHD.DLL" at base 73ee0000 "schtasks.exe" loaded module "SSPICLI.DLL" at base 75760000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 69f90000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DRAWING\F7568D7F1B9D356F64779B4C0927CFB3\SYSTEM.DRAWING.NI.DLL" at base 696d0000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.WINDOWS.FORMS\C9A4CBC00F690A9E3CDDFC400F6E85BB\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 5d2b0000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.V9921E851#\A891970B44DB9E340C3EF3EFA95B793C\MICROSOFT.VISUALBASIC.NI.DLL" at base 69070000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "RASAPI32.DLL" at base 6c1d0000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "RTUTILS.DLL" at base 736e0000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL" at base 77700000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL" at base 77700000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "WS2_32.DLL" at base 75ef0000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 752a0000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 74e00000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 75290000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "RASMAN.DLL" at base 721e0000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "WINHTTP.DLL" at base 71be0000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "CREDSSP.DLL" at base 74f70000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "IPHLPAPI.DLL" at base 73c30000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "DHCPCSVC6.DLL" at base 73b40000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "DHCPCSVC.DLL" at base 73ac0000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "NSI.DLL" at base 76880000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "CFGMGR32.DLL" at base 75a00000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL" at base 77700000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "DNSAPI.DLL" at base 75160000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "RASADHLP.DLL" at base 71f20000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 73b60000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 750e0000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "NCRYPT.DLL" at base 75410000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 74fb0000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "CRYPT32.DLL" at base 75a80000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "USERENV.DLL" at base 759b0000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "GPAPI.DLL" at base 74eb0000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "OLEAUT32" at base 766b0000 "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.SECURITY\93D03EB9812405FA70E89D4EFD5F7E14\SYSTEM.SECURITY.NI.DLL" at base 69eb000043:T125a,"ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" touched "Recycle Bin" (Path: "HKCU\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" touched "Control Panel" (Path: "HKCU\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" touched "UsersLibraries" (Path: "HKCU\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" touched "CLSID_SearchFolder" (Path: "HKCU\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" touched "Microsoft OneNote Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER") "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" touched "@C:\Program Files (x86)\Microsoft Office\Office15\MAPISHELL.DLL,-110" (Path: "HKCU\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER") "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" touched "Public Folder" (Path: "HKCU\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" touched "DXP" (Path: "HKCU\CLSID\{8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}\SHELLFOLDER") "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" touched "CLSID_SearchHome" (Path: "HKCU\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" touched "Windows Search Service Media Center Namespace Extension Handler" (Path: "HKCU\CLSID\{98D99750-0B8A-4C59-9151-589053683D73}\SHELLFOLDER") "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" touched "Other Users Folder" (Path: "HKCU\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" touched "Games Explorer" (Path: "HKCU\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER") "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" touched "Computers and Devices" (Path: "HKCU\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" touched "Sticky Notes Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{F3F5824C-AD58-4728-AF59-A1EBE3392799}\SHELLFOLDER") "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" touched "Security Manager" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}") "powershell.exe" touched "NDP SymBinder" (Path: "HKCU\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\INPROCSERVER32")44:Tc1b,"ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "HmnCSybE.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "DISMHOST.EXE.6AA9DA9A.bin" file has an entrypoint instructions - "call 0x100a7e6,jmp 0x10097f4,int3 ,int3 ,int3 ,int3 ,int3 ,push 0x14,push 0x1010878,call 0x1009d10,and dword ptr [ebp - 4], 0,dec dword ptr [ebp + 0x10],js 0x1009afc,mov ecx, dword ptr [ebp + 8],sub ecx, dword ptr [ebp + 0xc],mov dword ptr [ebp + 8], ecx,call dword ptr [ebp + 0x14],jmp 0x1009abc,mov eax, dword ptr [ebp - 0x14],mov dword ptr [ebp - 0x1c], eax,mov eax, dword ptr [ebp - 0x1c],mov eax, dword ptr [eax],mov dword ptr [ebp - 0x20], eax,mov eax, dword ptr [ebp - 0x20],cmp dword ptr [eax], 0xe06d7363,je 0x1009af3,mov dword ptr [ebp - 0x24], 0,mov eax, dword ptr [ebp - 0x24],ret ,call dword ptr [0x1001210],mov esp, dword ptr [ebp - 0x18],"45:T7d8,"ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SYEARMONTH") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "AR") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "AR") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "AR-SA") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "AR-SA") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "BG") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "BG") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "BG-BG") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "BG-BG")46:T1010,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00005768-00000C2B-229042655] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00005768-00000C2B-229408933] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00005768-00000C2B-230651963] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00005768-00000C2B-230800679] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00005768-00000C2B-231095955] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00005768-00000C2B-231170510] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00005768-00000C2B-231321788] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00005768-00000C2B-231692743] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00005768-00000C2B-231788103] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll" [Source: 00000000-00005768-00000C2B-231874636] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll" [Source: 00000000-00005768-00000C2B-231984301] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" [Source: 00000000-00005768-00000C2B-232217646] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00005768-00000C2B-232451882] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" [Source: 00000000-00005768-00000C2B-232522829] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00005768-00000C2B-232607325] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll" [Source: 00000000-00005768-00000C2B-232681943] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00005768-00000C2B-233188379] Observed system executable string:"%WINDIR%\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\gdiplus.dll" [Source: 00000000-00005768-00000C2B-234114437] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00005768-00000C2B-235236541] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00005768-00000C2B-235330664] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll" [Source: 00000000-00005768-00000C2B-235423898] Observed system executable string:"%WINDIR%\system32\IconCodecService.dll" [Source: 00000000-00005768-00000C2B-235797485] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\a891970b44db9e340c3ef3efa95b793c\Microsoft.VisualBasic.ni.dll" [Source: 00000000-00005768-00000C2B-236598885] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00005768-00000C2B-237956310] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00006100-00000C2B-242807002]47:T5a6,The input sample is signed with a certificate issued by "CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com Inc.", L=Scottsdale, ST=Arizona, C=US" (SHA1: EC:27:13:72:1E:6C:94:9F:47:59:A4:24:4F:AB:9B:02:E3:6E:54:41; see report for more information) The input sample is signed with a certificate issued by "CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com Inc.", L=Scottsdale, ST=Arizona, C=US" (SHA1: 