26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 8c:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4ae,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious IL:Trojan.ClipBanker Sample f24d47bd9cc9… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample f24d47bd9cc9…. Malware family: IL:Trojan.ClipBanker. Threat score 100/100. 17/25 AV engines flagged this file. 21 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d","keywords":["Malicious","IL:Trojan.ClipBanker","malware analysis","sandbox report","threat intelligence","f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d"],"about":{"@type":"SoftwareApplication","name":"latestrock.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"IL:Trojan.ClipBanker","antivirusDetections":{"malicious":17,"total":25},"behavioralIndicators":{"malicious":21,"suspicious":26},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:Tcb9,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; File: "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; File: "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; File: "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; File: "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d") Found reference to API "WTSFreeMemory" (Indicator: "FreeMemory"; File: "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00003696.00000000.87243.0012C000.00000004.mdmp, 00000000-00003696.00000001.87336.0012C000.00000004.mdmp") Found reference to API "NtWriteVirtualMemory" (Indicator: "WriteVirtualMemory"; Source: "00000000-00003696.00000000.87243.0012C000.00000004.mdmp, 00000000-00003696.00000001.87336.0012C000.00000004.mdmp") Found reference to API "NtWriteVirtualMemory" (Indicator: "NtWriteVirtualMemory"; Source: "00000000-00003696.00000000.87243.0012C000.00000004.mdmp, 00000000-00003696.00000001.87336.0012C000.00000004.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00003696.00000000.87243.0012C000.00000004.mdmp, 00000000-00003696.00000001.87336.0012C000.00000004.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00003696.00000000.87243.0012C000.00000004.mdmp, 00000000-00003696.00000001.87336.0012C000.00000004.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00003696.00000000.87243.0012C000.00000004.mdmp, 00000000-00003696.00000001.87336.0012C000.00000004.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00003696.00000000.87243.0012C000.00000004.mdmp, 00000000-00003696.00000001.87336.0012C000.00000004.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00003756.00000002.91077.00408000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00003992.00000001.89667.71AAA000.00000004.mdmp, 00000000-00003992.00000001.89667.71C09000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00003992.00000001.89667.71AAA000.00000004.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00003992.00000001.89667.71C09000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00003992.00000001.89667.71C09000.00000002.mdmp")28:T43a,"Broom.exe" called "FindResourceW" with parameter "789" - (UID: 00000000-00003992) "Broom.exe" called "FindResourceW" with parameter "2" - (UID: 00000000-00003992) "Broom.exe" called "FindResourceW" with parameter "9" - (UID: 00000000-00003992) "Broom.exe" called "FindResourceW" with parameter "3" - (UID: 00000000-00003992) "Broom.exe" called "FindResourceW" with parameter "19" - (UID: 00000000-00003992) "Broom.exe" called "FindResourceW" with parameter "1001" - (UID: 00000000-00003992) "Broom.exe" called "FindResourceW" with parameter "2105" - (UID: 00000000-00003992) "Broom.exe" called "FindResourceW" with parameter "10" - (UID: 00000000-00003992) "Broom.exe" called "FindResourceW" with parameter "20" - (UID: 00000000-00003992) "Broom.exe" called "FindResourceW" with parameter "2107" - (UID: 00000000-00003992) "Broom.exe" called "FindResourceW" with parameter "8" - (UID: 00000000-00003992) "Broom.exe" called "FindResourceW" with parameter "18" - (UID: 00000000-00003992) "Broom.exe" called "FindResourceW" with parameter "2104" - (UID: 00000000-00003992)29:Ta8f,"InstallSetup5.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4477584'}" (UID: 00000000-00003756) "InstallSetup5.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4477488'}" (UID: 00000000-00003756) "Broom.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8866360'}" (UID: 00000000-00003992) "Broom.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8864344'}" (UID: 00000000-00003992) "Broom.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8866376'}" (UID: 00000000-00003992) "Broom.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8864360'}" (UID: 00000000-00003992) "Broom.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8866392'}" (UID: 00000000-00003992) "Broom.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8864376'}" (UID: 00000000-00003992) "Broom.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8866408'}" (UID: 00000000-00003992) "Broom.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8864392'}" (UID: 00000000-00003992) "Broom.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8866440'}" (UID: 00000000-00003992) "Broom.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8864424'}" (UID: 00000000-00003992) "Broom.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8866424'}" (UID: 00000000-00003992) "Broom.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8864408'}" (UID: 00000000-00003992) "Broom.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8866456'}" (UID: 00000000-00003992) "Broom.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8864872'}" (UID: 00000000-00003992) "Broom.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8864840'}" (UID: 00000000-00003992) "Broom.exe" called "LoadResource with parameter {'hModule': '1972436992', 'hResInfo': '4130288'}" (UID: 00000000-00003992) "Broom.exe" called "LoadResource with parameter {'hModule': '1891368960', 'hResInfo': '1891377280'}" (UID: 00000000-00003992) "Broom.exe" called "LoadResource with parameter {'hModule': '1620705282', 'hResInfo': '1620834160'}" (UID: 00000000-00003992) "Broom.exe" called "LoadResource with parameter {'hModule': '1620705282', 'hResInfo': '1620795760'}" (UID: 00000000-00003992) "Broom.exe" called "LoadResource with parameter {'hModule': '1600389122', 'hResInfo': '1600518016'}" (UID: 00000000-00003992)2a:T148a,Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00003696.00000000.87243.0012C000.00000004.mdmp, 00000000-00003696.00000001.87336.0012C000.00000004.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00003756.00000002.91077.00408000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00003756.00000002.91077.00408000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00003992.00000001.89667.71AAA000.00000004.mdmp, 00000000-00003992.00000001.89667.71C09000.00000002.mdmp, 00000000-00003992.00000002.91592.71B2A000.00000002.mdmp, 00000000-00003992.00000002.91592.71B68000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003992.00000001.89667.71AAA000.00000004.mdmp, 00000000-00003992.00000001.89667.71C09000.00000002.mdmp, 00000000-00003992.00000001.89667.71CA4000.00000002.mdmp, 00000000-00003992.00000002.91592.71B2A000.00000002.mdmp, 00000000-00003992.00000002.91592.71B68000.00000002.mdmp") Found reference to API "CreateTimerQueueTimer" (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00003992.00000001.89667.71AAA000.00000004.mdmp, 00000000-00003992.00000001.89667.71C09000.00000002.mdmp") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00003992.00000001.89667.71AAA000.00000004.mdmp") Found reference to API "result == ((((DWORD )0x00000000L) ) + 0 ) && L"WaitForSingleObject failed"" (Indicator: "WaitForSingleObject"; Source: "00000000-00003992.00000001.89667.71BA1000.00000020.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00003992.00000001.89667.71BA1000.00000020.mdmp, 00000000-00003992.00000001.89667.71C09000.00000002.mdmp, 00000000-00003992.00000001.89667.71CA4000.00000002.mdmp, 00000000-00003992.00000002.91592.71B2A000.00000002.mdmp, 00000000-00003992.00000002.91592.71B68000.00000002.mdmp") Found reference to API "(BOOL)g_pfnGetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00003992.00000001.89667.71BA1000.00000020.mdmp") Found reference to API "CreateTimerQueueTimer(&m_hTimerQueueHandle, nullptr, PeriodicTimer::TimerFired, this, period, period, 0x00000000)" (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00003992.00000001.89667.71BA1000.00000020.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003992.00000001.89667.71C09000.00000002.mdmp, 00000000-00003992.00000001.89667.71CA4000.00000002.mdmp, 00000000-00003992.00000002.91592.71B2A000.00000002.mdmp, 00000000-00003992.00000002.91592.71B68000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00003992.00000001.89667.71C09000.00000002.mdmp, 00000000-00003992.00000002.91592.71B68000.00000002.mdmp")2b:T977,Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00003428.00000000.89476.0B880000.00000004.mdmp, 00000000-00003428.00000001.89674.0B880000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00003756.00000002.91077.00408000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00003756.00000002.91077.00408000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00003992.00000001.89667.71AAA000.00000004.mdmp, 00000000-00003992.00000001.89667.71C09000.00000002.mdmp, 00000000-00003992.00000002.91592.71B68000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00003992.00000001.89667.71AAA000.00000004.mdmp, 00000000-00003992.00000001.89667.71C09000.00000002.mdmp, 00000000-00003992.00000002.91592.71B68000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00003992.00000001.89667.71AAA000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00003992.00000001.89667.71AAA000.00000004.mdmp, 00000000-00003992.00000001.89667.71C09000.00000002.mdmp, 00000000-00003992.00000002.91592.71B68000.00000002.mdmp") Found reference to API "FreeLibraryAnd" (Indicator: "FreeLibrary"; Source: "00000000-00003992.00000001.89667.71AAA000.00000004.mdmp") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; Source: "00000000-00003992.00000001.89667.71C09000.00000002.mdmp")2c:T405,Found reference to API "RegReplaceKeyW" (Indicator: "RegReplaceKey"; File: "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d") Found reference to API "RegFlushKey" (Indicator: "RegFlushKey"; File: "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d") Found reference to API "RegRestoreKeyW" (Indicator: "RegRestoreKey"; File: "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d") Found reference to API "RegSetValueExW" (Indicator: "RegSetValue"; File: "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d") Found reference to API "RegSetValueExW" (Indicator: "RegSetValue"; Source: "00000000-00000416.00000001.89158.0B480000.00000004.mdmp") Found reference to API "RegSetValueExW" (Indicator: "RegSetValue"; Source: "00000000-00003756.00000002.91077.00408000.00000002.mdmp") Found reference to API "RegSetValueExW" (Indicator: "RegSetValue"; Source: "00000000-00003992.00000001.89667.71C09000.00000002.mdmp, 00000000-00003992.00000002.91592.71B68000.00000002.mdmp")2d:T9c7,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00000416.00000001.89158.0B480000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00000416.00000001.89158.0B480000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00000416.00000001.89158.0B480000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00000416.00000001.89158.0B480000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00003428.00000000.89476.0B880000.00000004.mdmp, 00000000-00003428.00000001.89674.0B880000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00003428.00000000.89476.0B880000.00000004.mdmp, 00000000-00003428.00000001.89674.0B880000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00003428.00000000.89476.0B880000.00000004.mdmp, 00000000-00003428.00000001.89674.0B880000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00003428.00000000.89476.0B880000.00000004.mdmp, 00000000-00003428.00000001.89674.0B880000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/w" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00003992.00000001.89667.71BA1000.00000020.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/w" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00003992.00000001.89667.71BA1000.00000020.mdmp")2e:T745,Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00001368-00000CC3-392762622") Found reference to "SA/SHA384" (Indicator: "SHA384"; Source: "00000000-00001368.00000001.89322.00320000.00000004.mdmp, 00000000-00001368.00000002.91245.00320000.00000004.mdmp") Found reference to "CryptCNGInitHMAC" (Indicator: "HMAC"; Source: "00000000-00001368.00000001.89322.00320000.00000004.mdmp, 00000000-00001368.00000002.91245.00320000.00000004.mdmp") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00001368.00000001.89322.04BB0000.00000004.mdmp, 00000000-00001368.00000002.91245.04BB0000.00000004.mdmp") Found reference to ".?AVSHA512@CryptoPP@@" (Indicator: "SHA512"; Source: "00000000-00003992.00000001.89667.71322000.00000004.mdmp") Found reference to ".?AV?$IteratedHashWithStaticTransform@_KU?$EnumToType@W4ByteOrder@CryptoPP@@$00@CryptoPP@@$0IA@$0EA@VSHA512@2@$0EA@@CryptoPP@@" (Indicator: "SHA512"; Source: "00000000-00003992.00000001.89667.71322000.00000004.mdmp") Found reference to ".?AV?$ClonableImpl@VSHA512@CryptoPP@@V?$AlgorithmImpl@V?$IteratedHash@_KU?$EnumToType@W4ByteOrder@CryptoPP@@$00@CryptoPP@@$0IA@VHashTransformation@2@@CryptoPP@@VSHA512@2@@2@@CryptoPP@@" (Indicator: "SHA512"; Source: "00000000-00003992.00000001.89667.71322000.00000004.mdmp") Found reference to ".?AV?$AlgorithmImpl@V?$IteratedHash@_KU?$EnumToType@W4ByteOrder@CryptoPP@@$00@CryptoPP@@$0IA@VHashTransformation@2@@CryptoPP@@VSHA512@2@@CryptoPP@@" (Indicator: "SHA512"; Source: "00000000-00003992.00000001.89667.71322000.00000004.mdmp") Found reference to ".?AV?$HMAC@VSHA512@CryptoPP@@@CryptoPP@@" (Indicator: "HMAC"; Source: "00000000-00003992.00000001.89667.71322000.00000004.mdmp") Found reference to ".?AV?$HMAC@VSHA512@CryptoPP@@@CryptoPP@@" (Indicator: "SHA512"; Source: "00000000-00003992.00000001.89667.71322000.00000004.mdmp")2f:Td9d,"f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USERSFILES\NAMESPACE\DELEGATEFOLDERS") "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SESSIONINFO\1\USERSFILES\NAMESPACE") "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SESSIONINFO\1\USERSFILES\NAMESPACE\DELEGATEFOLDERS") "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INPROCSERVER32") "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INPROCSERVER32") "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE") "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE") "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE") "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE") "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE\INITPROPERTYBAG") "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE\INITPROPERTYBAG") "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SHELLCOMPATIBILITY\OBJECTS\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}") "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\EXEFILE") "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" (Access type: "OPEN"; Path: "HKCU\EXEFILE\SHELL") "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\EXEFILE\SHELL") "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\EXEFILE\SHELL") "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\EXEFILE\SHELL") "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\EXEFILE\SHELL\OPEN")30:T99e,Found api reference "CryptAcquireContextW(&hProv, 0, 0, 1, 0xF0000000)" (Indicator: "CryptAcquireContextW"; Source: "00000000-00003992.00000001.89667.71BA1000.00000020.mdmp") Found api reference "CryptImportKey(hProv, pBlob, cbBlob, 0, 0, &hKey)" (Indicator: "CryptImportKey"; Source: "00000000-00003992.00000001.89667.71BA1000.00000020.mdmp") Found api reference "CryptCreateHash(hProv, ((4 << 13) | (0) | 9), hKey, 0, &hHash)" (Indicator: "CryptCreateHash"; Source: "00000000-00003992.00000001.89667.71BA1000.00000020.mdmp") Found api reference "CryptSetHashParam(hHash, 0x0005, pHmacInfo, 0)" (Indicator: "CryptSetHashParam"; Source: "00000000-00003992.00000001.89667.71BA1000.00000020.mdmp") Found api reference "CryptHashData(hHash, pbBuffer, cbBuffer, 0)" (Indicator: "CryptHashData"; Source: "00000000-00003992.00000001.89667.71BA1000.00000020.mdmp") Found api reference "CryptHashData(hHash, bHmacPadding, cbPadding, 0)" (Indicator: "CryptHashData"; Source: "00000000-00003992.00000001.89667.71BA1000.00000020.mdmp") Found api reference "CryptGetHashParam(hHash, 0x0002, pHash, &dwHmacLen, 0)" (Indicator: "CryptGetHashParam"; Source: "00000000-00003992.00000001.89667.71BA1000.00000020.mdmp") Found api reference "CryptAcquireContextW" (Indicator: "CryptAcquireContextW"; Source: "00000000-00003992.00000001.89667.71C09000.00000002.mdmp") Found api reference "CryptReleaseContext" (Indicator: "CryptReleaseContext"; Source: "00000000-00003992.00000001.89667.71C09000.00000002.mdmp") Found api reference "CryptDestroyKey" (Indicator: "CryptDestroyKey"; Source: "00000000-00003992.00000001.89667.71C09000.00000002.mdmp") Found api reference "CryptSetHashParam" (Indicator: "CryptSetHashParam"; Source: "00000000-00003992.00000001.89667.71C09000.00000002.mdmp") Found api reference "CryptGetHashParam" (Indicator: "CryptGetHashParam"; Source: "00000000-00003992.00000001.89667.71C09000.00000002.mdmp") Found api reference "CryptImportKey" (Indicator: "CryptImportKey"; Source: "00000000-00003992.00000001.89667.71C09000.00000002.mdmp") Found api reference "CryptCreateHash" (Indicator: "CryptCreateHash"; Source: "00000000-00003992.00000001.89667.71C09000.00000002.mdmp") Found api reference "CryptHashData" (Indicator: "CryptHashData"; Source: "00000000-00003992.00000001.89667.71C09000.00000002.mdmp") Found api reference "CryptDestroyHash" (Indicator: "CryptDestroyHash"; Source: "00000000-00003992.00000001.89667.71C09000.00000002.mdmp")31:T132a,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003696-4504-50-0040C751 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003696-4504-50-0040C751 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003696-4504-54-00412A74 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003696-4504-54-00412A74 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003696-4504-59-0040AF79 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003696-4504-59-0040AF79 Assembly shows XOR instruction xor ecx dword ptr [eax+08h] in Stream UID: 00000000-00003696-4504-163-0041409D Assembly shows XOR instruction xor dword ptr [eax+08h] ecx in Stream UID: 00000000-00003696-4504-163-0041409D Assembly shows XOR instruction xor ecx dword ptr [eax] in Stream UID: 00000000-00003696-4504-163-0041409D Assembly shows XOR instruction xor dword ptr [eax] ecx in Stream UID: 00000000-00003696-4504-163-0041409D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003696-4504-202-00408ED3 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003696-4504-202-00408ED3 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003696-4504-205-00411248 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003696-4504-205-00411248 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003696-4504-228-00409651 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003696-4504-228-00409651 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003696-4504-502-00411AD3 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003696-4504-502-00411AD3 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003696-4504-517-00409A26 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003696-4504-517-00409A26 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003696-4504-518-0040CEE8 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003696-4504-518-0040CEE8 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003696-4504-520-00412DDF Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003696-4504-520-00412DDF Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003696-4504-523-0040A0F2 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003696-4504-523-0040A0F2 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003696-4504-525-0040A3A2 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003696-4504-525-0040A3A2 Assembly shows XOR instruction xor esi dword ptr [ebp-08h] in Stream UID: 00000000-00003696-4504-576-0040CE4F Assembly shows XOR instruction xor esi eax in Stream UID: 00000000-00003696-4504-576-0040CE4F Assembly shows