27:AC:93:69:FA:F2:52:07:BB:26:27:CE:FA:CC:BE:4E:F9:C3:19:B8; see report for more information) The input sample is signed with a certificate issued by "CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com Inc.", L=Scottsdale, ST=Arizona, C=US" (SHA1: 47:BE:AB:C9:22:EA:E8:0E:78:78:34:62:A7:9F:45:C2:54:FD:E6:8B; see report for more information) The input sample is signed with a certificate issued by "CN=WE1, O=Google Trust Services, C=US" (SHA1: 7D:CC:19:E6:DD:89:86:66:35:DB:DC:14:88:AC:3E:E7:E4:51:71:2F; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R4, O=Google Trust Services LLC, C=US" (SHA1: 10:8F:BF:79:4E:18:EC:53:47:A4:14:E4:37:0C:C4:50:6C:29:7A:B2; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 93:2B:ED:33:9A:A6:92:12:C8:93:75:B7:93:04:B4:75:49:0B:89:A0; see report for more information)48:Tbd4,"ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: ""; Value: "") "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: ""; Value: "") "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SHELLCOMPATIBILITY\APPLICATIONS\EC2687F0E226016D1CEC0764216B00675B8BDA746AA9606053F62F3ED799F3D6.EXE"; Key: ""; Value: "") "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE\ASSEMBLYSTORAGEROOTS"; Key: ""; Value: "") "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\DELEGATEFOLDERS"; Key: ""; Value: "") "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE"; Key: ""; Value: "") "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{031E4825-7B94-4DC3-B131-E946B44C8DD5}"; Key: ""; Value: "") "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{04731B67-D933-450A-90E6-4ACD2E9408FE}"; Key: ""; Value: "") "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}"; Key: ""; Value: "") "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{11016101-E366-4D22-BC06-4ADA335C892B}"; Key: ""; Value: "") "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}"; Key: ""; Value: "") "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE"; Key: ""; Value: "") "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\DELEGATEFOLDERS"; Key: ""; Value: "")49:T1582,"ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{031E4825-7B94-4DC3-B131-E946B44C8DD5}"; Key: "SUPPRESSIONPOLICY"; Value: "") "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{04731B67-D933-450A-90E6-4ACD2E9408FE}"; Key: "SUPPRESSIONPOLICY"; Value: "") "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}"; Key: "SUPPRESSIONPOLICY"; Value: "") "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{11016101-E366-4D22-BC06-4ADA335C892B}"; Key: "SUPPRESSIONPOLICY"; Value: "") "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}"; Key: "SUPPRESSIONPOLICY"; Value: "") "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "ATTRIBUTES"; Value: "") "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "CALLFORATTRIBUTES"; Value: "") "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "RESTRICTEDATTRIBUTES"; Value: "") "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "WANTSFORDISPLAY"; Value: "") "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "HIDEFOLDERVERBS"; Value: "") "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "USEDROPHANDLER"; Value: "") "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "WANTSFORPARSING"; Value: "") "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "WANTSPARSEDISPLAYNAME"; Value: "") "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "QUERYFOROVERLAY"; Value: "") "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "MAPNETDRIVEVERBS"; Value: "") "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "QUERYFORINFOTIP"; Value: "") "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "HIDEINWEBVIEW"; Value: "") "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "HIDEONDESKTOPPERUSER"; Value: "") "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "WANTSALIASEDNOTIFICATIONS"; Value: "") "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "WANTSUNIVERSALDELEGATE"; Value: "") "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "NOFILEFOLDERJUNCTION"; Value: "") "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "PINTONAMESPACETREE"; Value: "") "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "HASNAVIGATIONENUM"; Value: "")4a:T6e5,"ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\config\machine.config" "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll.aux" "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.windows.forms\c9a4cbc00f690a9e3cddfc400f6e85bb\system.windows.forms.ni.dll.aux" "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\0b2f69b43a576b9edcc807a30872bd91\system.ni.dll.aux" "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\2c3c912ea8f058f9d04c4650128feb3f\system.ni.dll.aux" "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.drawing\f7568d7f1b9d356f64779b4c0927cfb3\system.drawing.ni.dll.aux" "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.configuration\96f7edb07b12303f0ec2595c7f3778c7\system.configuration.ni.dll.aux" "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.core\31fae3290fad30c31c98651462d22724\system.core.ni.dll.aux" "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.xml\15af16d373cf0528cb74fc73d365fdbf\system.xml.ni.dll.aux"4b:Tcfc,"ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" trying to touch file "C:\Windows\SYSTEM32\MSCOREE.DLL" "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" trying to touch file "C:\FLTLIB.DLL" "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" trying to touch file "C:\Windows\system32\FLTLIB.DLL" "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" trying to touch file "C:\MSVCP140.dll" "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" trying to touch file "C:\Windows\system32\MSVCP140.dll" "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" trying to touch file "C:\VCRUNTIME140.dll" "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" trying to touch file "C:\Windows\system32\VCRUNTIME140.dll" "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" trying to touch file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" trying to touch file "C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll" "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" trying to touch file "C:\ucrtbase.DLL" "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" trying to touch file "C:\Windows\system32\ucrtbase.DLL" "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" trying to touch file "C:\api-ms-win-core-timezone-l1-1-0.dll" "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-timezone-l1-1-0.dll" "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" trying to touch file "C:\api-ms-win-core-file-l2-1-0.dll" "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-file-l2-1-0.dll" "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" trying to touch file "C:\api-ms-win-core-localization-l1-2-0.dll" "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-localization-l1-2-0.dll" "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" trying to touch file "C:\api-ms-win-core-synch-l1-2-0.dll" "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-synch-l1-2-0.dll" "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" trying to touch file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-processthreads-l1-1-1.dll" "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" trying to touch file "C:\api-ms-win-core-file-l1-2-0.dll" "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-file-l1-2-0.dll"4c:Tcf7,"ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" trying to access non-existent file "C:\FLTLIB.DLL" "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" trying to access non-existent file "C:\MSVCP140.dll" "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" trying to access non-existent file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" trying to access non-existent file "C:\ucrtbase.DLL" "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" trying to access non-existent file "C:\api-ms-win-core-timezone-l1-1-0.dll" "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" trying to access non-existent file "C:\api-ms-win-core-file-l2-1-0.dll" "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" trying to access non-existent file "C:\api-ms-win-core-localization-l1-2-0.dll" "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" trying to access non-existent file "C:\api-ms-win-core-synch-l1-2-0.dll" "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" trying to access non-existent file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" trying to access non-existent file "C:\api-ms-win-core-file-l1-2-0.dll" "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" trying to access non-existent file "C:\api-ms-win-crt-heap-l1-1-0.dll" "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" trying to access non-existent file "C:\api-ms-win-crt-string-l1-1-0.dll" "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" trying to access non-existent file "C:\api-ms-win-crt-stdio-l1-1-0.dll" "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" trying to access non-existent file "C:\api-ms-win-crt-convert-l1-1-0.dll" "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" trying to access non-existent file "C:\api-ms-win-crt-locale-l1-1-0.dll" "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" trying to access non-existent file "C:\api-ms-win-crt-filesystem-l1-1-0.dll" "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" trying to access non-existent file "C:\api-ms-win-crt-time-l1-1-0.dll" "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" trying to access non-existent file "C:\api-ms-win-crt-environment-l1-1-0.dll" "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" trying to access non-existent file "C:\api-ms-win-crt-math-l1-1-0.dll" "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" trying to access non-existent file "C:\api-ms-win-crt-utility-l1-1-0.dll" "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL"4d:T947,"ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" trying to access non-existent file "C:\Windows\SYSTEM32\MSCOREE.DLL.local" "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" trying to access non-existent file "C:\ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe.config" "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\kLu\" "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" trying to access non-existent file "C:\ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.INI" "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" trying to access non-existent file "C:\ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe.Local\" "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe:Zone.Identifier" "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" trying to access non-existent file "C:\Windows\System32\schtasks.exe:Zone.Identifier" "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" trying to access non-existent file "C:\EC2687F0E226016D1CEC0764216B00675B8BDA746AA9606053F62F3ED799F3D6.EXE.CONFIG" "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC" "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\KLU" "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" trying to access non-existent file "C:\EC2687F0E226016D1CEC0764216B00675B8BDA746AA9606053F62F3ED799F3D6.INI" "ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME"4e:T453,Found string "api.telegram.org" (Indicator: "api.telegram.org"; File: "PCAP") Found string "s://api.telegram.org/bot" (Indicator: "api.telegram.org"; File: "00004116.00001014.16849967.00402000.wprm") Found string "ttps://api.telegram.org/bot" (Indicator: "api.telegram.org"; Source: "00000000-00004116.00000001.81497.00400000.00000040.mdmp") Found string "api.telegram.org0" (Indicator: "api.telegram.org"; Source: "00000000-00004116.00000001.81497.049D9000.00000004.mdmp, 00000000-00004116.00000002.83420.049D9000.00000004.mdmp") Found string "api.telegram.org" (Indicator: "api.telegram.org"; Source: "00000000-00004116.00000001.81497.049D9000.00000004.mdmp, 00000000-00004116.00000002.83420.049D9000.00000004.mdmp") Found string "www.api.telegram.org0" (Indicator: "api.telegram.org"; Source: "00000000-00004116.00000001.81497.049D9000.00000004.mdmp, 00000000-00004116.00000002.83420.049D9000.00000004.mdmp") Found string "w.api.telegram.org" (Indicator: "api.telegram.org"; Source: "00000000-00004116.00000001.81497.049D9000.00000004.mdmp, 00000000-00004116.00000002.83420.049D9000.00000004.mdmp")4f:T7000,Found URL "http://aborters.duckdns.org:8081,http://anotherarmy.dns.army:8081srokyichvpfhakipzaxnnchkmgklnaizhgmyrnjfulidgkftkrtelinhfklkjrkdexmvkeucxukugr$hash" - Source: "00000000-00004116.00000001.81497.00400000.00000040.mdmp") Found URL "http://checkip.dyndns.org/ents/event0319_64gssapiegotiateerberos91-lchannelssspcalrpcdigestku2uredsspcalrpccalrpc032,23,3025,,rtlgetn8" - Source: "00000000-00004116.00000001.81497.004E0000.00000004.mdmp") Found URL "https://reallyfreegeoip.org/xml/64.124.12.1629iqmgvw,czc0?1$0" - Source: "00000000-00004116.00000001.81497.04948000.00000004.mdmp") Found URL "http://isrg.trustid.ocsp.identrust.com0;/http://apps.identrust.com/roots/dstrootcax3.p7c0m0k0000." - Source: "00000000-00004116.00000001.81497.04948000.00000004.mdmp") Found URL "http://cps.root-x1.letsencrypt.org0<50301+http://crl.identrust.com/dstrootcax3crl.crl0ig'" - Source: "00000000-00004116.00000001.81497.04948000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00004116.00000001.81497.04948000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl02.5.4.3" - Source: "00000000-00004116.00000001.81497.04948000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1english1sea" - Source: "00000000-00004116.00000001.81497.04948000.00000004.mdmp") Found URL "https://secure.comodo.com/cps0" - Source: "00000000-00004116.00000001.81497.04948000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com05addons.mozilla.orgwww.addons.mozilla.org0zsb)j9e/9ckxsalt" - Source: "00000000-00004116.00000001.81497.04948000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0%www.google.comgoogle.com0io]l,e9n0p1+0)" - Source: "00000000-00004116.00000001.81497.04948000.00000004.mdmp") Found URL "http://www.public-trust.com/cps/omniroot.html0w0u1gte" - Source: "00000000-00004116.00000001.81497.04948000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0dmxt*j]+xijom5ooc*9" - Source: "00000000-00004116.00000001.81497.04948000.00000004.mdmp") Found URL "http://ocsp.entrust.net03,0*0(" - Source: "00000000-00004116.00000001.81497.04948000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.11c)d[b" - Source: "00000000-00004116.00000001.81497.04948000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0w0u1staat" - Source: "00000000-00004116.00000001.81497.04948000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl0]ko)tsz'ek" - Source: "00000000-00004116.00000001.81497.04948000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.skype.comwww.login.skype.com0ynsl" - Source: "00000000-00004116.00000001.81497.04948000.00000004.mdmp") Found URL "http://cybertrust.omniroot.com/repository.cfm0w0u1gte" - Source: "00000000-00004116.00000001.81497.04948000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0j)z" - Source: "00000000-00004116.00000001.81497.04948000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1tampa1sea" - Source: "00000000-00004116.00000001.81497.04948000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0global" - Source: "00000000-00004116.00000001.81497.04948000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0\0z1staat" - Source: "00000000-00004116.00000001.81497.04948000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domorganisatielatestcrl-g2.crl0^tl*" - Source: "00000000-00004116.00000001.81497.04948000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0or" - Source: "00000000-00004116.00000001.81497.04948000.00000004.mdmp") Found URL "https://www.verisign.com/repository/cpsthis" - Source: "00000000-00004116.00000001.81497.04948000.00000004.mdmp") Found URL "https://www.verisign.com;" - Source: "00000000-00004116.00000001.81497.04948000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0(+pw)salt" - Source: "00000000-00004116.00000001.81497.04948000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.yahoo.comwww.login.yahoo.com0yvr,salt" - Source: "00000000-00004116.00000001.81497.04948000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/mail.google.comwww.mail.google.com0?=*k!\yro2;nki0!!salt" - Source: "00000000-00004116.00000001.81497.04948000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0kw(=n" - Source: "00000000-00004116.00000001.81497.04948000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0f$\_)$bf!t%qwt%79;8kbt%ntt%lit%" - Source: "00000000-00004116.00000001.81497.04948000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.1q7z?,entrust.net1@0>7www.entrust.net/cps_2048" - Source: "00000000-00004116.00000001.81497.04948000.00000004.mdmp") Found URL "http://ocsp.entrust.net0d=0;09000." - Source: "00000000-00004116.00000001.81497.04948000.00000004.mdmp") Found URL "http://www.digicert.com.my/cps.htm02+0)0'!http://crl.entrust.net/2048ca.crl09yk3y!gte" - Source: "00000000-00004116.00000001.81497.04948000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0\0" - Source: "00000000-00004116.00000001.81497.04948000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl00ev" - Source: "00000000-00004116.00000001.81497.04948000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0-login.live.comwww.login.live.com0nwk1uy1un:tqg.,t%79t%r" - Source: "00000000-00004116.00000001.81497.04948000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0entrust.net1;092www.entrust.net/cps" - Source: "00000000-00004116.00000001.81497.04948000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0v7.1ctj7+>.entrust%:/0a0" - Source: "00000000-00004116.00000001.81497.04948000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0>ej-+\lu>gvpob\hzagxr" - Source: "00000000-00004116.00000001.81497.04948000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?com1" - Source: "00000000-00004116.00000001.81497.04948000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnk't" - Source: "00000000-00004116.00000001.81497.04948000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0>^" - Source: "00000000-00004116.00000001.81497.04948000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004116.00000001.81497.04948000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0^ziq$(c\a6\4[=1.3.6.1.4.1.311.10.1210316072924z0/^g(o-cejy" - Source: "00000000-00004116.00000001.81497.04948000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0^ziq$(c\a6\4[=2.23.140.1.2.1stem." - Source: "00000000-00004116.00000001.81497.04948000.00000004.mdmp") Found URL "http://i.pki.goog/r4.crt0+$0" - Source: "00000000-00004116.00000001.81497.049A1000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&globalsign" - Source: "00000000-00004116.00000001.81497.049A1000.00000004.mdmp") Found URL "http://i.pki.goog/gsr1.crt0-&0$0" - Source: "00000000-00004116.00000001.81497.049A1000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:84xih8xi.3.edaa4erm" - Source: "00000000-00004116.00000001.81497.049A1000.00000004.mdmp") Found URL "http://i.pki.goog/we1.crt05reallyfreegeoip.org*.reallyfreegeoip.org0/0-0+%http://c.pki.goog/we1/ouqgbjkzwhu.crl0?rg" - Source: "00000000-00004116.00000001.81497.049A1000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:ezd" - Source: "00000000-00004116.00000001.81497.049A1000.00000004.mdmp") Found URL "http://i.pki.goog/r4.crt0+$0" - Source: "00000000-00004116.00000001.81497.049C6000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&0923" - Source: "00000000-00004116.00000001.81497.049C6000.00000004.mdmp") Found URL "http://i.pki.goog/r4.$0" - Source: "00000000-00004116.00000001.81497.049C6000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&globalsign" - Source: "00000000-00004116.00000001.81497.049C6000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0yu5,1[?ep[?:lmem8nonicf" - Source: "00000000-00004116.00000001.81497.049C6000.00000004.mdmp") Found URL "http://i.pki.goog/we1.crt05reallyfreegeoip.org*.reallyfreegeoip.org0/0-0+%http://c.pki.goog/we1/ouqgbjkzwhu.crl0?rg" - Source: "00000000-00004116.00000001.81497.049C6000.00000004.mdmp") Found URL "http://i.pki.goog/gsr1.crt0-&0$0" - Source: "00000000-00004116.00000001.81497.049C6000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:e,uy;9iqmgvw,czc0?1$0" - Source: "00000000-00004116.00000002.83420.04948000.00000004.mdmp") Found URL "http://isrg.trustid.ocsp.identrust.com0;/http://apps.identrust.com/roots/dstrootcax3.p7c0m0k0000." - Source: "00000000-00004116.00000002.83420.04948000.00000004.mdmp") Found URL "http://cps.root-x1.letsencrypt.org0<50301+http://crl.identrust.com/dstrootcax3crl.crl0ig'" - Source: "00000000-00004116.00000002.83420.04948000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00004116.00000002.83420.04948000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl02.5.4.3" - Source: "00000000-00004116.00000002.83420.04948000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1english1sea" - Source: "00000000-00004116.00000002.83420.04948000.00000004.mdmp") Found URL "https://secure.comodo.com/cps0" - Source: "00000000-00004116.00000002.83420.04948000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com05addons.mozilla.orgwww.addons.mozilla.org0zsb)j9e/9ckxsalt" - Source: "00000000-00004116.00000002.83420.04948000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0%www.google.comgoogle.com0io]l,e9n0p1+0)" - Source: "00000000-00004116.00000002.83420.04948000.00000004.mdmp") Found URL "http://www.public-trust.com/cps/omniroot.html0w0u1gte" - Source: "00000000-00004116.00000002.83420.04948000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0dmxt*j]+xijom5ooc*9" - Source: "00000000-00004116.00000002.83420.04948000.00000004.mdmp") Found URL "http://ocsp.entrust.net03,0*0(" - Source: "00000000-00004116.00000002.83420.04948000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.11c)d[b" - Source: "00000000-00004116.00000002.83420.04948000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0w0u1staat" - Source: "00000000-00004116.00000002.83420.04948000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl0]ko)tsz'ek" - Source: "00000000-00004116.00000002.83420.04948000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.skype.comwww.login.skype.com0ynsl" - Source: "00000000-00004116.00000002.83420.04948000.00000004.mdmp") Found URL "http://cybertrust.omniroot.com/repository.cfm0w0u1gte" - Source: "00000000-00004116.00000002.83420.04948000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0j)z" - Source: "00000000-00004116.00000002.83420.04948000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1tampa1sea" - Source: "00000000-00004116.00000002.83420.04948000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0global" - Source: "00000000-00004116.00000002.83420.04948000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0\0z1staat" - Source: "00000000-00004116.00000002.83420.04948000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domorganisatielatestcrl-g2.crl0^tl*" - Source: "00000000-00004116.00000002.83420.04948000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0or" - Source: "00000000-00004116.00000002.83420.04948000.00000004.mdmp") Found URL "https://www.verisign.com/repository/cpsthis" - Source: "00000000-00004116.00000002.83420.04948000.00000004.mdmp") Found URL "https://www.verisign.com;" - Source: "00000000-00004116.00000002.83420.04948000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0(+pw)salt" - Source: "00000000-00004116.00000002.83420.04948000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.yahoo.comwww.login.yahoo.com0yvr,salt" - Source: "00000000-00004116.00000002.83420.04948000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/mail.google.comwww.mail.google.com0?=*k!\yro2;nki0!!salt" - Source: "00000000-00004116.00000002.83420.04948000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0kw(=n" - Source: "00000000-00004116.00000002.83420.04948000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0f$\_)$bf!t%qwt%79;8kbt%ntt%lit%" - Source: "00000000-00004116.00000002.83420.04948000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.1q7z?,entrust.net1@0>7www.entrust.net/cps_2048" - Source: "00000000-00004116.00000002.83420.04948000.00000004.mdmp") Found URL "http://ocsp.entrust.net0d=0;09000." - Source: "00000000-00004116.00000002.83420.04948000.00000004.mdmp") Found URL "http://www.digicert.com.my/cps.htm02+0)0'!http://crl.entrust.net/2048ca.crl09yk3y!gte" - Source: "00000000-00004116.00000002.83420.04948000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0\0" - Source: "00000000-00004116.00000002.83420.04948000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl00ev" - Source: "00000000-00004116.00000002.83420.04948000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0-login.live.comwww.login.live.com0nwk1uy1un:tqg.,t%79t%r" - Source: "00000000-00004116.00000002.83420.04948000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0entrust.net1;092www.entrust.net/cps" - Source: "00000000-00004116.00000002.83420.04948000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0v7.1ctj7+>.entrust%:/0a0" - Source: "00000000-00004116.00000002.83420.04948000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0>ej-+\lu>gvpob\hzagxr" - Source: "00000000-00004116.00000002.83420.04948000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?com1" - Source: "00000000-00004116.00000002.83420.04948000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnk't" - Source: "00000000-00004116.00000002.83420.04948000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0>^" - Source: "00000000-00004116.00000002.83420.04948000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004116.00000002.83420.04948000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0^ziq$(c\a6\4[=1.3.6.1.4.1.311.10.1210316072924z0/^g(o-cejy" - Source: "00000000-00004116.00000002.83420.04948000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0^ziq$(c\a6\4[=2.23.140.1.2.1stem." - Source: "00000000-00004116.00000002.83420.04948000.00000004.mdmp") Found URL "http://i.pki.goog/r4.crt0+$0" - Source: "00000000-00004116.00000002.83420.049A1000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&globalsign" - Source: "00000000-00004116.00000002.83420.049A1000.00000004.mdmp") Found URL "http://i.pki.goog/gsr1.crt0-&0$0" - Source: "00000000-00004116.00000002.83420.049A1000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:84xih8xi.3.edaa4erm" - Source: "00000000-00004116.00000002.83420.049A1000.00000004.mdmp") Found URL "http://i.pki.goog/we1.crt05reallyfreegeoip.org*.reallyfreegeoip.org0/0-0+%http://c.pki.goog/we1/ouqgbjkzwhu.crl0?rg" - Source: "00000000-00004116.00000002.83420.049A1000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:ezd" - Source: "00000000-00004116.00000002.83420.049A1000.00000004.mdmp") Found URL "http://i.pki.goog/r4.crt0+$0" - Source: "00000000-00004116.00000002.83420.049C6000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&0923" - Source: "00000000-00004116.00000002.83420.049C6000.00000004.mdmp") Found URL "http://i.pki.goog/r4.