XOR instruction xor eax dword ptr [ebp-10h] in Stream UID: 00000000-00003696-4504-576-0040CE4F Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003696-4504-587-0040F6CF Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003696-4504-587-0040F6CF Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003696-4504-594-0040F9A2 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003696-4504-594-0040F9A2 Assembly shows XOR instruction xor ecx edx in Stream UID: 00000000-00003696-4504-644-004295A5 Assembly shows XOR instruction xor eax dword ptr [esp+1Ch] in Stream UID: 00000000-00003696-4504-644-004295A5 Assembly shows XOR instruction xor esi ebp in Stream UID: 00000000-00003696-4504-644-004295A5 Assembly shows XOR instruction xor eax esi in Stream UID: 00000000-00003696-4504-644-004295A5 Assembly shows XOR instruction xor esi dword ptr [edx] in Stream UID: 00000000-00001368-22953-4-002529A1 Assembly shows XOR instruction xor al byte ptr [eax] in Stream UID: 00000000-00001368-22953-4-002529A1 Assembly shows XOR instruction xor eax 00003200h in Stream UID: 00000000-00001368-22953-4-002529A1 Assembly shows XOR instruction xor dword ptr [esi] ebp in Stream UID: 00000000-00001368-22953-4-002529A1 Assembly shows XOR instruction xor byte ptr [esi] ch in Stream UID: 00000000-00001368-22953-4-002529A1 Assembly shows XOR instruction xor byte ptr [eax] al in Stream UID: 00000000-00001368-22953-4-002529A1 Assembly shows XOR instruction xor dword ptr [ecx] edi in Stream UID: 00000000-00001368-22953-4-002529A1 Assembly shows XOR instruction xor byte ptr [ebp+64h] ah in Stream UID: 00000000-00001368-22953-4-002529A1 Assembly shows XOR instruction xor bh byte ptr [ecx] in Stream UID: 00000000-00001368-22953-4-002529A1 Assembly shows XOR instruction xor dh byte ptr [edx+424E54B5h] in Stream UID: 00000000-00003500-23432-2-00402EB832:T4d2,Found string ":\Windows\system32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00000416.00000001.89158.001D0000.00000004.mdmp") Found string ":\Windows\system32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00001368.00000001.89322.00320000.00000004.mdmp, 00000000-00001368.00000002.91245.00320000.00000004.mdmp") Found string ":\Windows\system32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00003428.00000001.89674.00170000.00000004.mdmp") Found string ":\Windows\system32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00003668.00000000.86679.000C0000.00000004.mdmp, 00000000-00003668.00000001.87614.000C0000.00000004.mdmp") Found string ":\Windows\system32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00003696.00000000.87243.00314000.00000004.mdmp, 00000000-00003696.00000001.87336.00314000.00000004.mdmp") Found string ":\Windows\system32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00003756.00000002.91077.00260000.00000004.mdmp") Found string ":\Windows\system32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00003992.00000001.89667.00200000.00000004.mdmp, 00000000-00003992.00000002.91592.00200000.00000004.mdmp")33:T490,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Able to utilize the Windows bcrypt cryptographic API Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains reference to crypto DLLs Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Contains CRYPTO related strings Matched sigs: Contains reference to cryptographic keys Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Able to import cryptographic keys (seen in ransomware) Matched sigs: Reads the cryptographic machine GUID Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Able to decode string content at runtime (.NET) Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: YARA signature match - Compress data using CryptoPP library34:Tab4f,Found XOR loop in file "Broom.exe" at offset 183152; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 1398424; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 2277228; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 3174453; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 3981781; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4215979; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4245459; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4251701; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4260243; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4264477; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4265025; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4271407; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4271957; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4273515; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4274021; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4279917; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4280775; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4284139; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4288461; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4290757; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4291873; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4297089; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4300237; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4304883; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4313819; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4319369; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4320045; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4322943; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4323589; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4324945; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4333207; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4338377; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4352667; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4356527; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4357111; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4359663; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4360203; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4369085; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4374163; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4376541; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4377281; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4380581; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4381685; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4382305; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4386127; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4395379; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4398571; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4404639; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4412133; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4425135; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4427849; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4435905; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4440201; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4442039; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4445249; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4448235; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4450563; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4453889; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4457403; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4460219; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4460969; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4467047; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4471467; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4474225; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4482825; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4489837; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4491907; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4498605; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4503451; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4505491; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4507535; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4509567; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4511595; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4513603; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4515581; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4520079; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4521503; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 207330; code bytes = 33c1 Found XOR loop in file "Broom.exe" at offset 751110; code bytes = 33c1 Found XOR loop in file "Broom.exe" at offset 751176; code bytes = 33c1 Found XOR loop in file "Broom.exe" at offset 751734; code bytes = 33c1 Found XOR loop in file "Broom.exe" at offset 751800; code bytes = 33c1 Found XOR loop in file "Broom.exe" at offset 752048; code bytes = 33c1 Found XOR loop in file "Broom.exe" at offset 752102; code bytes = 33c1 Found XOR loop in file "Broom.exe" at offset 2969433; code bytes = 33c1 Found XOR loop in file "Broom.exe" at offset 4223551; code bytes = 33c1 Found XOR loop in file "Broom.exe" at offset 4225721; code bytes = 33c1 Found XOR loop in file "Broom.exe" at offset 4250745; code bytes = 33c1 Found XOR loop in file "Broom.exe" at offset 4257353; code bytes = 33c1 Found XOR loop in file "Broom.exe" at offset 4258403; code bytes = 33c1 Found XOR loop in file "Broom.exe" at offset 4284487; code bytes = 33c1 Found XOR loop in file "Broom.exe" at offset 4301381; code bytes = 33c1 Found XOR loop in file "Broom.exe" at offset 4304513; code bytes = 33c1 Found XOR loop in file "Broom.exe" at offset 4360263; code bytes = 33c1 Found XOR loop in file "Broom.exe" at offset 4371529; code bytes = 33c1 Found XOR loop in file "Broom.exe" at offset 4378617; code bytes = 33c1 Found XOR loop in file "Broom.exe" at offset 4390005; code bytes = 33c1 Found XOR loop in file "Broom.exe" at offset 4394975; code bytes = 33c1 Found XOR loop in file "Broom.exe" at offset 4403681; code bytes = 33c1 Found XOR loop in file "Broom.exe" at offset 4405911; code bytes = 33c1 Found XOR loop in file "Broom.exe" at offset 4411623; code bytes = 33c1 Found XOR loop in file "Broom.exe" at offset 4441387; code bytes = 33c1 Found XOR loop in file "Broom.exe" at offset 4475725; code bytes = 33c1 Found XOR loop in file "Broom.exe" at offset 4477315; code bytes = 33c1 Found XOR loop in file "Broom.exe" at offset 171412; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 171439; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 171849; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 171876; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 172115; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 172139; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 172364; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 172445; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 172468; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 172492; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 172520; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 172544; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 632057; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 749208; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 1494445; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 1499378; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 1527668; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 1534029; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 1647056; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 1656959; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 1660710; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 1683414; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 1690242; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 1874404; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 1932020; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 2335633; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 2339613; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 2438552; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 2487542; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 2564565; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 2698258; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 2698330; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 2698356; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 2704137; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 3007389; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 3178035; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 3196123; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 3390901; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 3488098; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 3502055; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 3510588; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 3520770; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 3679280; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 3723862; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4166870; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4184466; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4213454; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4224030; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4237972; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4252254; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4256824; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4258836; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4263948; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4268236; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4268706; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4272994; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4273992; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4277572; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4286098; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4286624; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4290722; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4295448; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4300212; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4302548; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4303382; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4303872; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4304856; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4306654; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4310622; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4323560; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4324184; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4327980; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4329212; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4331564; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4338338; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4345638; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4347110; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4352628; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4357072; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4359624; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4365408; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4368810; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4371958; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4376506; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4383398; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4391652; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4396928; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4413582; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4418808; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4425096; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4429034; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4431508; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4433694; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4439310; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4440168; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4441244; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4442004; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4449753; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4450524; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4456826; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4460422; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4468210; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4477810; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4482044; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4482796; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4503412; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4505452; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4507496; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4509528; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4511556; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4513564; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4515544; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4518884; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4520040; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4521484; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4523006; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4525327; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4525451; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4526027; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4526299; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 5057962; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 271023; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 351464; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 362814; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 396274; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 496808; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 510459; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 529269; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 611727; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 659281; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 676026; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 904784; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 907087; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 958236; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1225789; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1265688; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1372536; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1381920; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1591600; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1673952; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1674195; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1732762; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1787821; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1806456; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1827063; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1856997; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1937654; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2118610; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2232720; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2236526; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2252300; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2387562; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2458405; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2476652; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2525888; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2547526; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2610672; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2629518; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2641713; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2657795; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2708610; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2850274; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2884080; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2899329; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2998288; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3111410; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3125441; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3140391; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3199559; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3210682; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3219344; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3229100; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3253972; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3259675; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3264877; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3598566; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3727006; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3917401; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3987810; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 