$0" - Source: "00000000-00004116.00000002.83420.049C6000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&globalsign" - Source: "00000000-00004116.00000002.83420.049C6000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0yu5,1[?ep[?:lmem8nonicf" - Source: "00000000-00004116.00000002.83420.049C6000.00000004.mdmp") Found URL "http://i.pki.goog/we1.crt05reallyfreegeoip.org*.reallyfreegeoip.org0/0-0+%http://c.pki.goog/we1/ouqgbjkzwhu.crl0?rg" - Source: "00000000-00004116.00000002.83420.049C6000.00000004.mdmp") Found URL "http://i.pki.goog/gsr1.crt0-&0$0" - Source: "00000000-00004116.00000002.83420.049C6000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:e,uy;\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00005768.00000000.78495.000B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegOpenKeyExW\" in file \"ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6\"\n Found registry query API: \"RegQueryValueExW\" in file \"ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6\"\n Found registry query API: \"RegQueryValueExW\" in \"00000000-00004084.00000001.83492.00381000.00000020.mdmp\"\n Found registry query API: \"RegOpenKeyExW\" in \"00000000-00004084.00000001.83492.00381000.00000020.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"GetKeyboardState\" (Indicator: \"GetKeyboardState\"; File: \"00004116.00001014.16849967.00402000.wprm\")\n Found reference to API \"MapVirtualKey\" (Indicator: \"MapVirtualKey\"; File: \"00004116.00001014.16849967.00402000.wprm\")\n Found reference to API \"GetKeyboardState\" (Indicator: \"GetKeyboardState\"; Source: \"00000000-00004116.00000001.81497.00400000.00000040.mdmp\")\n Found reference to API \"MapVirtualKey\" (Indicator: \"MapVirtualKey\"; Source: \"00000000-00004116.00000001.81497.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to read volume data via DOS device path","description":"\"ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe\" tries to directly access volume data \"C:\"","origin":"API Call","mitre_attack_id":"T1006","relevance":1,"id":"api-306","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$51","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"powershell.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"schtasks.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"000000000010000000000100fffffe7f03000000080000004a020000000001000600004f\"}\n \"powershell.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"000000000010000000000100fffffe7f03000000080000004a020000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user names for specified SIDs","description":"\"ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe\" called \"LsaLookupSids\" with parameters {\"PolicyHandle\": \"154388\"\n \"Count\": \"1\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":1,"id":"api-255","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; File: \"00004116.00001014.16849967.00402000.wprm\")\n Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; File: \"00004116.00001014.16849967.00402000.wprm\")\n Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; Source: \"00000000-00004116.00000001.81497.00400000.00000040.mdmp\")\n Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"00000000-00004116.00000001.81497.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$52","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004084.00000001.83492.00381000.00000020.mdmp\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004084.00000001.83492.00381000.00000020.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004084.00000001.83492.00381000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00004084.00000001.83492.00381000.00000020.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00004116.00000001.81497.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; File: \"ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6\")\n Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00004084.00000001.83492.00381000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetSystemDirectoryW\" (Indicator: \"GetSystemDirectory\"; File: \"ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6\")\n Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; File: \"ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6\")\n Found reference to API \"GetSystemDirectoryW\" (Indicator: \"GetSystemDirectory\"; Source: \"00000000-00004084.00000001.83492.00381000.00000020.mdmp\")\n Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; Source: \"00000000-00004084.00000001.83492.00381000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"00004116.00001014.16849967.00402000.wprm\")\n Found reference to API \"GetModuleFileNameqwq\" (Indicator: \"GetModuleFileName\"; File: \"00004116.00001014.16849967.00402000.wprm\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00004084.00000001.83492.00381000.00000020.mdmp\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00004116.00000001.81497.00400000.00000040.mdmp\")\n Found reference to API \"GetModuleFileNameqwq\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00004116.00000001.81497.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariable\" (Indicator: \"GetEnvironmentVariable\"; File: \"00004116.00001014.16849967.00402000.wprm\")\n Found reference to API \"GetEnvironmentVariable\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00004116.00000001.81497.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"402820,2312,111,,GetSystemMetrics,user32.dll,\"755:56:01.185\",RX=0,PX=0\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00004116.00000001.81497.04948000.00000004.mdmp, 00000000-00004116.00000002.83420.04948000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00004084.00000001.83492.00381000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"p_DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00004084.00000001.83492.00381000.00000020.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$53","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found mail information locations related strings","description":"\"Software\\Microsoft\\Office\\15.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\" in Source: 00004116.00001014.16849967.00402000.wprm\n \"\\Postbox\\\" in Source: 00004116.00001014.16849967.00402000.wprm\n \"oftware\\Microsoft\\Office\\15.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\" in Source: 00000000-00004116.00000001.81497.00400000.00000040.mdmp\n \"oftware\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\" in Source: 00000000-00004116.00000001.81497.00400000.00000040.mdmp\n \"oftware\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\" in Source: 00000000-00004116.00000001.81497.00400000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1114","relevance":1,"id":"string-129","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References Chromium browser credentials files","description":"$54","origin":"File/Memory","mitre_attack_id":"T1555.003","relevance":3,"id":"string-1000","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References Firefox browser credentials files","description":"Found string \"%APPDATA%\\Mozilla\\Firefox\\Profiles\\g4h7miqt.default\\logins.json\" (Indicator: \"logins.json\"; in Source: \"00000000-00004116-00000C2E-68827330748\")","origin":"File/Memory","mitre_attack_id":"T1555.003","relevance":1,"id":"string-405","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00006100)\n \"ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe\" called an API \"AdjustTokenPrivileges\"on file: C:\\Windows\\System32\\tzres.dll\" (UID: 00000000-00004116)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$55","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"$56","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$57","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00004116-00000C2C-264062917","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6\")\n Found reference to API \"ExitProcess23\" (Indicator: \"ExitProcess\"; File: \"00004116.00001014.16849967.00402000.wprm\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00004084.00000001.83492.00381000.00000020.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00004084.00000001.83492.00381000.00000020.mdmp\")\n Found reference to API \"ExitProcess23\" (Indicator: \"ExitProcess\"; Source: \"00000000-00004116.00000001.81497.00400000.00000040.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00004116.00000001.81497.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"$58","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe\" opened \"\\Device\\KsecDD\"\n \"powershell.exe\" opened \"\\Device\\KsecDD\"\n \"schtasks.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$59","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"level":"informative","category":"System Security","name":"Uses powershell with a add-mppreference commandline param","description":"Process \"powershell.exe\" with commandline \"Add-MpPreference -ExclusionPath \"%APPDATA%\\\\HmnCSybE.exe\"\" (UID: 00000000-00006100)","origin":"Monitored Target","mitre_attack_id":"T1562","relevance":3,"id":"target-236","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$5a","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"HmnCSybE.exe\" - Location: [%APPDATA%\\HmnCSybE.exe]- [targetUID: 00000000-00005768]\n Dropped file: \"StartupProfileData-NonInteractive\" - Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive]- [targetUID: 00000000-00006100]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"GetPixel\" (Source: ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6, API is part of module: GDI32.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6\" was detected as \"Microsoft Visual C# v7.0 / Basic .NET\"\n \"HmnCSybE.exe\" was detected as \"Microsoft Visual C# v7.0 / Basic .NET\"\n \"DISMHOST.EXE.6AA9DA9A.bin\" was detected as \"Visual C++ 2005 Release -> Microsoft\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6\" has section name .text with entropy \"7.866670056036135\"\n \"ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6\" has section name .rsrc with entropy \"7.026178876636283\"\n \"HmnCSybE.exe\" has section name .text with entropy \"7.866670056036135\"\n \"HmnCSybE.exe\" has section name .rsrc with entropy \"7.026178876636283\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"level":"suspicious","category":"Environment Awareness","name":"Able to evade execution by checking for blacklisted external IPs","description":"Found string \"https://reallyfreegeoip.org/xml/64.124.12.162\" (Indicator: \"64.124.12.162\"; Source: \"00000000-00004116.00000001.81497.004E0000.00000004.mdmp, 00000000-00004116.00000002.83420.004E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1590.005","relevance":1,"id":"string-643","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"level":"suspicious","category":"Environment Awareness","name":"Tries to steal Pidgin account information (file access)","description":"\"ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\.PURPLE\\ACCOUNTS.XML\"\n \"ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe\" trying to open a file \"%APPDATA%\\.PURPLE\\ACCOUNTS.XML\"","origin":"API Call","mitre_attack_id":"T1005","relevance":5,"id":"api-116","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"13/26 Antivirus vendors marked sample as malicious (50% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"level":"suspicious","category":"General","name":"PE file has unusual entropy resources","description":"\"ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6\" has resource with unusual entropy \"RT_ICON:7.716974381601892\"\n \"HmnCSybE.exe\" has resource with unusual entropy \"RT_ICON:7.716974381601892\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":5,"id":"static-92","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"HmnCSybE.exe\" has type \"PE32 executable for MS Windows 6.00 (GUI) Intel i386 Mono/.Net assembly 3 sections\"- Location: [%APPDATA%\\HmnCSybE.exe]- [targetUID: 00000000-00005768]\n \"DISMHOST.EXE.6AA9DA9A.bin\" has type \"PE32 executable for MS Windows 5.01 (GUI) Intel i386 4 sections\"- [targetUID: N/A]","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"level":"suspicious","category":"Network Related","name":"Employs a browser-related User Agent without launching browser","description":"Found User Agent(s): Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 132.226.8.169 on port 80 is sent without HTTP header\n TCP traffic to 172.67.177.134 on port 443 is sent without HTTP header\n TCP traffic to 149.154.166.110 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - Customized RC4 encryption for MSIL","description":"YARA signature for Custom RC4 technique process \"00000000-00005768\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-168","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"level":"suspicious","category":"Pattern Matching","name":"Yara Signature Match - Indicators","description":"YARA signature \"INDICATOR_SUSPICIOUS_Binary_References_Browsers\" matched process \"00000000-00004116\" as \"Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.\"\n YARA signature \"INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients\" matched process \"00000000-00004116\" as \"Detects executables referencing many email and collaboration clients. Observed in information stealers\"\n YARA signature \"INDICATOR_SUSPICIOUS_EXE_DotNetProcHook\" matched process \"00000000-00004116\" as \"Detects executables with potential process hoocking\"\n YARA signature \"INDICATOR_SUSPICIOUS_EXE_TelegramChatBot\" matched process \"00000000-00004116\" as \"Detects executables using Telegram Chat Bot\"\n YARA signature \"INDICATOR_EXE_Packed_SmartAssembly\" matched process \"00000000-00005768\" as \"Detects executables packed with SmartAssembly\"","origin":"YARA Signature","relevance":9,"id":"yara-553","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Accesses potentially sensitive information from local browsers","description":"\"ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe\" had access to \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites\" (Type: \"FileHandle\")\n \"ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe\" had access to \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\Local State\" (Type: \"FileHandle\")","origin":"Touched Handle","mitre_attack_id":"T1005","relevance":7,"id":"handle-0","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\tmpD401.tmp\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\1aauomap.d2z.ps1\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\0hxe44th.jsd.psm1\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\tmpD401.tmp\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"powershell.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"powershell.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"SetSecurityDescriptorDacl\n RegOpenKeyExW\n RegCloseKey\n FindResourceExW\n CreateThread\n GetModuleHandleA\n TerminateProcess\n LoadLibraryW\n GetModuleFileNameW\n CreateFileMappingW\n OutputDebugStringA\n GetCommandLineW\n GetModuleHandleExW\n LoadLibraryExW\n GetTickCount\n OutputDebugStringW\n Sleep\n CreateFileW\n GetModuleHandleW\n GetProcAddress\n UnhandledExceptionFilter\n GetSystemDirectoryW\n MapViewOfFile\n GetVersionExW\n GetFileAttributesW\n GetVersionExA\n GetStartupInfoA","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe\" called \"CreateProcessA\" with parameter \"C:\\ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe\" - (UID: 00000000-00005768)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Modifies file/console tracing settings (often used to hide footprints on system)","description":"\"ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"ENABLEFILETRACING\"; Value: \"0000000000\")\n \"ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"ENABLECONSOLETRACING\"; Value: \"0000000000\")\n \"ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"FILETRACINGMASK\"; Value: \"0000FFFF00\")\n \"ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"CONSOLETRACINGMASK\"; Value: \"0000FFFF00\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":5,"id":"registry-30","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"level":"malicious","category":"Exploit/Shellcode","name":"Writes shellcode to a remote process","description":"Wrote 2070 instructions to a remote process\n Wrote 12 instructions to a remote process\n Wrote 2 instructions to a remote process\n Wrote 8 instructions to a remote process\n Wrote 15 instructions to a remote process\n Wrote 3 instructions to a remote process\n Wrote 24 instructions to a remote process\n Wrote 9 instructions to a remote process\n Wrote 13 instructions to a remote process\n Wrote 14 instructions to a remote process\n Wrote 29 instructions to a remote process\n Wrote 16 instructions to a remote process\n Wrote 705 instructions to a remote process\n Wrote 11 instructions to a remote process","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1055","relevance":8,"id":"stream-38","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"13/26 Antivirus vendors marked sample as malicious (50% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"13/26 Antivirus vendors marked dropped file \"HmnCSybE.exe\" as malicious (classified as \"IL:Trojan.NanoCore\" with 50% detection rate)","origin":"Binary File","mitre_attack_id":"T1204.002","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"13/26 Antivirus vendors marked spawned process \"ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe\" (PID: 4116) as malicious (classified as \"IL:Trojan.NanoCore\" with 50% detection rate)","origin":"Monitored Target","mitre_attack_id":"T1204.002","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"level":"malicious","category":"Installation/Persistence","name":"Schedules a task to be executed at a specific time and