4006306; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 4137795; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 4152647; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 30810; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 31429; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 95528; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 198985; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 350081; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 367255; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 373467; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 422942; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 466500; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 495532; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 572289; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 590305; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 660202; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 665866; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 667544; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 689363; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 762450; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 878151; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1117314; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1138450; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1286693; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1366196; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1398963; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1431194; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1440261; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1484968; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1569376; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1629014; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1636672; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1751774; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1863366; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1870347; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1904369; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1912927; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1980170; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2030141; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2153563; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2270878; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2398539; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2507787; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2547298; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2703057; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2747767; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2799585; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2937777; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3081503; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3098999; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3125350; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3130702; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3220709; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3348858; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3377716; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3500675; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3542956; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3707922; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3729348; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3759695; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3848093; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3870628; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3872919; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3919579; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3946980; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3975779; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 4030494; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 4108455; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 4141938; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 4151442; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 4203391; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 4223835; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 4251331; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 133825; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 199184; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 208729; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 230823; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 384598; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 453778; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 544567; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 820929; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 835648; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 962041; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1031158; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1091642; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1227889; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1325474; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1350423; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1582135; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1645218; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1737345; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1910734; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1946583; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1956526; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1981059; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1982021; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2014072; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2095249; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2109858; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2141909; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2174368; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2193550; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2220364; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2237235; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2346368; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2368673; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2472555; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2539731; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2650612; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2674838; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2682744; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2684492; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2801320; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2945176; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3125173; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3202020; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3282853; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3355524; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3386777; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3522615; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3552363; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3693956; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3748476; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3767221; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3785793; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3804768; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3814416; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3883557; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3978919; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3983654; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 4020970; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 4072534; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 4082740; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 4121398; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 4165674; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 4215206; code bytes = 8030 Found XOR loop in file "InstallSetup5.exe" at offset 475865; code bytes = 30d0 Found XOR loop in file "InstallSetup5.exe" at offset 529593; code bytes = 30d0 Found XOR loop in file "InstallSetup5.exe" at offset 578576; code bytes = 30d0 Found XOR loop in file "InstallSetup5.exe" at offset 795940; code bytes = 30d0 Found XOR loop in file "InstallSetup5.exe" at offset 889817; code bytes = 30d0 Found XOR loop in file "InstallSetup5.exe" at offset 1015190; code bytes = 30d0 Found XOR loop in file "InstallSetup5.exe" at offset 1248629; code bytes = 30d0 Found XOR loop in file "InstallSetup5.exe" at offset 1408097; code bytes = 30d0 Found XOR loop in file "InstallSetup5.exe" at offset 1411865; code bytes = 30d0 Found XOR loop in file "InstallSetup5.exe" at offset 1413161; code bytes = 30d0 Found XOR loop in file "InstallSetup5.exe" at offset 1418239; code bytes = 30d0 Found XOR loop in file "InstallSetup5.exe" at offset 1475644; code bytes = 30d0 Found XOR loop in file "InstallSetup5.exe" at offset 1477106; code bytes = 30d0 Found XOR loop in file "InstallSetup5.exe" at offset 1494193; code bytes = 30d0 Found XOR loop in file "InstallSetup5.exe" at offset 1536073; code bytes = 30d0 Found XOR loop in file "InstallSetup5.exe" at offset 1576865; code bytes = 30d0 Found XOR loop in file "InstallSetup5.exe" at offset 1604124; code bytes = 30d0 Found XOR loop in file "InstallSetup5.exe" at offset 1642490; code bytes = 30d0 Found XOR loop in file "InstallSetup5.exe" at offset 1664735; code bytes = 30d0 Found XOR loop in file "InstallSetup5.exe" at offset 1758721; code bytes = 30d0 Found XOR loop in file "InstallSetup5.exe" at offset 1767128; code bytes = 30d0 Found XOR loop in file "InstallSetup5.exe" at offset 1789245; code bytes = 30d0 Found XOR loop in file "InstallSetup5.exe" at offset 1820657; code bytes = 30d0 Found XOR loop in file "InstallSetup5.exe" at offset 1927702; code bytes = 30d0 Found XOR loop in file "InstallSetup5.exe" at offset 2006859; code bytes = 30d0 Found XOR loop in file "InstallSetup5.exe" at offset 2044507; code bytes = 30d0 Found XOR loop in file "InstallSetup5.exe" at offset 2315521; code bytes = 30d0 Found XOR loop in file "InstallSetup5.exe" at offset 2646530; code bytes = 30d0 Found XOR loop in file "InstallSetup5.exe" at offset 2657904; code bytes = 30d0 Found XOR loop in file "InstallSetup5.exe" at offset 54142; code bytes = 33c1 Found XOR loop in file "InstallSetup5.exe" at offset 78074; code bytes = 33c1 Found XOR loop in file "InstallSetup5.exe" at offset 159414; code bytes = 33c1 Found XOR loop in file "InstallSetup5.exe" at offset 170374; code bytes = 33c1 Found XOR loop in file "InstallSetup5.exe" at offset 310878; code bytes = 33c1 Found XOR loop in file "InstallSetup5.exe" at offset 436826; code bytes = 33c1 Found XOR loop in file "InstallSetup5.exe" at offset 568704; code bytes = 33c1 Found XOR loop in file "InstallSetup5.exe" at offset 752288; code bytes = 33c1 Found XOR loop in file "InstallSetup5.exe" at offset 761171; code bytes = 33c1 Found XOR loop in file "InstallSetup5.exe" at offset 769927; code bytes = 33c1 Found XOR loop in file "InstallSetup5.exe" at offset 781201; code bytes = 33c1 Found XOR loop in file "InstallSetup5.exe" at offset 863842; code bytes = 33c1 Found XOR loop in file "InstallSetup5.exe" at offset 921051; code bytes = 33c1 Found XOR loop in file "InstallSetup5.exe" at offset 966753; code bytes = 33c1 Found XOR loop in file "InstallSetup5.exe" at offset 1078542; code bytes = 33c1 Found XOR loop in file "InstallSetup5.exe" at offset 1221035; code bytes = 33c1 Found XOR loop in file "InstallSetup5.exe" at offset 1428907; code bytes = 33c1 Found XOR loop in file "InstallSetup5.exe" at offset 1533972; code bytes = 33c1 Found XOR loop in file "InstallSetup5.exe" at offset 1839241; code bytes = 33c1 Found XOR loop in file "InstallSetup5.exe" at offset 2060217; code bytes = 33c1 Found XOR loop in file "InstallSetup5.exe" at offset 2106558; code bytes = 33c1 Found XOR loop in file "InstallSetup5.exe" at offset 2177437; code bytes = 33c1 Found XOR loop in file "InstallSetup5.exe" at offset 2205775; code bytes = 33c1 Found XOR loop in file "InstallSetup5.exe" at offset 2227399; code bytes = 33c1 Found XOR loop in file "InstallSetup5.exe" at offset 2244427; code bytes = 33c1 Found XOR loop in file "InstallSetup5.exe" at offset 2315710; code bytes = 33c1 Found XOR loop in file "InstallSetup5.exe" at offset 2487365; code bytes = 33c1 Found XOR loop in file "InstallSetup5.exe" at offset 2528503; code bytes = 33c1 Found XOR loop in file "InstallSetup5.exe" at offset 2541638; code bytes = 33c1 Found XOR loop in file "InstallSetup5.exe" at offset 2562289; code bytes = 33c1 Found XOR loop in file "InstallSetup5.exe" at offset 2596403; code bytes = 33c1 Found XOR loop in file "InstallSetup5.exe" at offset 2598455; code bytes = 33c1 Found XOR loop in file "InstallSetup5.exe" at offset 459470; code bytes = 8030 Found XOR loop in file "InstallSetup5.exe" at offset 477638; code bytes = 8030 Found XOR loop in file "InstallSetup5.exe" at offset 535390; code bytes = 8030 Found XOR loop in file "InstallSetup5.exe" at offset 683029; code bytes = 8030 Found XOR loop in file "InstallSetup5.exe" at offset 800748; code bytes = 8030 Found XOR loop in file "InstallSetup5.exe" at offset 869283; code bytes = 8030 Found XOR loop in file "InstallSetup5.exe" at offset 908816; code bytes = 8030 Found XOR loop in file "InstallSetup5.exe" at offset 1081275; code bytes = 8030 Found XOR loop in file "InstallSetup5.exe" at offset 1084335; code bytes = 8030 Found XOR loop in file "InstallSetup5.exe" at offset 1153633; code bytes = 8030 Found XOR loop in file "InstallSetup5.exe" at offset 1272121; code bytes = 8030 Found XOR loop in file "InstallSetup5.exe" at offset 1328389; code bytes = 8030 Found XOR loop in file "InstallSetup5.exe" at offset 1350591; code bytes = 8030 Found XOR loop in file "InstallSetup5.exe" at offset 1363233; code bytes = 8030 Found XOR loop in file "InstallSetup5.exe" at offset 1412910; code bytes = 8030 Found XOR loop in file "InstallSetup5.exe" at offset 1821194; code bytes = 8030 Found XOR loop in file "InstallSetup5.exe" at offset 1864695; code bytes = 8030 Found XOR loop in file "InstallSetup5.exe" at offset 1970666; code bytes = 8030 Found XOR loop in file "InstallSetup5.exe" at offset 1985873; code bytes = 8030 Found XOR loop in file "InstallSetup5.exe" at offset 1999493; code bytes = 8030 Found XOR loop in file "InstallSetup5.exe" at offset 2010743; code bytes = 8030 Found XOR loop in file "InstallSetup5.exe" at offset 2025866; code bytes = 8030 Found XOR loop in file "InstallSetup5.exe" at offset 2101523; code bytes = 8030 Found XOR loop in file "InstallSetup5.exe" at offset 2104991; code bytes = 8030 Found XOR loop in file "InstallSetup5.exe" at offset 2181666; code bytes = 8030 Found XOR loop in file "InstallSetup5.exe" at offset 2270757; code bytes = 8030 Found XOR loop in file "InstallSetup5.exe" at offset 2387166; code bytes = 8030 Found XOR loop in file "InstallSetup5.exe" at offset 2617282; code bytes = 8030 Found XOR loop in file "InstallSetup5.exe" at offset 2630632; code bytes = 8030 Found XOR loop in file "InstallSetup5.exe" at offset 2667711; code bytes = 8030 Found XOR loop in file "toolspub2.exe" at offset 1548; code bytes = 30d0 Found XOR loop in file "toolspub2.exe" at offset 93222; code bytes = 30d0 Found XOR loop in file "toolspub2.exe" at offset 131262; code bytes = 30d0 Found XOR loop in file "toolspub2.exe" at offset 141489; code bytes = 30d0 Found XOR loop in file "toolspub2.exe" at offset 178660; code bytes = 30d0 Found XOR loop in file "toolspub2.exe" at offset 30794; code bytes = 33c1 Found XOR loop in file "toolspub2.exe" at offset 31413; code bytes = 33c1 Found XOR loop in file "toolspub2.exe" at offset 165971; code bytes = 33c1 Found XOR loop in file "toolspub2.exe" at offset 111196; code bytes = 8030 Found XOR loop in file "toolspub2.exe" at offset 135932; code bytes = 803035:T6ea,file/memory contains long string with (Indicator: "GetCommandLine"; File: "toolspub2.exe") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; File: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found string "GetCursorPos" (Indicator: "GetCursorPos"; File: "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00003696-00000C2C-369316081") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00000416.00000001.89158.0B480000.00000004.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00003428.00000000.89476.0B880000.00000004.mdmp, 00000000-00003428.00000001.89674.0B880000.00000004.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00003696.00000000.87243.0012C000.00000004.mdmp, 00000000-00003696.00000001.87336.0012C000.00000004.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00003756.00000002.91077.00408000.00000002.mdmp") Found string "GetCursorPos" (Indicator: "GetCursorPos"; Source: "00000000-00003992.00000000.87747.0081E000.00000004.mdmp, 00000000-00003992.00000002.91592.0081D000.00000004.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00003992.00000001.89667.71AAA000.00000004.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00003992.00000001.89667.71AAA000.00000004.mdmp, 00000000-00003992.00000001.89667.71C09000.00000002.mdmp, 00000000-00003992.00000002.91592.71B68000.00000002.mdmp")36:T6b0,Found reference to API "EnumSystemLocalesA" (Indicator: "EnumSystemLocales"; File: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; File: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; File: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; File: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; File: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "EnumSystemLocalesA" (Indicator: "EnumSystemLocales"; Source: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; Source: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00003992.00000001.89667.71C09000.00000002.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00003992.00000001.89667.71C09000.00000002.mdmp")37:T8d9,Found system information discovery API: "GetUserObjectInformationW" in file "00000000-00003696.00000001.87336.00401000.00000020.mdmp" Found system information discovery API: "ExpandEnvironmentStringsA" in file "00000000-00003696.00000001.87336.00401000.00000020.mdmp" Found system information discovery API: "GetEnvironmentStrings" in file "00000000-00003696.00000001.87336.00401000.00000020.mdmp" Found system information discovery API: "ExpandEnvironmentStringsW" in file "00000000-00003696.00000001.87336.00401000.00000020.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in file "00000000-00003696.00000001.87336.00401000.00000020.mdmp" Found system information discovery API: "GetSystemInfo" in file "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d" Found system information discovery API: "GetMonitorInfoW" in file "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d" Found system information discovery API: "GetUserObjectInformationW" in "00000000-00003696.00000001.87336.00401000.00000020.mdmp" Found system information discovery API: "ExpandEnvironmentStringsA" in "00000000-00003696.00000001.87336.00401000.00000020.mdmp" Found system information discovery API: "GetEnvironmentStrings" in "00000000-00003696.00000001.87336.00401000.00000020.mdmp" Found system information discovery API: "ExpandEnvironmentStringsW" in "00000000-00003696.00000001.87336.00401000.00000020.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00003696.00000001.87336.00401000.00000020.mdmp" Found system information discovery API: "ExpandEnvironmentStringsW" in "00000000-00003756.00000002.91077.00408000.00000002.mdmp" Found system information discovery API: "WTSRegisterSessionNotification" in "00000000-00003992.00000000.87747.00822000.00000004.mdmp, 00000000-00003992.00000001.89667.00822000.00000004.mdmp" Found system information discovery API: "GetNativeSystemInfo" in "00000000-00003992.00000000.87747.00822000.00000004.mdmp, 00000000-00003992.00000001.89667.00822000.00000004.mdmp, 00000000-00003992.00000001.89667.71C09000.00000002.mdmp" Found system information discovery API: "ExpandEnvironmentStringsW" in "00000000-00003992.00000001.89667.71C09000.00000002.mdmp"38:T5b7,Found reference to API "GetUserDefaultLangID" (Indicator: "GetUserDefaultLangID"; File: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "GetSystemDefaultUILanguage" (Indicator: "GetSystemDefaultUILanguage"; File: "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d") Found reference to API "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; File: "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d") Found reference to API "GetKeyboardLayoutNameW" (Indicator: "GetKeyboardLayout"; File: "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d") Found reference to API "GetKeyboardLayout" (Indicator: "GetKeyboardLayout"; File: "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d") Found reference to API "GetKeyboardLayoutList" (Indicator: "GetKeyboardLayoutList"; File: "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d") Found reference to API "GetUserDefaultLangID" (Indicator: "GetUserDefaultLangID"; Source: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00003756.00000001.89154.0040A000.00000004.mdmp") Found reference to API "GetKeyboardLayoutList" (Indicator: "GetKeyboardLayoutList"; Source: "00000000-00003992.00000000.87747.0081E000.00000004.mdmp, 00000000-00003992.00000002.91592.0081D000.00000004.mdmp")39:Tb61,Found reference to API "PostMessageW" (Indicator: "postmessage"; File: "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d") Found reference to API "EnumWindows" (Indicator: "enumwindows"; File: "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d") Found reference to API "FindWindowW" (Indicator: "findwindow"; File: "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d") Found reference to API "FindWindowExW" (Indicator: "findwindow"; File: "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d") Found reference to API "SendMessageW" (Indicator: "sendmessage"; File: "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; File: "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d") Found reference to API "SendMessageA" (Indicator: "sendmessage"; File: "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d") Found reference to API "SendMessageTimeoutW" (Indicator: "sendmessage"; File: "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d") Found reference to API "PostMessageA" (Indicator: "postmessage"; Source: "00000000-00003696-00000C2C-369417479") Found reference to API "PostMessageA" (Indicator: "postmessage"; Source: "00000000-00003696.00000000.87243.0012C000.00000004.mdmp, 00000000-00003696.00000001.87336.0012C000.00000004.mdmp") Found reference to API "SendMessageW" (Indicator: "sendmessage"; Source: "00000000-00003756.00000002.91077.00408000.00000002.mdmp") Found reference to API "FindWindowExW" (Indicator: "findwindow"; Source: "00000000-00003756.00000002.91077.00408000.00000002.mdmp") Found reference to API "SendMessageTimeoutW" (Indicator: "sendmessage"; Source: "00000000-00003756.00000002.91077.00408000.00000002.mdmp") Found reference to API "SendMessageA" (Indicator: "sendmessage"; Source: "00000000-00003992.00000000.87747.0081E000.00000004.mdmp, 00000000-00003992.00000002.91592.0081D000.00000004.mdmp") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00003992.00000000.87747.0081E000.00000004.mdmp, 00000000-00003992.00000002.91592.0081D000.00000004.mdmp") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; Source: "00000000-00003992.00000000.87747.0081E000.00000004.mdmp, 00000000-00003992.00000002.91592.0081D000.00000004.mdmp") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00003992.00000000.87747.0081E000.00000004.mdmp, 00000000-00003992.00000002.91592.0081D000.00000004.mdmp, 00000000-00003992.00000002.91592.71B68000.00000002.mdmp") Found reference to API "SendMessageW" (Indicator: "sendmessage"; Source: "00000000-00003992.00000000.87747.0081E000.00000004.mdmp, 00000000-00003992.00000002.91592.0081D000.00000004.mdmp, 00000000-00003992.00000002.91592.71B68000.00000002.mdmp")3a:T80e,"f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003668) "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003668) "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000000000001400000000000000000000000000000000000000000000000200000248361100216f004e0000000000000000000000008000000000000000216f004ee07611000100000000000000020000000c000000b82e1100b82e1100b32e1100000000000000000000000c000000000100f52f000000000020fb2f0095e16e777a031c00feffffff435c72775059727794000000a0000000b22e1100b02e110094000000a4f62f00fdfed07584ef2f000100000020fb2f0092e09468b088cf62feffffff3cf62f004c9c94685c0c000050f62f005f9c94680000000000000000 (UID: 00000000-00003668)3b:T1876,"f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000001005c00530058e210001100001175ba00005092110048361100b1080000aaa8640000200000b0080000580f00000d004200a2000000b1080000a1000000a1080000c9570000000000000000000036a8ffff5c00500000000000b1080000 (UID: 00000000-00003668) "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eb8e77a897160000a0fd7f9a5c737700b0fd7f14c6f90444a0fd7f00000000400000003f0000002100000000a0fd7f08c6f904c15c737760827a772100000000a0fd7f9a5c737700b0fd7f2cc6f9045789727780837a7713178c75d8eb8e77 (UID: 00000000-00003668) "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003668) "InstallSetup5.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eb8e77001b2b0000c0fd7f9a5c737700f0fd7fecf4120044c0fd7f00000000400000003f0000001d00000000c0fd7fe0f41200c15c737760827a771d00000000c0fd7f9a5c737700f0fd7f04f512005789727780837a7713178c75d8eb8e77 (UID: 00000000-00003756) "toolspub2.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003696) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000416) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000a4ea1200000000000000000000000000b8ea1200000000000000000000000000aeab4c1facea1200186d8b75acea12002a6d8b751c5c717743798b75ffffffff0c0000004c6271771f798b75ffffffff0c000000c0ea1200040000000004000001000000d4ea1200210e3f0200000000 (UID: 00000000-00000416) "kos4.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000350030002c002c004900730057006f00770036003400500072006f0063006500730073002c006b00650072006e0065006c00330032002e0064006c006c002c0022003200350032003a00300038003a00310037002e0033003700300022002c00520058003d0030002c00500058003d00 (UID: 00000000-00001368) "Broom.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003992) "Broom.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031007f00f00700000000008c470d7488d325008c470d740000000088d32500bcfe1200086d727718817a7700000000988d80000000000000000000fcfe120095e16e7725421c00feffffff6b2c737731198c75021000000000000000000100d0fe1200c89f72778c470d740000000000000000 (UID: 00000000-00003992) "Broom.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eb8e7780ca260000f0fd7f9a5c737700e0fd7fc4c7120044f0fd7f00000000400000003f0000002100000000f0fd7fb8c71200c15c737760827a772100000000f0fd7f9a5c737700e0fd7fdcc712005789727780837a7713178c75d8eb8e77 (UID: 00000000-00003992) "Broom.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b203100005cab2400100000001c000000c8db1200ccdc12007ac82d7108000000ac4e717793798b75ffffffff30dc1200000000001cdc12000010000004000000002000003cdc1200bf798b75ffffffff0000f4010000f401001000000400000074dc1200000013006ee901710000f401ff000000 (UID: 00000000-00003992) "Broom.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100205061636b203100005cab2400100000001c000000c8db1200ccdc12007ac82d7108000000ac4e717793798b75ffffffff30dc1200000000001cdc12000010000004000000002000003cdc1200bf798b75ffffffff0000f4010000f401001000000400000074dc1200000013006ee90171 (UID: 00000000-00003992) "Broom.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b203100205061636b203100205061636b203100005cab2400100000001c000000c8db1200ccdc12007ac82d7108000000ac4e717793798b75ffffffff30dc1200000000001cdc12000010000004000000002000003cdc1200bf798b75ffffffff0000f4010000f401001000000400000074dc1200 (UID: 00000000-00003992) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003428) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000a4ea1200000000000000000000000000b8ea12000000000000000000000000008bf168a6acea1200186d8b75acea12002a6d8b751c5c717743798b75ffffffff0c0000004c6271771f798b75ffffffff0c000000c0ea1200040000000004000001000000d4ea1200210e440200000000 (UID: 00000000-00003428)3c:T4fe,"f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" called "GetLocaleInfoW" with parameter "9" - (UID: 00000000-00003668) "Broom.exe" called "GetLocaleInfoW" with parameter "1033" - (UID: 00000000-00003992) "Broom.exe" called "GetLocaleInfoW" with parameter "65663" - (UID: 00000000-00003992) "Broom.exe" called "GetLocaleInfoW" with parameter "66567" - (UID: 00000000-00003992) "Broom.exe" called "GetLocaleInfoW" with parameter "66574" - (UID: 00000000-00003992) "Broom.exe" called "GetLocaleInfoW" with parameter "66615" - (UID: 00000000-00003992) "Broom.exe" called "GetLocaleInfoW" with parameter "133124" - (UID: 00000000-00003992) "Broom.exe" called "GetLocaleInfoW" with parameter "135172" - (UID: 00000000-00003992) "Broom.exe" called "GetLocaleInfoW" with parameter "136196" - (UID: 00000000-00003992) "Broom.exe" called "GetLocaleInfoW" with parameter "197636" - (UID: 00000000-00003992) "Broom.exe" called "GetLocaleInfoW" with parameter "263172" - (UID: 00000000-00003992) "Broom.exe" called "GetLocaleInfoW" with parameter "263185" - (UID: 00000000-00003992) "Broom.exe" called "GetLocaleInfoW" with parameter "265220" - (UID: 00000000-00003992) "Broom.exe" called "GetLocaleInfoW" with parameter "267268" - (UID: 00000000-00003992)3d:T5de,Found reference to API "FindNextVolumeMountPointA" (Indicator: "FindNextVolume"; File: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "FindNextVolumeMountPointA" (Indicator: "FindNextVolumeMountPoint"; File: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "FindNextVolumeMountPointW" (Indicator: "FindNextVolume"; File: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "FindNextVolumeMountPointW" (Indicator: "FindNextVolumeMountPoint"; File: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "FindFirstVolumeA" (Indicator: "FindFirstVolume"; File: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "FindNextVolumeMountPointA" (Indicator: "FindNextVolume"; Source: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "FindNextVolumeMountPointA" (Indicator: "FindNextVolumeMountPoint"; Source: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "FindNextVolumeMountPointW" (Indicator: "FindNextVolume"; Source: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "FindNextVolumeMountPointW" (Indicator: "FindNextVolumeMountPoint"; Source: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "FindFirstVolumeA" (Indicator: "FindFirstVolume"; Source: "00000000-00003696.00000001.87336.00401000.00000020.mdmp")3e:T4a2,"f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "InstallSetup5.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "InstallSetup5.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "toolspub2.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "toolspub2.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "kos4.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "Broom.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")3f:T591,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; File: "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00003992.00000001.89667.71AAA000.00000004.mdmp, 00000000-00003992.00000001.89667.71C09000.00000002.mdmp") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00003992.00000001.89667.71AAA000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003992.00000001.89667.71AAA000.00000004.mdmp, 00000000-00003992.00000001.89667.71C09000.00000002.mdmp, 00000000-00003992.00000001.89667.71CA4000.00000002.mdmp, 00000000-00003992.00000002.91592.71B2A000.00000002.mdmp, 00000000-00003992.00000002.91592.71B68000.00000002.mdmp") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; Source: "00000000-00003992.00000001.89667.71AAA000.00000004.mdmp, 00000000-00003992.00000001.89667.71C09000.00000002.mdmp")40:T840,Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; File: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; File: "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; File: "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; File: "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d") Found reference to API "FindWindowW" (Indicator: "FindWindow"; File: "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d") Found reference to API "FindWindowExW" (Indicator: "FindWindow"; File: "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; File: "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "FindWindowExW" (Indicator: "FindWindow"; Source: "00000000-00003756.00000002.91077.00408000.00000002.mdmp") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; Source: "00000000-00003992.00000000.87747.0081E000.00000004.mdmp, 00000000-00003992.00000002.91592.0081D000.00000004.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00003992.00000000.87747.0081E000.00000004.mdmp, 00000000-00003992.00000002.91592.0081D000.00000004.mdmp, 00000000-00003992.00000002.91592.719E1000.00000020.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00003992.00000000.87747.0081E000.00000004.mdmp, 00000000-00003992.00000002.91592.0081D000.00000004.mdmp") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; Source: "00000000-00003992.00000000.87747.0081E000.00000004.mdmp, 00000000-00003992.00000002.91592.0081D000.00000004.mdmp")41:T768,Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; File: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; File: "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; File: "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; File: "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; File: "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00003756.00000002.91077.00408000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00003756.00000002.91077.00408000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00003992.00000001.89667.71AAA000.00000004.mdmp, 00000000-00003992.00000001.89667.71C09000.00000002.mdmp, 00000000-00003992.00000002.91592.71B68000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00003992.00000001.89667.71AAA000.00000004.mdmp, 00000000-00003992.00000001.89667.71C09000.00000002.mdmp, 00000000-00003992.00000002.91592.71B68000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00003992.00000001.89667.71C09000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00003992.00000001.89667.71C09000.00000002.mdmp")42:T718,"kos4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "ENABLEDHCP"; Value: "") "kos4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTRATIONENABLED"; Value: "") "kos4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTERADAPTERNAME"; Value: "") "kos4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DOMAIN"; Value: "") "kos4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPDOMAIN"; Value: "") "kos4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "kos4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "kos4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "kos4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "kos4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")43:T620,"f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\31839B57A4F11171D6ABC8BBC4451EE4.EXE") "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\31839B57A4F11171D6ABC8BBC4451EE4.EXE") "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\INSTALLSETUP5.EXE") "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\INSTALLSETUP5.EXE") "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\KOS4.EXE") "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\KOS4.EXE") "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\TOOLSPUB2.EXE") "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\TOOLSPUB2.EXE") "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\LATESTX.EXE") "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\LATESTX.EXE")44:T49b,Found registry modification API: "RegCreateKeyExW" in file "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d" Found registry modification API: "RegConnectRegistryW" in file "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d" Found registry modification API: "RegLoadKeyW" in file "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d" Found registry modification API: "RegCreateKeyExW" in "00000000-00000416.00000001.89158.0B480000.00000004.mdmp" Found registry modification API: "RegCreateKeyExW" in "00000000-00003428.00000001.89674.0B880000.00000004.mdmp" Found registry modification API: "RegCreateKeyExW" in "00000000-00003756.00000002.91077.00408000.00000002.mdmp" Found registry modification API: "RegCreateKeyTransactedW" in "00000000-00003992.00000001.89667.71BA1000.00000020.mdmp, 00000000-00003992.00000002.91592.71B51000.00000020.mdmp" Found registry modification API: "RegCreateKeyExW" in "00000000-00003992.00000001.89667.71C09000.00000002.mdmp, 00000000-00003992.00000002.91592.71B68000.00000002.mdmp" Found registry modification API: "RegCreateKeyExA" in "00000000-00003992.00000001.89667.71C09000.00000002.mdmp"45:T4c1,file/memory contains long string with (Indicator: "MoveFileW"; File: "toolspub2.exe") Found string "MoveFileWithProgressA" (Indicator: "MoveFileW"; File: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found string "MoveFileWithProgressW" (Indicator: "MoveFileW"; File: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found string "MoveFileExW" (Indicator: "MoveFileExW"; File: "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d") Found string "MoveFileW" (Indicator: "MoveFileW"; File: "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d") Found string "MoveFileWithProgressA" (Indicator: "MoveFileW"; Source: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found string "MoveFileWithProgressW" (Indicator: "MoveFileW"; Source: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found string "MoveFileW" (Indicator: "MoveFileW"; Source: "00000000-00003756.00000002.91077.00408000.00000002.mdmp") Found string "MoveFileExW" (Indicator: "MoveFileExW"; Source: "00000000-00003756.00000002.91077.00408000.00000002.mdmp") Found string "MoveFileExW" (Indicator: "MoveFileExW"; Source: "00000000-00003992.00000001.89667.71AAA000.00000004.mdmp")46:T559,"kos4.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "kos4.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "kos4.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "kos4.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "kos4.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\2E4916B07F3DE90C8DDE2566FD9B9B400D89BBBA"; Key: "BLOB") "kos4.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB") "kos4.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\E6A3B45B062D509B3382282D196EFE97D5956CCB"; Key: "BLOB") "kos4.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\F5AD0BCC1AD56CD150725B1C866C30AD92EF21B0"; Key: "BLOB") "kos4.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "kos4.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "kos4.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "kos4.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "kos4.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB")47:T4e5,"f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00003668) "InstallSetup5.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00003756) "InstallSetup5.exe" called "CreateDirectoryW" with parameter %TEMP%\ (UID: 00000000-00003756) "InstallSetup5.exe" called "CreateDirectoryW" with parameter C:\Users (UID: 00000000-00003756) "InstallSetup5.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00003756) "InstallSetup5.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData (UID: 00000000-00003756) "InstallSetup5.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00003756) "InstallSetup5.