date","description":"Process \"schtasks.exe\" with commandline \"/Create /TN \"Updates\\\\HmnCSybE\" /XML \"%TEMP%\\\\tmpD401.tmp\"\" (UID: 00000000-00006132)","origin":"Monitored Target","mitre_attack_id":"T1053.005","relevance":8,"id":"target-13","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"level":"malicious","category":"Installation/Persistence","name":"Schedules a task to be executed from task XML file","description":"Process \"schtasks.exe\" with commandline \"/Create /TN \"Updates\\\\HmnCSybE\" /XML \"%TEMP%\\\\tmpD401.tmp\"\" (UID: 00000000-00006132)","origin":"Monitored Target","mitre_attack_id":"T1053.005","relevance":5,"id":"target-414","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"level":"malicious","category":"Network Related","name":"Attempts to identify external IP address","description":"\"checkip.dyndns.org\"\n \"reallyfreegeoip.org\"","origin":"Network Traffic","mitre_attack_id":"T1016","relevance":6,"id":"network-24","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match - Snake Keylogger","description":"YARA signature Malware.Snake Keylogger matched on process \"00000000-00004116\"","origin":"YARA Signature","relevance":10,"id":"yara-5","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match - generic stealer","description":"YARA signature Malware.Stealer matched on process \"00000000-00004116\"","origin":"YARA Signature","relevance":10,"id":"yara-8","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Attempts to obtain browser login credentials (file access)","description":"$5b","origin":"API Call","mitre_attack_id":"T1555.003","relevance":10,"id":"api-281","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Known malware detected","description":"The sample is known malware – Agent Tesla","origin":"Indicator Combinations","relevance":10,"id":"summary-5003","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Observed sensitive data harvesting behavior","description":"Identified stealer based malicious activity","origin":"Indicator Combinations","relevance":7,"id":"summary-46","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal Mail credentials from registry","description":"$5c","origin":"Registry Access","mitre_attack_id":"T1114","relevance":3,"id":"registry-37","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal browser sensitive information (file access)","description":"$5d","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-96","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Binary shows a combination of malicious behaviors","description":"Defender exclusion with suspicious schedule task creation","origin":"Indicator Combinations","relevance":1,"id":"summary-38","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]}],"incidents":[{"name":"Spyware","details_count":6,"details":[{"detail":"Accesses potentially sensitive information from local browsers"},{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Tries to steal browser sensitive information (file access)"},{"detail":"Attempts to steal desktop application's information (file access)"},{"detail":"Found browser information locations related strings"},{"detail":"Found desktop apps credentials related location strings"}],"sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"name":"Stealer/Phishing","details_count":3,"details":[{"detail":"Reads FTP client related files"},{"detail":"Tries to steal Mail credentials from registry"},{"detail":"Identified FTP credentials location strings"}],"sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Schedules a task to be executed at a specific time and date"}],"sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"name":"Fingerprint","details_count":5,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Attempts to identify external IP address"},{"detail":"Queries sensitive IE security settings"},{"detail":"Tries to steal Mail credentials from registry"},{"detail":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Marks file for deletion"},{"detail":"Modifies file/console tracing settings (often used to hide footprints on system)"}],"sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 3 domains and 3 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]}],"intel_graph":{"map":{"Domain:api.telegram.org":{"type":"Domain","value":"api.telegram.org"},"Domain:checkip.dyndns.org":{"type":"Domain","value":"checkip.dyndns.org"},"Domain:reallyfreegeoip.org":{"type":"Domain","value":"reallyfreegeoip.org"},"File:49a4efdcd81c685e1275f5c49a2d6ae700dab7e1da6919857a0a0ed82b07e3f6":{"type":"File","value":"49a4efdcd81c685e1275f5c49a2d6ae700dab7e1da6919857a0a0ed82b07e3f6"},"File:a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf":{"type":"File","value":"a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf"},"File:c556354361399c1953d1a79647e49a7e03fe0264fdc2aa93c99b3aaac2bdb63b":{"type":"File","value":"c556354361399c1953d1a79647e49a7e03fe0264fdc2aa93c99b3aaac2bdb63b"},"File:ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6":{"type":"File","value":"ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["confirmed malicious file","confirmed relationship with a Threat MatiexKeylogger"]}},"File:ecb636b278261eade712e68ec7d805d20e802628248da872d3d0ada1432ffc11":{"type":"File","value":"ecb636b278261eade712e68ec7d805d20e802628248da872d3d0ada1432ffc11"},"Ip:132.226.8.169":{"type":"Ip","value":"132.226.8.169"},"Ip:149.154.166.110":{"type":"Ip","value":"149.154.166.110"},"Ip:172.67.177.134":{"type":"Ip","value":"172.67.177.134"},"Threat:cad5945798d819643b90b5947ba7951f45d54bd04ed4d201016a506c9c98c777":{"type":"Threat","value":"MatiexKeylogger","verdict":{"verdict":"malicious","verdict_source":"indicator database"}},"Url:/":{"type":"Url","value":"/"}},"chains":[{"id":"1549144907169108985","root":"File:ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6","edges":[],"verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["confirmed malicious file","confirmed relationship with a Threat MatiexKeylogger"]}},{"id":"1549144907169108984","root":"File:ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6","edges":[{"edge_kind":"in_crowdstrike_knowledge_database","from_key":"File:ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6","to_key":"Threat:cad5945798d819643b90b5947ba7951f45d54bd04ed4d201016a506c9c98c777"}],"verdict":{"verdict":"malicious","verdict_source":"indicator database"}},{"id":"sandbox_network","root":"File:ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6","edges":[{"edge_kind":"contacted_ip","from_key":"File:ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6","to_key":"Ip:132.226.8.169"},{"edge_kind":"contacted_ip","from_key":"File:ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6","to_key":"Ip:172.67.177.134"},{"edge_kind":"contacted_ip","from_key":"File:ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6","to_key":"Ip:149.154.166.110"},{"edge_kind":"contacted_domain","from_key":"File:ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6","to_key":"Domain:api.telegram.org"},{"edge_kind":"resolves_to","from_key":"Domain:api.telegram.org","to_key":"Ip:149.154.166.110"},{"edge_kind":"contacted_domain","from_key":"File:ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6","to_key":"Domain:checkip.dyndns.org"},{"edge_kind":"resolves_to","from_key":"Domain:checkip.dyndns.org","to_key":"Ip:132.226.8.169"},{"edge_kind":"contacted_domain","from_key":"File:ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6","to_key":"Domain:reallyfreegeoip.org"},{"edge_kind":"resolves_to","from_key":"Domain:reallyfreegeoip.org","to_key":"Ip:172.67.177.134"},{"edge_kind":"contacted_url","from_key":"File:ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6","to_key":"Url:/"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6","edges":[{"edge_kind":"extracted","from_key":"File:ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6","to_key":"File:ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6"},{"edge_kind":"extracted","from_key":"File:ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6","to_key":"File:ecb636b278261eade712e68ec7d805d20e802628248da872d3d0ada1432ffc11"},{"edge_kind":"extracted","from_key":"File:ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6","to_key":"File:c556354361399c1953d1a79647e49a7e03fe0264fdc2aa93c99b3aaac2bdb63b"},{"edge_kind":"extracted","from_key":"File:ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6","to_key":"File:a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf"},{"edge_kind":"extracted","from_key":"File:ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6","to_key":"File:49a4efdcd81c685e1275f5c49a2d6ae700dab7e1da6919857a0a0ed82b07e3f6"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":4,"spawned_processes_count":4,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":4,"imported_dlls_count":158,"dropped_files_count":0,"extracted_files_count":5,"files_written_count":7,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":2,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":3,"dns_resolutions_count":3,