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Temp (UID: 00000000-00003756) "kos4.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00001368) "kos4.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00001368) "Broom.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00003992)48:T417,"f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" called "CreateProcessW" with parameter ""%TEMP%\InstallSetup5.exe"" - (UID: 00000000-00003668) "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" called "CreateProcessW" with parameter ""%TEMP%\toolspub2.exe"" - (UID: 00000000-00003668) "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" called "CreateProcessW" with parameter ""%TEMP%\31839b57a4f11171d6abc8bbc4451ee4.exe"" - (UID: 00000000-00003668) "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" called "CreateProcessW" with parameter ""%TEMP%\kos4.exe"" - (UID: 00000000-00003668) "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" called "CreateProcessW" with parameter ""%TEMP%\latestX.exe"" - (UID: 00000000-00003668) "InstallSetup5.exe" called "CreateProcessW" with parameter "%TEMP%\Broom.exe" - (UID: 00000000-00003756) "toolspub2.exe" called "CreateProcessA" with parameter ""%TEMP%\toolspub2.exe"" - (UID: 00000000-00003696)49:T6d8e,"f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003668) "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003668) "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003668) "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003668) "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003668) "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00003668) "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003668) "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00003668) "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00003668) "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00003668) "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00003668) "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003668) "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00003668) "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00003668) "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00003668) "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00003668) "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00003668) "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00003668) "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00003668) "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003668) "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00003668) "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00003668) "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003668) "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003668) "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00003668) "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00003668) "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00003668) "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00003668) "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00003668) "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003668) "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00003668) "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00003668) "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00003668) "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00003668) "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00003668) "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00003668) "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00003668) "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003668) "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00003668) "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00003668) "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00003668) "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00003668) "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00003668) "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00003668) "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" called "LoadLibrary" with a parameter f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe (UID: 00000000-00003668) "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll (UID: 00000000-00003668) "InstallSetup5.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00003756) "InstallSetup5.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003756) "InstallSetup5.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SETUPAPI.dll (UID: 00000000-00003756) "InstallSetup5.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\APPHELP.dll (UID: 00000000-00003756) "InstallSetup5.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003756) "InstallSetup5.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00003756) "InstallSetup5.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\PROPSYS.dll (UID: 00000000-00003756) "InstallSetup5.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\DWMAPI.dll (UID: 00000000-00003756) "InstallSetup5.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CRYPTBASE.dll (UID: 00000000-00003756) "InstallSetup5.exe" called "LoadLibrary" with a parameter OLEACCRC.DLL (UID: 00000000-00003756) "InstallSetup5.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\OLEACC.dll (UID: 00000000-00003756) "InstallSetup5.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CLBCATQ.dll (UID: 00000000-00003756) "InstallSetup5.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\NTMARTA.dll (UID: 00000000-00003756) "InstallSetup5.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\VERSION.dll (UID: 00000000-00003756) "InstallSetup5.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SHFOLDER.dll (UID: 00000000-00003756) "InstallSetup5.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003756) "InstallSetup5.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003756) "InstallSetup5.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00003756) "InstallSetup5.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00003756) "toolspub2.exe" called "LoadLibrary" with a parameter msimg32.dll (UID: 00000000-00003696) "toolspub2.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003696) "toolspub2.exe" called "LoadLibrary" with a parameter user32 (UID: 00000000-00003696) "toolspub2.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003696) "toolspub2.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003696) "toolspub2.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003696) "toolspub2.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00003696) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter msimg32.dll (UID: 00000000-00000416) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00000416) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter msvcr100.dll (UID: 00000000-00000416) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00000416) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00000416) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00000416) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00000416) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00000416) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00000416) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter wtsapi32.dll (UID: 00000000-00000416) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter WINSTA.dll (UID: 00000000-00000416) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00000416) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00000416) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00000416) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00000416) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00000416) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00000416) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00000416) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter SXS.DLL (UID: 00000000-00000416) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00000416) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter netapi32.dll (UID: 00000000-00000416) "kos4.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00001368) "kos4.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00001368) "kos4.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00001368) "kos4.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00001368) "kos4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00001368) "kos4.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001368) "kos4.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001368) "kos4.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001368) "kos4.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001368) "kos4.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001368) "kos4.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00001368) "kos4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00001368) "kos4.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00001368) "kos4.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00001368) "kos4.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00001368) "kos4.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00001368) "kos4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00001368) "kos4.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001368) "kos4.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00001368) "kos4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00001368) "kos4.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00001368) "kos4.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001368) "kos4.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00001368) "kos4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00001368) "kos4.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00001368) "kos4.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00001368) "kos4.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00001368) "kos4.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001368) "kos4.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00001368) "kos4.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001368) "kos4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00001368) "kos4.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00001368) "kos4.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00001368) "kos4.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00001368) "kos4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00001368) "kos4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll (UID: 00000000-00001368) "kos4.exe" called "LoadLibrary" with a parameter rasapi32.dll (UID: 00000000-00001368) "kos4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00001368) "kos4.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00001368) "kos4.exe" called "LoadLibrary" with a parameter RASMAN.DLL (UID: 00000000-00001368) "kos4.exe" called "LoadLibrary" with a parameter rtutils.dll (UID: 00000000-00001368) "kos4.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-winsvc-L1-1-0.dll (UID: 00000000-00001368) "kos4.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L1-1-0.dll (UID: 00000000-00001368) "kos4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll (UID: 00000000-00001368) "kos4.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00001368) "kos4.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00001368) "kos4.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00001368) "kos4.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00001368) "kos4.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00001368) "kos4.exe" called "LoadLibrary" with a parameter NSI.dll (UID: 00000000-00001368) "kos4.exe" called "LoadLibrary" with a parameter CFGMGR32.dll (UID: 00000000-00001368) "kos4.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L2-1-0.dll (UID: 00000000-00001368) "kos4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00001368) "kos4.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00001368) "kos4.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00001368) "kos4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll (UID: 00000000-00001368) "kos4.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00001368) "kos4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00001368) "kos4.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00001368) "kos4.exe" called "LoadLibrary" with a parameter ncrypt.dll (UID: 00000000-00001368) "kos4.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\bcryptprimitives.dll (UID: 00000000-00001368) "kos4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00001368) "kos4.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00001368) "kos4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll (UID: 00000000-00001368) "kos4.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00001368) "kos4.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00001368) "kos4.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00001368) "kos4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00001368) "kos4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00001368) "kos4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00001368) "Broom.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003992) "Broom.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00003992) "Broom.exe" called "LoadLibrary" with a parameter wtsapi32.dll (UID: 00000000-00003992) "Broom.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003992) "Broom.exe" called "LoadLibrary" with a parameter WINSTA.dll (UID: 00000000-00003992) "Broom.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003992) "Broom.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00003992) "Broom.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00003992) "Broom.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00003992) "Broom.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00003992) "Broom.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00003992) "Broom.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00003992) "Broom.exe" called "LoadLibrary" with a parameter colorui.dll (UID: 00000000-00003992) "Broom.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00003992) "Broom.exe" called "LoadLibrary" with a parameter comdlg32.dll (UID: 00000000-00003992) "Broom.exe" called "LoadLibrary" with a parameter compstui.dll (UID: 00000000-00003992) "Broom.exe" called "LoadLibrary" with a parameter inetres.dll (UID: 00000000-00003992) "Broom.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00003992) "Broom.exe" called "LoadLibrary" with a parameter %WINDIR%\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\gdiplus.dll (UID: 00000000-00003992) "Broom.exe" called "LoadLibrary" with a parameter msimg32.dll (UID: 00000000-00003992) "Broom.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003992) "Broom.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00003992) "Broom.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00003992) "Broom.exe" called "LoadLibrary" with a parameter WindowsCodecs.dll (UID: 00000000-00003992) "Broom.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00003992) "Broom.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Microsoft\OneDrive\17.3.4604.0120\FileSyncShell.dll (UID: 00000000-00003992) "Broom.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\EhStorShell.dll (UID: 00000000-00003992) "Broom.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\MICROS~3\Office14\GROOVEEX.DLL (UID: 00000000-00003992) "Broom.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\COMMON~1\MICROS~1\OFFICE14\Cultures\office.odf (UID: 00000000-00003992) "Broom.exe" called "LoadLibrary" with a parameter Comctl32.dll (UID: 00000000-00003992) "Broom.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\MICROS~3\Office14\1033\GrooveIntlResource.dll (UID: 00000000-00003992) "Broom.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\imageres.dll (UID: 00000000-00003992) "Broom.exe" called "LoadLibrary" with a parameter DWMAPI.DLL (UID: 00000000-00003992) "Broom.exe" called "LoadLibrary" with a parameter UXTHEME (UID: 00000000-00003992) "Broom.exe" called "LoadLibrary" with a parameter User32 (UID: 00000000-00003992) "Broom.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003992) "Broom.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00003992) "Broom.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00003992) "Broom.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003992) "Broom.exe" called "LoadLibrary" with a parameter %TEMP%\Broom.exe (UID: 00000000-00003992) "Broom.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00003992) "Broom.exe" called "LoadLibrary" with a parameter UxTheme.dll (UID: 00000000-00003992) "Broom.exe" called "LoadLibrary" with a parameter IMM32.dll (UID: 00000000-00003992) "Broom.exe" called "LoadLibrary" with a parameter comctl32 (UID: 00000000-00003992) "Broom.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ole32.dll (UID: 00000000-00003992) "Broom.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\MSCTF.dll (UID: 00000000-00003992) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter msimg32.dll (UID: 00000000-00003428) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003428) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter msvcr100.dll (UID: 00000000-00003428) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003428) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003428) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00003428) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00003428) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00003428) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00003428) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter wtsapi32.dll (UID: 00000000-00003428) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter WINSTA.dll (UID: 00000000-00003428) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003428) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00003428) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00003428) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003428) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00003428) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003428) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00003428) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter SXS.DLL (UID: 00000000-00003428) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00003428)4a:T557,Found reference to API "CreateFileW" (Indicator: "CreateFile"; File: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; File: "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00000416.00000001.89158.0B480000.00000004.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00003428.00000001.89674.0B880000.00000004.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00003696.00000000.87243.0012C000.00000004.mdmp, 00000000-00003696.00000001.87336.0012C000.00000004.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00003756.00000002.91077.00408000.00000002.mdmp") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00003992.00000001.89667.71C09000.00000002.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00003992.00000001.89667.71C09000.00000002.mdmp, 00000000-00003992.00000001.89667.71CA4000.00000002.mdmp, 00000000-00003992.00000002.91592.71B2A000.00000002.mdmp")4b:T73a,Found reference to API "WinExec" (Indicator: "WinExec"; File: "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d") Found reference to API "ShellExecuteExW" (Indicator: "ShellExecute"; File: "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d") Found reference to API "ShellExecuteW" (Indicator: "ShellExecute"; File: "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d") Found reference to API "at System.Diagnostics.Process.StartWithShellExecuteEx(ProcessStartInfo startInfo)" (Indicator: "ShellExecute"; Source: "00000000-00003668.00000001.87614.000C0000.00000004.mdmp, 00000000-00003668.00000001.87614.02A80000.00000004.mdmp") Found reference to API "at System.Diagnostics.Process.StartWithShellExecuteEx(System.Diagnostics.ProcessStartInfo)" (Indicator: "ShellExecute"; Source: "00000000-00003668.00000001.87614.000C0000.00000004.mdmp") Found reference to API "StartWithShellExecuteEx" (Indicator: "ShellExecute"; Source: "00000000-00003668.00000001.87614.02A80000.00000004.mdmp") Found reference to API "WinExec" (Indicator: "WinExec"; Source: "00000000-00003696.00000000.87243.0012C000.00000004.mdmp, 00000000-00003696.00000001.87336.0012C000.00000004.mdmp") Found reference to API "ShellExecuteExW" (Indicator: "ShellExecute"; Source: "00000000-00003756.00000002.91077.00408000.00000002.mdmp") Found reference to API "ShellExecuteW" (Indicator: "ShellExecute"; Source: "00000000-00003992.00000000.87747.0081E000.00000004.mdmp, 00000000-00003992.00000002.91592.0081D000.00000004.mdmp, 00000000-00003992.00000002.91592.71B68000.00000002.mdmp") Found reference to API "ShellExecuteExW" (Indicator: "ShellExecute"; Source: "00000000-00003992.00000000.87747.0081E000.00000004.mdmp, 00000000-00003992.00000002.91592.0081D000.00000004.mdmp, 00000000-00003992.00000002.91592.71B68000.00000002.mdmp")4c:T612,Found reference to API "FreeResource" (Indicator: "FreeResource"; File: "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d") Found reference to API "LockResource" (Indicator: "LockResource"; File: "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d") Found reference to API "FindResourceW" (Indicator: "FindResource"; File: "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00003992.00000001.89667.71C09000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00003992.00000001.89667.71C09000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00003992.00000001.89667.71C09000.00000002.mdmp, 00000000-00003992.00000002.91592.71B68000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00003992.00000001.89667.71C09000.00000002.mdmp, 00000000-00003992.00000002.91592.71B68000.00000002.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00003992.00000001.89667.71C09000.00000002.mdmp, 00000000-00003992.00000002.91592.71B68000.00000002.mdmp")4d:T4b5,Found reference to API "MoveFileWithProgressA" (Indicator: "MoveFile"; File: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "MoveFileWithProgressW" (Indicator: "MoveFile"; File: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "MoveFileExW" (Indicator: "MoveFile"; File: "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d") Found reference to API "MoveFileW" (Indicator: "MoveFile"; File: "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d") Found reference to API "MoveFileWithProgressA" (Indicator: "MoveFile"; Source: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "MoveFileWithProgressW" (Indicator: "MoveFile"; Source: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "MoveFileW" (Indicator: "MoveFile"; Source: "00000000-00003756.00000002.91077.00408000.00000002.mdmp") Found reference to API "MoveFileExW" (Indicator: "MoveFile"; Source: "00000000-00003756.00000002.91077.00408000.00000002.mdmp") Found reference to API "MoveFileExW" (Indicator: "MoveFile"; Source: "00000000-00003992.00000001.89667.71AAA000.00000004.mdmp")4e:T5c9,Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; File: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00000416.00000001.89158.0B480000.00000004.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00003428.00000000.89476.0B880000.00000004.mdmp, 00000000-00003428.00000001.89674.0B880000.00000004.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00003696.00000000.87243.0012C000.00000004.mdmp, 00000000-00003696.00000001.87336.0012C000.00000004.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00003756.00000002.91077.00408000.00000002.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00003992.00000001.89667.71AAA000.00000004.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00003992.00000001.89667.71AAA000.00000004.mdmp, 00000000-00003992.00000001.89667.71C09000.00000002.mdmp, 00000000-00003992.00000002.91592.71B68000.00000002.mdmp") Found reference to API "CommandLineToArgvW" (Indicator: "CommandLineToArgv"; Source: "00000000-00003992.00000001.89667.71C09000.00000002.mdmp")4f:T64d,Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00003696.00000000.87243.0012C000.00000004.mdmp, 00000000-00003696.00000001.87336.0012C000.00000004.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00003696.00000000.87243.0012C000.00000004.mdmp, 00000000-00003696.00000001.87336.0012C000.00000004.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00003696.00000000.87243.0012C000.00000004.mdmp, 00000000-00003696.00000001.87336.0012C000.00000004.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00003756.00000002.91077.00408000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00003992.00000001.89667.71AAA000.00000004.mdmp, 00000000-00003992.00000001.89667.71C09000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00003992.00000001.89667.71AAA000.00000004.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00003992.00000001.89667.71AAA000.00000004.mdmp")50:T5cf,Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; File: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00003756.00000002.91077.00408000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00003992.00000001.89667.71AAA000.00000004.mdmp, 00000000-00003992.00000001.89667.71BA1000.00000020.mdmp, 00000000-00003992.00000001.89667.71C09000.00000002.mdmp, 00000000-00003992.00000001.89667.71CA4000.00000002.mdmp, 00000000-00003992.00000002.91592.71B2A000.00000002.mdmp, 00000000-00003992.00000002.91592.71B68000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00003992.00000001.89667.71AAA000.00000004.mdmp, 00000000-00003992.00000001.89667.71C09000.00000002.mdmp, 00000000-00003992.00000002.91592.71B68000.00000002.mdmp") Found reference to API "HRESULT_FROM_WIN32(GetLastError())" (Indicator: "GetLastError"; Source: "00000000-00003992.00000001.89667.71BA1000.00000020.mdmp")51:Tcf4,":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00003668.00000001.87614.000C0000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00003668.00000001.87614.000C0000.00000004.mdmp ":\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00003668.00000001.87614.000C0000.00000004.mdmp "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00003668.00000001.87614.000C0000.00000004.mdmp ":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00003756.00000002.91077.00260000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00003756.00000002.91077.00260000.00000004.mdmp ":\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00003756.00000002.91077.00260000.00000004.mdmp "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00003756.00000002.91077.00260000.00000004.mdmp ":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00003992.00000001.89667.00200000.00000004.mdmp 00000000-00003992.00000002.91592.00200000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00003992.00000001.89667.00200000.00000004.mdmp 00000000-00003992.00000001.89667.01C40000.00000002.mdmp 00000000-00003992.00000002.91592.00200000.00000004.mdmp ":\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00003992.00000001.89667.00200000.00000004.mdmp 00000000-00003992.00000002.91592.00200000.00000004.mdmp "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00003992.00000001.89667.00200000.00000004.mdmp 00000000-00003992.00000001.89667.01C40000.00000002.mdmp 00000000-00003992.00000002.91592.00200000.00000004.mdmp52:T13b9,"S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\TestApp" in Source: 00000000-00000416.00000001.89158.0B480000.00000004.mdmp "S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\483f7b2a" in Source: 00000000-00000416.00000001.89158.0B480000.00000004.mdmp "HKEY_USERS\S-1-5-21-2092356043-4041700817-663127204-1001" in Source: 00000000-00000416.00000001.89158.0B480000.00000004.mdmp "HKEY_USERS\1464" in Source: 00000000-00000416.00000001.89158.0B480000.00000004.mdmp "!This program cannoHKEY_USERS\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\TestApp" in Source: 00000000-00000416.00000001.89158.0B480000.00000004.mdmp "HKEY_USERS\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\483f7b2a" in Source: 00000000-00000416.00000001.89158.0B480000.00000004.mdmp "S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\TestApp" in Source: 00000000-00003428.00000001.89674.0B880000.00000004.mdmp "S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\483f7b2a" in Source: 00000000-00003428.00000001.89674.0B880000.00000004.mdmp "HKEY_USERS\S-1-5-21-2092356043-4041700817-663127204-1001" in Source: 00000000-00003428.00000001.89674.0B880000.00000004.mdmp "HKEY_USERS\1464" in Source: 00000000-00003428.00000001.89674.0B880000.00000004.mdmp "!This program cannoHKEY_USERS\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\TestApp" in Source: 00000000-00003428.00000001.89674.0B880000.00000004.mdmp "HKEY_USERS\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\483f7b2a" in Source: 00000000-00003428.00000001.89674.0B880000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00003668.00000000.86679.000C0000.00000004.mdmp 00000000-00003668.00000001.87614.000C0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00003668.00000000.86679.000C0000.00000004.mdmp 00000000-00003668.00000001.87614.000C0000.00000004.mdmp "EGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00003668.00000001.87614.000C0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00003668.00000001.87614.000C0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00003668.00000001.87614.000C0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00003668.00000001.87614.02A80000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00003668.00000001.87614.02A80000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00003668.00000001.87614.02A80000.00000004.mdmp "SOFTWARE\BroomCleaner" in Source: 00000000-00003756.00000002.91077.00260000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00003756.00000002.91077.00408000.00000002.mdmp "EGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00003992.00000001.89667.00200000.00000004.mdmp 00000000-00003992.00000002.91592.00200000.00000004.mdmp "oftware\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify" in Source: 00000000-00003992.00000001.89667.00200000.00000004.mdmp 00000000-00003992.00000002.91592.00200000.00000004.mdmp "Software\Microsoft\OneDrive" in Source: 00000000-00003992.00000001.89667.71BA1000.00000020.mdmp 00000000-00003992.00000002.91592.71B51000.00000020.mdmp "Software\Microsoft\Windows Live\Common" in Source: 00000000-00003992.00000001.89667.71BA1000.00000020.mdmp 00000000-00003992.00000002.91592.71B51000.00000020.mdmp "Software\Microsoft\Windows Live\Common\Activations\%d" in Source: 00000000-00003992.00000001.89667.71BA1000.00000020.mdmp "Software\Policies\Microsoft\SQMClient" in Source: 00000000-00003992.00000001.89667.71BA1000.00000020.mdmp "Software\Microsoft\SQMClient" in Source: 00000000-00003992.00000001.89667.71BA1000.00000020.mdmp "Software\Microsoft\SQMClient\%s\AdaptiveSqm\ManifestInfo" in Source: 00000000-00003992.00000001.89667.71BA1000.00000020.mdmp "Software\Microsoft\SQMClient\%s\AdaptiveSqm\Throttling" in Source: 00000000-00003992.00000001.89667.71BA1000.00000020.mdmp "SOFTWARE\Microsoft\Reliability Analysis\RAC" in Source: 00000000-00003992.00000001.89667.71BA1000.00000020.mdmp "Software\Microsoft\SQMClient\Windows" in Source: 00000000-00003992.00000001.89667.71BA1000.00000020.mdmp "Software\Policies\Microsoft\SQMClient\Windows" in Source: 00000000-00003992.00000001.89667.71BA1000.00000020.mdmp "Software\Microsoft\SQMClient\UploadUrlMap" in Source: 00000000-00003992.00000001.89667.71BA1000.00000020.mdmp "SOFTWARE\Microsoft\Cryptography" in Source: 00000000-00003992.00000001.89667.71BA1000.00000020.mdmp53:T10ae,"f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "kos4.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "kos4.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "kos4.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "kos4.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "kos4.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "kos4.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "kos4.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "kos4.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "kos4.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "kos4.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "kos4.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll" - [base:0; Status:c0000135] "kos4.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "kos4.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll" - [base:0; Status:c0000135] "kos4.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "kos4.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" - [base:0; Status:c0000135] "kos4.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "kos4.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "kos4.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135]54:T178b,"HKEY_USERS\S-1-5-21-2092356043-4041700817-663127204-1001" in Source: 00000000-00000416.00000001.89158.0B480000.00000004.mdmp "HKEY_USERS\1464" in Source: 00000000-00000416.00000001.89158.0B480000.00000004.mdmp "S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\TestApp" in Source: 00000000-00000416.00000001.89158.0B480000.00000004.mdmp "S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\483f7b2a" in Source: 00000000-00000416.00000001.89158.0B480000.00000004.mdmp "!This program cannoHKEY_USERS\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\TestApp" in Source: 00000000-00000416.00000001.89158.0B480000.00000004.mdmp "HKEY_USERS\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\483f7b2a" in Source: 00000000-00000416.00000001.89158.0B480000.00000004.mdmp "HKEY_USERS\S-1-5-21-2092356043-4041700817-663127204-1001" in Source: 00000000-00003428.00000001.89674.0B880000.00000004.mdmp "HKEY_USERS\1464" in Source: 00000000-00003428.00000001.89674.0B880000.00000004.mdmp "S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\TestApp" in Source: 00000000-00003428.00000001.89674.0B880000.00000004.mdmp "S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\483f7b2a" in Source: 00000000-00003428.00000001.89674.0B880000.00000004.mdmp "!This program cannoHKEY_USERS\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\TestApp" in Source: 00000000-00003428.00000001.89674.0B880000.00000004.mdmp "HKEY_USERS\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\483f7b2a" in Source: 00000000-00003428.00000001.89674.0B880000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00003668.00000000.86679.000C0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00003668.00000000.86679.000C0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00003668.00000001.87614.000C0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00003668.00000001.87614.000C0000.00000004.mdmp "EGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00003668.00000001.87614.000C0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00003668.00000001.87614.000C0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00003668.00000001.87614.000C0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00003668.00000001.87614.02A80000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00003668.00000001.87614.02A80000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00003668.00000001.87614.02A80000.00000004.mdmp "SOFTWARE\BroomCleaner" in Source: 00000000-00003756.00000002.91077.00260000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00003756.00000002.91077.00408000.00000002.mdmp "EGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00003992.00000001.89667.00200000.00000004.mdmp "oftware\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify" in Source: 00000000-00003992.00000001.89667.00200000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography" in Source: 00000000-00003992.00000001.89667.71BA1000.00000020.mdmp "Software\Microsoft\OneDrive" in Source: 00000000-00003992.00000001.89667.71BA1000.00000020.mdmp "Software\Microsoft\Windows Live\Common" in Source: 00000000-00003992.00000001.89667.71BA1000.00000020.mdmp "Software\Microsoft\Windows Live\Common\Activations\%d" in Source: 00000000-00003992.00000001.89667.71BA1000.00000020.mdmp "Software\Policies\Microsoft\SQMClient" in Source: 00000000-00003992.00000001.89667.71BA1000.00000020.mdmp "Software\Microsoft\SQMClient" in Source: 00000000-00003992.00000001.89667.71BA1000.00000020.mdmp "Software\Microsoft\SQMClient\%s\AdaptiveSqm\ManifestInfo" in Source: 00000000-00003992.00000001.89667.71BA1000.00000020.mdmp "Software\Microsoft\SQMClient\%s\AdaptiveSqm\Throttling" in Source: 00000000-00003992.00000001.89667.71BA1000.00000020.mdmp "SOFTWARE\Microsoft\Reliability Analysis\RAC" in Source: 00000000-00003992.00000001.89667.71BA1000.00000020.mdmp "Software\Microsoft\SQMClient\Windows" in Source: 00000000-00003992.00000001.89667.71BA1000.00000020.mdmp "Software\Policies\Microsoft\SQMClient\Windows" in Source: 00000000-00003992.00000001.89667.71BA1000.00000020.mdmp "Software\Microsoft\SQMClient\UploadUrlMap" in Source: 00000000-00003992.00000001.89667.71BA1000.00000020.mdmp "EGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00003992.00000002.91592.00200000.00000004.mdmp "oftware\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify" in Source: 00000000-00003992.00000002.91592.00200000.00000004.mdmp "Software\Microsoft\OneDrive" in Source: 00000000-00003992.00000002.91592.71B51000.00000020.mdmp "Software\Microsoft\Windows Live\Common" in Source: 00000000-00003992.00000002.91592.71B51000.00000020.mdmp "Software\Microsoft\Windows Live\Environment\Sync" in Source: 00000000-00003992.00000002.91592.71B51000.00000020.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify" in Source: 00000000-00003992.00000002.91592.71B51000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\EnableAutoTray" in Source: 00000000-00003992.00000002.91592.71B51000.00000020.mdmp55:T4a56,"f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 688b0000 "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 71c60000 "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" loaded module "KERNEL32" at base 75cc0000 "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" loaded module "ADVAPI32.DLL" at base 760a0000 "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 6be20000 "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" loaded module "SHLWAPI.DLL" at base 75f40000 "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" loaded module "VERSION.DLL" at base 74a70000 "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 64e30000 "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" loaded module "USER32.DLL" at base 75910000 "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" loaded module "MSCOREE.DLL" at base 6beb0000 "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" loaded module "PSAPI.DLL" at base 76090000 "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" loaded module "RPCRT4.DLL" at base 75fe0000 "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" loaded module "KERNEL32.DLL" at base 75cc0000 "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 63a20000 "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" loaded module "OLE32.DLL" at base 75a10000 "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" loaded module "CRYPTBASE.DLL" at base 754d0000 "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 6ee20000 "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 68ff0000 "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 62fc0000 "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 627a0000 "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 743f0000 "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" loaded module "SHELL32.DLL" at base 76930000 "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" loaded module "PROPSYS.DLL" at base 74140000 "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" loaded module "COMCTL32.DLL" at base 744d0000 "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" loaded module "OLEAUT32.DLL" at base 76440000 "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" loaded module "CLBCATQ.DLL" at base 768a0000 "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 74140000 "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" loaded module "NTMARTA.DLL" at base 74a40000 "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 759e0000 "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" loaded module "PROFAPI.DLL" at base 755e0000 "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" loaded module "APPHELP.DLL" at base 75480000 "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" loaded module "%WINDIR%\SYSTEM32\SHDOCVW.DLL" at base 713f0000 "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 76930000 "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 75cc0000 "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" loaded module "SETUPAPI.DLL" at base 75da0000 "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base 75710000 "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 77580000 "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" loaded module "SECUR32.DLL" at base 75300000 "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 75600000 "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L2-1-0.DLL" at base 6fa20000 "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75480000 "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\DIASYMREADER.DLL" at base 6a650000 "InstallSetup5.exe" loaded module "%WINDIR%\SYSTEM32\SETUPAPI.DLL" at base 75da0000 "InstallSetup5.