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["credentialharvesting","commodity","informationstealer","keylogger","matiexkeylogger","infostealer"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"6aa84f9c7fa5fa14b80402cb","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"IL:Trojan.NanoCore","contacted_countries":["JPN","NLD"],"submit_name":"ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6","analysis_start_time":"2026-09-14T19:48:46+00:00","indicators_count":{"informative":218,"suspicious":72,"malicious":19},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"132.226.8.169","port":80,"protocol":"TCP","country":"Japan","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"address":"172.67.177.134","port":443,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"address":"149.154.166.110","port":443,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]}],"dns_resolutions":[{"domain":"api.telegram.org","address":"149.154.166.110","ttl":295,"country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"domain":"checkip.dyndns.org","address":"132.226.8.169","ttl":95,"country":"Japan","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"domain":"reallyfreegeoip.org","address":"172.67.177.134","ttl":300,"country":"-","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]}],"http_requests":[{"host":"checkip.dyndns.org","host_ip":"132.226.8.169:80","url":"/","method":"GET","response_code":"200","response_phrase":"OK","header":"GET / HTTP/1.1\nUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)\nHost: checkip.dyndns.org\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}],"processes":[{"pid":5768,"ppid":0,"name":"ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe","command_line":"","sha256":"ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6","normalized_path":"C:\\ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe","uid":"00000000-00005768","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAA00lEQVR4Xt2WQQ6CQAxF0ZtzHxeuPYhyD+MaMwuM/Lb8aakw+JK/wenvS0YSuq4FXsN5XAqeTwcXYvB8Otaij8TjJH7Lpb+O4aSApZ6kEClTZqyr5ChlFJhZ96ddKTBbfrnZMTm6QGHxCrYQKOwuYFItEEkN7Qv8mr8W+H79tOD5OhzGuBCD5+sICFjPn/fIt4RDQLwVnpgcUsADnTEE1PumZQp0hgjMJGiZAp2ZBJQICVqmQGeUxdsKGIjlhUhZZKYglhciZZEZk6kskhSw1JMWeAMpxta8NuiyCgAAAABJRU5ErkJggg=="},{"pid":6100,"ppid":5768,"name":"powershell.exe","command_line":"Add-MpPreference -ExclusionPath \"%APPDATA%\\HmnCSybE.exe\"","sha256":"70ba57fb0bf2f34b86426d21559f5f6d05c1268193904de8e959d7b06ce964ce","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00005768","uid":"00000000-00006100"},{"pid":6132,"ppid":5768,"name":"schtasks.exe","command_line":"/Create /TN \"Updates\\HmnCSybE\" /XML \"%TEMP%\\tmpD401.tmp\"","sha256":"15018d0093befabba8b927743191030d1f8c17bb97fdb48c2fc3eab20e2d4b3d","normalized_path":"%WINDIR%\\System32\\schtasks.exe","parent_uid":"00000000-00005768","uid":"00000000-00006132"},{"pid":4116,"ppid":5768,"name":"ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe","command_line":"","sha256":"ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6","normalized_path":"C:\\ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6.exe","parent_uid":"00000000-00005768","uid":"00000000-00004116"}],"all_imported_dlls":["advapi32.dll","api-ms-win-core-file-l2-1-0.dll","msctf.dll","clr.dll","uxtheme.dll","Wldap32.dll","clbcatq.dll","msisip.dll","psapi.dll","iertutil.dll","Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.dll","fltLib.dll","api-ms-win-core-xstate-l2-1-0.dll","Microsoft.PowerShell.ConsoleHost.ni.dll","Microsoft.PowerShell.Security.ni.dll","Microsoft.Management.Infrastructure.ni.dll","System.Configuration.Install.ni.dll","tzres.dll","mscoree.dll","user32.dll","api-ms-win-crt-runtime-l1-1-0.dll","System.Windows.Forms.dll","ntmarta.dll","api-ms-win-downlevel-version-l1-1-0.dll","setupapi.dll","webio.dll","api-ms-win-core-file-l1-2-0.dll","ucrtbase_clr0400.dll","nlssorting.dll","msasn1.dll","Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.dll","sechost.dll","rpcrt4.dll","vcruntime140.dll","normaliz.dll","System.Data.ni.dll","ntdll.dll","api-ms-win-crt-environment-l1-1-0.dll","SensApi.dll","Microsoft.Windows.Diagnosis.TroubleshootingPack.dll","api-ms-win-crt-string-l1-1-0.dll","cryptsp.dll","devobj.dll","System.DirectoryServices.ni.dll","dhcpcsvc.dll","Microsoft.VisualBasic.ni.dll","api-ms-win-downlevel-user32-l1-1-0.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","rasman.dll","FWPUCLNT.DLL","api-ms-win-crt-locale-l1-1-0.dll","api-ms-win-crt-time-l1-1-0.dll","urlmon.dll","gdi32.dll","api-ms-win-crt-convert-l1-1-0.dll","mscorrc.dll","propsys.dll","System.Management.Automation.dll","Microsoft.BackgroundIntelligentTransfer.Management.dll","kernel32.dll","bcrypt.dll","Microsoft.CSharp.ni.dll","Microsoft.PowerShell.Commands.Management.ni.dll","Microsoft.PowerShell.LocalAccounts.dll","bcryptprimitives.dll","winhttp.dll","System.Drawing.ni.dll","KernelBase.dll","VxSSL32.dll","api-ms-win-crt-heap-l1-1-0.dll","atl.dll","dhcpcsvc6.dll","usp10.dll","vcruntime140_clr0400.dll","System.ni.dll","System.Core.ni.dll","profapi.dll","GdiPlus.dll","diasymreader.dll","System.Web.Extensions.dll","api-ms-win-core-localization-l1-2-0.dll","System.Xml.ni.dll","api-ms-win-core-timezone-l1-1-0.dll","mscoreei.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.dll","cryptnet.dll","mswsock.dll","credssp.dll","api-ms-win-core-processthreads-l1-1-1.dll","RpcRtRemote.dll","System.Numerics.ni.dll","gpapi.dll","ktmw32.dll","taskschd.dll","winnsi.dll","rpcss.dll","rasapi32.dll","nsi.dll","api-ms-win-crt-filesystem-l1-1-0.dll","mscorlib.ni.dll","System.Security.ni.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","ncrypt.dll","ws2_32.dll","lpk.dll","comctl32.dll","IconCodecService.dll","sspicli.dll","wininet.dll","userenv.dll","cfgmgr32.dll","crypt32.dll","rtutils.dll","oleaut32.dll","cryptbase.dll","System.Windows.Forms.ni.dll","shell32.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","shlwapi.dll","apphelp.dll","ieframe.dll","System.Management.Automation.ni.dll","System.Transactions.dll","Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.dll","AutoItX3.PowerShell.dll","imm32.dll","secur32.dll","wshext.dll","System.Transactions.ni.dll","Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","ucrtbase.dll","System.Configuration.ni.dll","rsaenh.dll","System.Data.dll","Microsoft.Management.Infrastructure.Native.ni.dll","Microsoft.Windows.Diagnosis.SDEngine.dll","dnsapi.dll","msvcp140.dll","api-ms-win-crt-utility-l1-1-0.dll","WindowsCodecs.dll","wship6.dll","schannel.dll","msvcrt.dll","api-ms-win-crt-stdio-l1-1-0.dll","System.Management.ni.dll","rasadhlp.dll","ole32.dll","pwrshsip.dll","api-ms-win-core-synch-l1-2-0.dll","api-ms-win-crt-math-l1-1-0.dll","wintrust.dll","version.dll","clrjit.dll","WSHTCPIP.DLL","IPHLPAPI.DLL"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"HmnCSybE.exe","sha256":"ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"name":"DISMHOST.EXE.6AA9DA9A.bin","sha256":"ecb636b278261eade712e68ec7d805d20e802628248da872d3d0ada1432ffc11","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"name":"tmpD401.tmp","sha256":"c556354361399c1953d1a79647e49a7e03fe0264fdc2aa93c99b3aaac2bdb63b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"name":"StartupProfileData-NonInteractive","sha256":"a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"name":"dism.log","sha256":"49a4efdcd81c685e1275f5c49a2d6ae700dab7e1da6919857a0a0ed82b07e3f6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]}],"files_written":[{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"path":"%APPDATA%\\HmnCSybE.exe","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"path":"%TEMP%\\tmpD401.tmp","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"path":"%TEMP%\\1aauomap.d2z.ps1","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"path":"%TEMP%\\0hxe44th.jsd.psm1","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"6aa84f9c7fa5fa14b80402cb"}]}]}},"report_ids":{"sandbox_job_ids":["6aa84f9c7fa5fa14b80402cb"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious IL:Trojan.NanoCore Sample ec2687f0e226… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample ec2687f0e226…. Malware family: IL:Trojan.NanoCore. Threat score 100/100. 14/27 AV engines flagged this file. 21 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6"}],["$","meta","4",{"property":"og:title","content":"Malicious IL:Trojan.NanoCore Sample ec2687f0e226… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample ec2687f0e226…. Malware family: IL:Trojan.NanoCore. Threat score 100/100. 14/27 AV engines flagged this file. 21 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/ec2687f0e226016d1cec0764216b00675b8bda746aa9606053f62f3ed799f3d6"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious IL:Trojan.NanoCore Sample ec2687f0e226… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample ec2687f0e226…. Malware family: IL:Trojan.NanoCore. Threat score 100/100. 14/27 AV engines flagged this file. 21 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L5e","11",{}]]