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75480000 "InstallSetup5.exe" loaded module "ADVAPI32.DLL" at base 760a0000 "InstallSetup5.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 74140000 "InstallSetup5.exe" loaded module "%WINDIR%\SYSTEM32\DWMAPI.DLL" at base 73ca0000 "InstallSetup5.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTBASE.DLL" at base 754d0000 "InstallSetup5.exe" loaded module "%WINDIR%\SYSTEM32\OLEACC.DLL" at base 6bf30000 "InstallSetup5.exe" loaded module "%WINDIR%\SYSTEM32\CLBCATQ.DLL" at base 768a0000 "InstallSetup5.exe" loaded module "%WINDIR%\SYSTEM32\NTMARTA.DLL" at base 74a40000 "InstallSetup5.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 74a70000 "InstallSetup5.exe" loaded module "%WINDIR%\SYSTEM32\SHFOLDER.DLL" at base 6e580000 "InstallSetup5.exe" loaded module "CRYPTBASE.DLL" at base 754d0000 "InstallSetup5.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 743f0000 "InstallSetup5.exe" loaded module "OLE32.DLL" at base 75a10000 "InstallSetup5.exe" loaded module "KERNEL32.DLL" at base 75cc0000 "InstallSetup5.exe" loaded module "COMCTL32.DLL" at base 744d0000 "InstallSetup5.exe" loaded module "OLEAUT32.DLL" at base 76440000 "InstallSetup5.exe" loaded module "SETUPAPI.DLL" at base 75da0000 "InstallSetup5.exe" loaded module "RPCRT4.DLL" at base 75fe0000 "InstallSetup5.exe" loaded module "CLBCATQ.DLL" at base 768a0000 "InstallSetup5.exe" loaded module "NTMARTA.DLL" at base 74a40000 "InstallSetup5.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 759e0000 "InstallSetup5.exe" loaded module "PROFAPI.DLL" at base 755e0000 "toolspub2.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 688b0000 "toolspub2.exe" loaded module "MSIMG32.DLL" at base 6ee10000 "toolspub2.exe" loaded module "KERNEL32.DLL" at base 75cc0000 "toolspub2.exe" loaded module "USER32" at base 75910000 "toolspub2.exe" loaded module "KERNEL32" at base 75cc0000 "toolspub2.exe" loaded module "NTDLL.DLL" at base 776d0000 "toolspub2.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 743f0000 "toolspub2.exe" loaded module "DWMAPI.DLL" at base 73ca0000 "toolspub2.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75480000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "MSIMG32.DLL" at base 725e0000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "KERNEL32.DLL" at base 75cc0000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "MSVCR100.DLL" at base 6a590000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "ADVAPI32.DLL" at base 760a0000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "NTDLL.DLL" at base 776d0000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "WINMM.DLL" at base 6f9e0000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "WS2_32.DLL" at base 77870000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "CRYPTBASE.DLL" at base 754d0000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 75cc0000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "POWRPROF.DLL" at base 74390000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "WTSAPI32.DLL" at base 73b30000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "WINSTA.DLL" at base 75540000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 759e0000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "RPCRT4.DLL" at base 75fe0000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "OLE32.DLL" at base 75a10000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "CLBCATQ.DLL" at base 768a0000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "CRYPTSP.DLL" at base 74fe0000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74d70000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "RPCRTREMOTE.DLL" at base 75570000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 743f0000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMDISP.DLL" at base 72560000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 760a0000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 6d480000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "%WINDIR%\SYSTEM32\OLEAUT32.DLL" at base 76440000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "SXS.DLL" at base 754e0000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "OLEAUT32.DLL" at base 76440000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 6cee0000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 6cf00000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 6d530000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMDISP.DLL" at base 724c0000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMDISP.DLL" at base 6ee70000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMDISP.DLL" at base 6a550000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "NETAPI32.DLL" at base 73d10000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "SAMLIB.DLL" at base 74120000 "kos4.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 688b0000 "kos4.exe" loaded module "SHLWAPI.DLL" at base 75f40000 "kos4.exe" loaded module "VERSION.DLL" at base 74a70000 "kos4.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 71c60000 "kos4.exe" loaded module "KERNEL32" at base 75cc0000 "kos4.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 64e30000 "kos4.exe" loaded module "USER32.DLL" at base 75910000 "kos4.exe" loaded module "MSCOREE.DLL" at base 6beb0000 "kos4.exe" loaded module "PSAPI.DLL" at base 76090000 "kos4.exe" loaded module "RPCRT4.DLL" at base 75fe0000 "kos4.exe" loaded module "KERNEL32.DLL" at base 75cc0000 "kos4.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 63a20000 "kos4.exe" loaded module "OLE32.DLL" at base 75a10000 "kos4.exe" loaded module "CRYPTBASE.DLL" at base 754d0000 "kos4.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 6ee20000 "kos4.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 68ff0000 "kos4.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 62fc0000 "kos4.exe" loaded module "ADVAPI32.DLL" at base 760a0000 "kos4.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 725a0000 "kos4.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 627a0000 "kos4.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 68b80000 "kos4.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 61d00000 "kos4.exe" loaded module "NTDLL.DLL" at base 776d0000 "kos4.exe" loaded module "SHELL32.DLL" at base 76930000 "kos4.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 759e0000 "kos4.exe" loaded module "PROFAPI.DLL" at base 755e0000 "kos4.exe" loaded module "BCRYPT.DLL" at base 750f0000 "kos4.exe" loaded module "CRYPTSP.DLL" at base 74fe0000 "kos4.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74d70000 "kos4.exe" loaded module "RASAPI32.DLL" at base 6c150000 "kos4.exe" loaded module "RTUTILS.DLL" at base 73730000 "kos4.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL" at base 759e0000 "kos4.exe" loaded module "API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL" at base 759e0000 "kos4.exe" loaded module "WS2_32.DLL" at base 77870000 "kos4.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74fa0000 "kos4.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 74b00000 "kos4.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 74f90000 "kos4.exe" loaded module "RASMAN.DLL" at base 6c130000 "kos4.exe" loaded module "WINHTTP.DLL" at base 71800000 "kos4.exe" loaded module "SSPICLI.DLL" at base 75460000 "kos4.exe" loaded module "CREDSSP.DLL" at base 74ca0000 "kos4.exe" loaded module "IPHLPAPI.DLL" at base 722c0000 "kos4.exe" loaded module "DHCPCSVC6.DLL" at base 715e0000 "kos4.exe" loaded module "DHCPCSVC.DLL" at base 71560000 "kos4.exe" loaded module "NSI.DLL" at base 75fa0000 "kos4.exe" loaded module "CFGMGR32.DLL" at base 756e0000 "kos4.exe" loaded module "OLEAUT32.DLL" at base 76440000 "kos4.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL" at base 759e0000 "kos4.exe" loaded module "DNSAPI.DLL" at base 74e60000 "kos4.exe" loaded module "RASADHLP.DLL" at base 6cd70000 "kos4.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 71600000 "kos4.exe" loaded module "SECUR32.DLL" at base 75300000 "kos4.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 74de0000 "kos4.exe" loaded module "NCRYPT.DLL" at base 75110000 "kos4.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 74cb0000 "kos4.exe" loaded module "CRYPT32.DLL" at base 75770000 "kos4.exe" loaded module "USERENV.DLL" at base 756c0000 "kos4.exe" loaded module "GPAPI.DLL" at base 74bb0000 "toolspub2.exe" loaded module "SHELL32" at base 76930000 "Broom.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 743f0000 "Broom.exe" loaded module "CRYPTBASE.DLL" at base 754d0000 "Broom.exe" loaded module "DWMAPI.DLL" at base 73ca0000 "Broom.exe" loaded module "WTSAPI32.DLL" at base 73b30000 "Broom.exe" loaded module "USER32.DLL" at base 75910000 "Broom.exe" loaded module "WINSTA.DLL" at base 75540000 "Broom.exe" loaded module "ADVAPI32.DLL" at base 760a0000 "Broom.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 759e0000 "Broom.exe" loaded module "RPCRT4.DLL" at base 75fe0000 "Broom.exe" loaded module "UXTHEME.DLL" at base 743f0000 "Broom.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 75cc0000 "Broom.exe" loaded module "COMCTL32.DLL" at base 744d0000 "Broom.exe" loaded module "COLORUI.DLL" at base 6a4f0000 "Broom.exe" loaded module "SHELL32.DLL" at base 76930000 "Broom.exe" loaded module "COMDLG32.DLL" at base 75b70000 "Broom.exe" loaded module "COMPSTUI.DLL" at base 72540000 "Broom.exe" loaded module "INETRES.DLL" at base 72570000 "Broom.exe" loaded module "GDIPLUS.DLL" at base 73f60000 "Broom.exe" loaded module "KERNEL32.DLL" at base 75cc0000 "Broom.exe" loaded module "%WINDIR%\WINSXS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.7601.23894_NONE_5C0BE957A009922E\GDIPLUS.DLL" at base 73f60000 "Broom.exe" loaded module "MSIMG32.DLL" at base 725e0000 "Broom.exe" loaded module "OLE32.DLL" at base 75a10000 "Broom.exe" loaded module "OLEAUT32.DLL" at base 76440000 "Broom.exe" loaded module "CLBCATQ.DLL" at base 768a0000 "Broom.exe" loaded module "SETUPAPI.DLL" at base 75da0000 "Broom.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 74140000 "Broom.exe" loaded module "NTMARTA.DLL" at base 74a40000 "Broom.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 759e0000 "Broom.exe" loaded module "PROFAPI.DLL" at base 755e0000 "Broom.exe" loaded module "WINDOWSCODECS.DLL" at base 73970000 "Broom.exe" loaded module "APPHELP.DLL" at base 75480000 "Broom.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base 75710000 "Broom.exe" loaded module "%LOCALAPPDATA%\MICROSOFT\ONEDRIVE\17.3.4604.0120\FILESYNCSHELL.DLL" at base 71b50000 "Broom.exe" loaded module "%WINDIR%\SYSTEM32\EHSTORSHELL.DLL" at base 71c20000 "Broom.exe" loaded module "%PROGRAMFILES%\MICROS~3\OFFICE14\GROOVEEX.DLL" at base 70fe0000 "Broom.exe" loaded module "%PROGRAMFILES%\COMMON~1\MICROS~1\OFFICE14\CULTURES\OFFICE.ODF" at base 70bc0000 "Broom.exe" loaded module "%PROGRAMFILES%\MICROS~3\OFFICE14\1033\GROOVEINTLRESOURCE.DLL" at base 70350000 "Broom.exe" loaded module "UXTHEME" at base 743f0000 "Broom.exe" loaded module "USER32" at base 75910000 "Broom.exe" loaded module "%WINDIR%\SYSTEM32\SHDOCVW.DLL" at base 713f0000 "Broom.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 76930000 "Broom.exe" loaded module "PROPSYS.DLL" at base 74140000 "Broom.exe" loaded module "GDI32.DLL" at base 77820000 "Broom.exe" loaded module "IMM32.DLL" at base 77900000 "Broom.exe" loaded module "COMCTL32" at base 744d0000 "Broom.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 75a10000 "Broom.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 75bf0000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "MSVCR100.DLL" at base 6a5a0000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMDISP.DLL" at base 6a560000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMDISP.DLL" at base 6a52000056:Tdfe,"f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}") "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INPROCSERVER32") "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" touched "Shell File System Folder" (Path: "HKCU\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" touched "NDP SymBinder" (Path: "HKCU\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\INPROCSERVER32") "31839b57a4f11171d6abc8bbc4451ee4.exe" touched "WBEM Scripting Locator" (Path: "HKCU\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}") "31839b57a4f11171d6abc8bbc4451ee4.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}") "31839b57a4f11171d6abc8bbc4451ee4.exe" touched "PSDispatch" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{00020420-0000-0000-C000-000000000046}") "31839b57a4f11171d6abc8bbc4451ee4.exe" touched "WbemDefaultPathParser" (Path: "HKCU\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\TREATAS") "31839b57a4f11171d6abc8bbc4451ee4.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "31839b57a4f11171d6abc8bbc4451ee4.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "31839b57a4f11171d6abc8bbc4451ee4.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "31839b57a4f11171d6abc8bbc4451ee4.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "31839b57a4f11171d6abc8bbc4451ee4.exe" touched "PSEnumVariant" (Path: "HKCU\CLSID\{00020421-0000-0000-C000-000000000046}\TREATAS") "Broom.exe" touched "Enhanced Storage Icon Overlay Handler Class" (Path: "HKCU\CLSID\{D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D}\INPROCSERVER32") "Broom.exe" touched "Groove Explorer Icon Overlay 1 (GFS Unread Stub)" (Path: "HKCU\CLSID\{99FD978C-D287-4F50-827F-B2C658EDA8E7}\INPROCSERVER32") "Broom.exe" touched "Groove Explorer Icon Overlay 2 (GFS Stub)" (Path: "HKCU\CLSID\{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC}\INPROCSERVER32") "Broom.exe" touched "Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)" (Path: "HKCU\CLSID\{920E6DB1-9907-4370-B3A0-BAFC03D81399}\INPROCSERVER32") "Broom.exe" touched "Groove Explorer Icon Overlay 3 (GFS Folder)" (Path: "HKCU\CLSID\{16F3DD56-1AF5-4347-846D-7C10C4192619}\INPROCSERVER32") "Broom.exe" touched "Groove Explorer Icon Overlay 4 (GFS Unread Mark)" (Path: "HKCU\CLSID\{2916C86E-86A6-43FE-8112-43ABE6BF8DCC}\INPROCSERVER32")57:T1130,"f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "Broom.exe" file has an entrypoint instructions - "push ebp,mov ebp, esp,add esp, -0x10,push ebx,mov eax, 0x7e608c,call 0x411608,mov ebx, dword ptr [0x801a80],mov eax, dword ptr [ebx],call 0x652328,mov cl, 1,mov edx, 0x7f31e8,mov eax, dword ptr [0x5db028],call 0x5f6190,mov ecx, dword ptr [0x80185c],mov eax, dword ptr [ebx],mov edx, dword ptr [0x783118],call 0x652340,mov ecx, dword ptr [0x801ce0],mov eax, dword ptr [ebx],mov edx, dword ptr [0x780dfc],call 0x652340,mov ecx, dword ptr [0x801590],mov eax, dword ptr [ebx],mov edx, dword ptr [0x781524]," "31839b57a4f11171d6abc8bbc4451ee4.exe" file has an entrypoint instructions - "call 0x40ce5d,jmp 0x407d4b,push dword ptr [0x815ecc],call dword ptr [0x401140],test eax, eax,je 0x407ed4,call eax,push 0x19,call 0x40c761,push 1,push 0,call 0x409f39,add esp, 0xc,jmp 0x409f06,int3 ,int3 ,int3 ,int3 ,mov ecx, dword ptr [esp + 4],test ecx, 3,je 0x407f20,mov al, byte ptr [ecx],add ecx, 1,test al, al,je 0x407f53,test ecx, 3,jne 0x407efc,add eax, 0,lea esp, [esp]," "InstallSetup5.exe" file has an entrypoint instructions - "sub esp, 0x3f8,push ebp,push esi,push edi,push 0x20,pop edi,xor ebp, ebp,push 0x8001,mov dword ptr [esp + 0x20], ebp,mov dword ptr [esp + 0x18], 0x40a2d8,mov dword ptr [esp + 0x14], ebp,call dword ptr [0x4080a4],mov esi, dword ptr [0x4080a8],lea eax, [esp + 0x34],push eax,mov dword ptr [esp + 0x4c], ebp,mov dword ptr [esp + 0x14c], ebp,mov dword ptr [esp + 0x150], ebp,mov dword ptr [esp + 0x38], 0x11c,call esi,test eax, eax,jne 0x4035be,lea eax, [esp + 0x34],mov dword ptr [esp + 0x34], 0x114,push eax,call esi," "toolspub2.exe" file has an entrypoint instructions - "call 0x40ce4d,jmp 0x407d3b,push dword ptr [0x430ecc],call dword ptr [0x401140],test eax, eax,je 0x407ec4,call eax,push 0x19,call 0x40c751,push 1,push 0,call 0x409f29,add esp, 0xc,jmp 0x409ef6,int3 ,int3 ,int3 ,int3 ,mov ecx, dword ptr [esp + 4],test ecx, 3,je 0x407f10,mov al, byte ptr [ecx],add ecx, 1,test al, al,je 0x407f43,test ecx, 3,jne 0x407eec,add eax, 0,lea esp, [esp]," "kos4.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"58:T922,"f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "InstallSetup5.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "InstallSetup5.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "kos4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "kos4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "kos4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "Broom.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "Broom.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "Broom.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "Broom.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "AR") "Broom.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "AR") "Broom.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "AR-SA") "Broom.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "AR-SA") "Broom.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "BG")59:Td47,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00003668-00000C2B-358768978] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00003668-00000C2B-359120006] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00003668-00000C2B-360439087] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00003668-00000C2B-360583073] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00003668-00000C2B-360834283] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00003668-00000C2B-360905696] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00003668-00000C2B-361116698] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00003668-00000C2B-361429272] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00003668-00000C2B-361505406] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00003668-00000C2B-361947241] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00003668-00000C2B-362015088] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll" [Source: 00000000-00003668-00000C2B-362083184] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00003668-00000C2B-362186561] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00003668-00000C2B-362619572] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" [Source: 00000000-00003668-00000C2B-370574946] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll" [Source: 00000000-00003668-00000C2B-375432657] Observed system executable string:"%WINDIR%\system32\SETUPAPI.dll" [Source: 00000000-00003756-00000C2B-367461120] Observed system executable string:"%WINDIR%\system32\APPHELP.dll" [Source: 00000000-00003756-00000C2B-367812557] Observed system executable string:"%WINDIR%\system32\PROPSYS.dll" [Source: 00000000-00003756-00000C2B-368543862] Observed system executable string:"%WINDIR%\system32\DWMAPI.dll" [Source: 00000000-00003756-00000C2B-368854884] Observed system executable string:"%WINDIR%\system32\CRYPTBASE.dll" [Source: 00000000-00003756-00000C2B-369240191] Observed system executable string:"%WINDIR%\system32\OLEACC.dll" [Source: 00000000-00003756-00000C2B-369684708] Observed system executable string:"%WINDIR%\system32\CLBCATQ.dll" [Source: 00000000-00003756-00000C2B-369792818] Observed system executable string:"%WINDIR%\system32\NTMARTA.dll" [Source: 00000000-00003756-00000C2B-369900983] Observed system executable string:"%WINDIR%\system32\VERSION.dll" [Source: 00000000-00003756-00000C2B-370002269]5a:T65a,Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00003428.00000000.89476.0B880000.00000004.mdmp, 00000000-00003428.00000001.89674.0B880000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00003756.00000002.91077.00408000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00003992.00000001.89667.71AAA000.00000004.mdmp, 00000000-00003992.00000001.89667.71C09000.00000002.mdmp, 00000000-00003992.00000002.91592.71B68000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00003992.00000001.89667.71AAA000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00003992.00000001.89667.71AAA000.00000004.mdmp, 00000000-00003992.00000001.89667.71C09000.00000002.mdmp, 00000000-00003992.00000002.91592.71B68000.00000002.mdmp")5b:Tf93,"f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER"; Key: ""; Value: "") "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER"; Key: ""; Value: "") "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}"; Key: ""; Value: "") "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}"; Key: ""; Value: "") "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\PROGID"; Key: ""; Value: "") "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\PROGID"; Key: ""; Value: "") "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USERSFILES\NAMESPACE"; Key: ""; Value: "") "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USERSFILES\NAMESPACE\DELEGATEFOLDERS"; Key: ""; Value: "") "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USERSFILES\NAMESPACE"; Key: ""; Value: "") "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USERSFILES\NAMESPACE\DELEGATEFOLDERS\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}"; Key: ""; Value: "") "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USERSFILES\NAMESPACE\DELEGATEFOLDERS"; Key: ""; Value: "") "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SESSIONINFO\1"; Key: ""; Value: "") "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SESSIONINFO\1\USERSFILES\NAMESPACE"; Key: ""; Value: "") "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SESSIONINFO\1\USERSFILES\NAMESPACE\DELEGATEFOLDERS"; Key: ""; Value: "") "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INPROCSERVER32"; Key: ""; Value: "") "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INPROCSERVER32"; Key: ""; Value: "") "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE"; Key: ""; Value: "") "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE"; Key: ""; Value: "") "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32"; Key: ""; Value: "") "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32"; Key: ""; Value: "")5c:T11b9,"f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER"; Key: "MAXIMIZEAPPS"; Value: "") "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER"; Key: "MAXIMIZEAPPS"; Value: "") "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USERSFILES\NAMESPACE\DELEGATEFOLDERS"; Key: "SUPPRESSIONPOLICY"; Value: "") "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USERSFILES\NAMESPACE\DELEGATEFOLDERS"; Key: ""; Value: "") "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USERSFILES\NAMESPACE\DELEGATEFOLDERS\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}"; Key: "SUPPRESSIONPOLICY"; Value: "") "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INPROCSERVER32"; Key: ""; Value: "") "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INPROCSERVER32"; Key: "LOADWITHOUTCOM"; Value: "") "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE"; Key: "CLSID"; Value: "") "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32"; Key: ""; Value: "") "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32"; Key: "LOADWITHOUTCOM"; Value: "") "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE\INITPROPERTYBAG"; Key: "ATTRIBUTES"; Value: "") "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE\INITPROPERTYBAG"; Key: "DESCRIPTIONID"; Value: "") "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE\INITPROPERTYBAG"; Key: "HELPTOPIC"; Value: "") "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE\INITPROPERTYBAG"; Key: "RECURSIVESEARCH"; Value: "") "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE\INITPROPERTYBAG"; Key: "TARGETKNOWNFOLDER"; Value: "") "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\.EXE"; Key: ""; Value: "") "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\EXEFILE"; Key: "ISSHORTCUT"; Value: "") "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\EXEFILE"; Key: "NOSTATICDEFAULTVERB"; Value: "") "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\EXEFILE\SHELL"; Key: ""; Value: "") "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\EXEFILE\SHELL\OPEN"; Key: "NEVERDEFAULT"; Value: "") "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\EXEFILE\SHELL\OPEN\COMMAND"; Key: "DELEGATEEXECUTE"; Value: "") "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\.ADE"; Key: ""; Value: "")5d:T77a,"f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\config\machine.config" "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll.aux" "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.core\31fae3290fad30c31c98651462d22724\system.core.ni.dll.aux" "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\0b2f69b43a576b9edcc807a30872bd91\system.ni.dll.aux" "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\2c3c912ea8f058f9d04c4650128feb3f\system.ni.dll.aux" "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" reads file "c:\users\%osuser%\appdata\local\temp\installsetup5.exe" "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" reads file "c:\users\%osuser%\appdata\local\temp\toolspub2.exe" "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" reads file "c:\users\%osuser%\appdata\local\temp\31839b57a4f11171d6abc8bbc4451ee4.exe" "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" reads file "c:\users\%osuser%\appdata\local\temp\kos4.exe" "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" reads file "c:\windows\microsoft.net\assembly\gac_msil\system\v4.0_4.0.0.0__b77a5c561934e089\system.dll" "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" reads file "c:\f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" "InstallSetup5.exe" reads file "c:\users\%osuser%\appdata\local\temp\installsetup5.exe"5e:T542,The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string) Matched sigs: Reference to an external IP address lookup service identified Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string) Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string) Matched sigs: Contains a Wine emulator-related string Matched sigs: Able to identify virtual environment by using API string Matched sigs: Able to identify virtual/sandbox environment Matched sigs: Able to identify virtual/sandbox environment devices Matched sigs: Able to identify sandbox environment running process Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques Matched sigs: Observed a high volume of repeated registry API calls (API Hammering) Matched sigs: Triggers a burst of requests to the same API (API Hammering) Matched sigs: Attempts to identify external IP address Matched sigs: Contains ability to detect sandbox (imports API) Matched sigs: Contains ability to delay the execution of current thread Matched sigs: Contains ability to detect virtual environment (API)5f:Tcfc,"f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" trying to touch file "C:\Windows\SYSTEM32\MSCOREE.DLL" "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" trying to touch file "C:\FLTLIB.DLL" "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" trying to touch file "C:\Windows\system32\FLTLIB.DLL" "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" trying to touch file "C:\MSVCP140.dll" "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" trying to touch file "C:\Windows\system32\MSVCP140.dll" "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" trying to touch file "C:\VCRUNTIME140.dll" "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" trying to touch file "C:\Windows\system32\VCRUNTIME140.dll" "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" trying to touch file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" trying to touch file "C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll" "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" trying to touch file "C:\ucrtbase.DLL" "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" trying to touch file "C:\Windows\system32\ucrtbase.DLL" "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" trying to touch file "C:\api-ms-win-core-timezone-l1-1-0.dll" "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-timezone-l1-1-0.dll" "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" trying to touch file "C:\api-ms-win-core-file-l2-1-0.dll" "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-file-l2-1-0.dll" "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" trying to touch file "C:\api-ms-win-core-localization-l1-2-0.dll" "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-localization-l1-2-0.dll" "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" trying to touch file "C:\api-ms-win-core-synch-l1-2-0.dll" "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-synch-l1-2-0.dll" "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" trying to touch file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-processthreads-l1-1-1.dll" "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" trying to touch file "C:\api-ms-win-core-file-l1-2-0.dll" "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-file-l1-2-0.dll"60:Tcf7,"f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" trying to access non-existent file "C:\FLTLIB.DLL" "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" trying to access non-existent file "C:\MSVCP140.dll" "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" trying to access non-existent file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" trying to access non-existent file "C:\ucrtbase.DLL" "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" trying to access non-existent file "C:\api-ms-win-core-timezone-l1-1-0.dll" "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" trying to access non-existent file "C:\api-ms-win-core-file-l2-1-0.dll" "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" trying to access non-existent file "C:\api-ms-win-core-localization-l1-2-0.dll" "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" trying to access non-existent file "C:\api-ms-win-core-synch-l1-2-0.dll" "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" trying to access non-existent file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" trying to access non-existent file "C:\api-ms-win-core-file-l1-2-0.dll" "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" trying to access non-existent file "C:\api-ms-win-crt-heap-l1-1-0.dll" "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" trying to access non-existent file "C:\api-ms-win-crt-string-l1-1-0.dll" "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" trying to access non-existent file "C:\api-ms-win-crt-stdio-l1-1-0.dll" "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" trying to access non-existent file "C:\api-ms-win-crt-convert-l1-1-0.dll" "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" trying to access non-existent file "C:\api-ms-win-crt-locale-l1-1-0.dll" "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" trying to access non-existent file "C:\api-ms-win-crt-filesystem-l1-1-0.dll" "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" trying to access non-existent file "C:\api-ms-win-crt-time-l1-1-0.dll" "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" trying to access non-existent file "C:\api-ms-win-crt-environment-l1-1-0.dll" "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" trying to access non-existent file "C:\api-ms-win-crt-math-l1-1-0.dll" "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" trying to access non-existent file "C:\api-ms-win-crt-utility-l1-1-0.dll" "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL"61:Tc39,"f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" trying to access non-existent file "C:\Windows\SYSTEM32\MSCOREE.DLL.local" "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" trying to access non-existent file "C:\f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe.config" "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\latestrock\" "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" trying to access non-existent file "C:\f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.INI" "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" trying to access non-existent file "C:\f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe.Local\" "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\InstallSetup5.exe:Zone.Identifier" "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\toolspub2.exe:Zone.Identifier" "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe:Zone.Identifier" "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\kos4.exe:Zone.Identifier" "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\latestX.exe:Zone.Identifier" "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" trying to access non-existent file "C:\f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.PDB" "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" trying to access non-existent file "C:\F24D47BD9CC9DAA71C869A1D06551801395BA2BBBFF0C33A102E79D32C0A630D.EXE.CONFIG" "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC" "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\LATESTROCK" "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" trying to access non-existent file "C:\F24D47BD9CC9DAA71C869A1D06551801395BA2BBBFF0C33A102E79D32C0A630D.INI" "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME"62:T1175,Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00000416-00000C2C-378974457") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00001368-00000C2C-381133001") Found reference to API "WinHttpOpenW" (Indicator: "WinHttpOpen"; Source: "00000000-00001368-00000C2C-381133079") Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00001368-00000C2C-397815832") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00000416.00000001.89158.0B480000.00000004.mdmp") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00003428.00000000.89476.0B880000.00000004.mdmp, 00000000-00003428.00000001.89674.0B880000.00000004.mdmp") Found reference to API "s_session.m_hHandle = ::WinHttpOpen( strwUserAgent, WINHTTP_ACCESS_TYPE_NO_PROXY, WINHTTP_NO_PROXY_NAME, WINHTTP_NO_PROXY_BYPASS, WINHTTP_FLAG_ASYNC)" (Indicator: "WinHttpOpen"; Source: "00000000-00003992.00000001.89667.71BA1000.00000020.mdmp") Found reference to API "hConnection = ::WinHttpConnect( m_hHandle, pszServer, nPort, NULL)" (Indicator: "WinHttpConnect"; Source: "00000000-00003992.00000001.89667.71BA1000.00000020.mdmp") Found reference to API "CWinHttpConnection::AutoDetectProxies" (Indicator: "WinHttpConnect"; Source: "00000000-00003992.00000001.89667.71BA1000.00000020.mdmp") Found reference to API "hHttpSession = ::WinHttpOpen( strwUserAgent, WINHTTP_ACCESS_TYPE_NO_PROXY, WINHTTP_NO_PROXY_NAME, WINHTTP_NO_PROXY_BYPASS, WINHTTP_FLAG_ASYNC)" (Indicator: "WinHttpOpen"; Source: "00000000-00003992.00000001.89667.71BA1000.00000020.mdmp") Found reference to API "CWinHttpConnection::DetectProxies" (Indicator: "WinHttpConnect"; Source: "00000000-00003992.00000001.89667.71BA1000.00000020.mdmp") Found reference to API "CWinHttpConnection::Reset" (Indicator: "WinHttpConnect"; Source: "00000000-00003992.00000001.89667.71BA1000.00000020.mdmp") Found reference to API "CWinHttpConnection::AsyncDetectProxies" (Indicator: "WinHttpConnect"; Source: "00000000-00003992.00000001.89667.71BA1000.00000020.mdmp") Found reference to API "CWinHttpConnection::DetectProxies(m_ServerName, &m_proxyInfo)" (Indicator: "WinHttpConnect"; Source: "00000000-00003992.00000001.89667.71BA1000.00000020.mdmp") Found reference to API "CWinHttpConnection::AsyncDetectProxiesCallback" (Indicator: "WinHttpConnect"; Source: "00000000-00003992.00000001.89667.71BA1000.00000020.mdmp") Found reference to API "CWinHttpConnection::DoProxyFailover" (Indicator: "WinHttpConnect"; Source: "00000000-00003992.00000001.89667.71BA1000.00000020.mdmp") Found reference to API "CWinHttpConnection::SendRequest" (Indicator: "WinHttpConnect"; Source: "00000000-00003992.00000001.89667.71BA1000.00000020.mdmp") Found reference to API "CWinHttpConnection::CreateRequest" (Indicator: "WinHttpConnect"; Source: "00000000-00003992.00000001.89667.71BA1000.00000020.mdmp") Found reference to API "::WinHttpSendRequest(m_hHandle, 0, 0, 0, 0, m_cbTotalBodyLength, (DWORD_PTR)this)" (Indicator: "HttpSendRequest"; Source: "00000000-00003992.00000001.89667.71BA1000.00000020.mdmp") Found reference to API "::WinHttpSendRequest(m_hHandle, 0, 0, 0, 0, m_cbTotalBodyLength, (DWORD_PTR)this)" (Indicator: "WinHttpSendRequest"; Source: "00000000-00003992.00000001.89667.71BA1000.00000020.mdmp") Found reference to API "WinHttpQueryHeaders( m_hHandle, 22, 0, (LPVOID)lpOutBuffer, &dwSize, 0)" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00003992.00000001.89667.71BA1000.00000020.mdmp") Found reference to API "::WinHttpQueryHeaders( m_hHandle, 19 | 0x20000000, 0, &m_httpStatus, &cbStatusCode, 0)" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00003992.00000001.89667.71BA1000.00000020.mdmp") Found reference to API "::WinHttpReadData(m_hHandle, (LPVOID)pNextBuffer, cbBytesAvailable, nullptr)" (Indicator: "WinHttpReadData"; Source: "00000000-00003992.00000001.89667.71BA1000.00000020.mdmp") Found reference to API "ReferenceCountedPtr::Attach" (Indicator: "WinHttpConnect"; Source: "00000000-00003992.00000001.89667.71BA1000.00000020.mdmp") Found reference to API "ReferenceCountedPtr::CopyTo" (Indicator: "WinHttpConnect"; Source: "00000000-00003992.00000001.89667.71BA1000.00000020.mdmp") Found reference to API ".?AVCWinHttpConnection@@" (Indicator: "WinHttpConnect"; Source: "00000000-00003992.00000001.89667.71C04000.00000004.mdmp")63:T12bd,Found reference to API "s_session.m_hHandle = ::WinHttpOpen( strwUserAgent, WINHTTP_ACCESS_TYPE_NO_PROXY, WINHTTP_NO_PROXY_NAME, WINHTTP_NO_PROXY_BYPASS, WINHTTP_FLAG_ASYNC)" (Indicator: "WinHttpOpen"; Source: "00000000-00003992.00000001.89667.71BA1000.00000020.mdmp") Found reference to API "WinHttpCrackUrl(pszUri, 0, 0, &urlComps)" (Indicator: "WinHttpCrackUrl"; Source: "00000000-00003992.00000001.89667.71BA1000.00000020.mdmp") Found reference to API "hConnection = ::WinHttpConnect( m_hHandle, pszServer, nPort, NULL)" (Indicator: "WinHttpConnect"; Source: "00000000-00003992.00000001.89667.71BA1000.00000020.mdmp") Found reference to API "CWinHttpConnection::AutoDetectProxies" (Indicator: "WinHttpConnect"; Source: "00000000-00003992.00000001.89667.71BA1000.00000020.mdmp") Found reference to API "hHttpSession = ::WinHttpOpen( strwUserAgent, WINHTTP_ACCESS_TYPE_NO_PROXY, WINHTTP_NO_PROXY_NAME, WINHTTP_NO_PROXY_BYPASS, WINHTTP_FLAG_ASYNC)" (Indicator: "WinHttpOpen"; Source: "00000000-00003992.00000001.89667.71BA1000.00000020.mdmp") Found reference to API "CWinHttpConnection::DetectProxies" (Indicator: "WinHttpConnect"; Source: "00000000-00003992.00000001.89667.71BA1000.00000020.mdmp") Found reference to API "CWinHttpConnection::Reset" (Indicator: "WinHttpConnect"; Source: "00000000-00003992.00000001.89667.71BA1000.00000020.mdmp") Found reference to API "CWinHttpConnection::AsyncDetectProxies" (Indicator: "WinHttpConnect"; Source: "00000000-00003992.00000001.89667.71BA1000.00000020.mdmp") Found reference to API "CWinHttpConnection::DetectProxies(m_ServerName, &m_proxyInfo)" (Indicator: "WinHttpConnect"; Source: "00000000-00003992.00000001.89667.71BA1000.00000020.mdmp") Found reference to API "CWinHttpConnection::AsyncDetectProxiesCallback" (Indicator: "WinHttpConnect"; Source: "00000000-00003992.00000001.89667.71BA1000.00000020.mdmp") Found reference to API "CWinHttpConnection::DoProxyFailover" (Indicator: "WinHttpConnect"; Source: "00000000-00003992.00000001.89667.71BA1000.00000020.mdmp") Found reference to API "CWinHttpConnection::SendRequest" (Indicator: "WinHttpConnect"; Source: "00000000-00003992.00000001.89667.71BA1000.00000020.mdmp") Found reference to API "CWinHttpConnection::CreateRequest" (Indicator: "WinHttpConnect"; Source: "00000000-00003992.00000001.89667.71BA1000.00000020.mdmp") Found reference to API "::WinHttpAddRequestHeaders(m_hHandle, header, header.length(), 0x20000000)" (Indicator: "WinHttpAddRequestHeaders"; Source: "00000000-00003992.00000001.89667.71BA1000.00000020.mdmp") Found reference to API "::WinHttpWriteData(m_hHandle, pbChunk, cbChunk, 0)" (Indicator: "WinHttpWriteData"; Source: "00000000-00003992.00000001.89667.71BA1000.00000020.mdmp") Found reference to API "((WINHTTP_STATUS_CALLBACK)(-1L)) != ::WinHttpSetStatusCallback(m_hHandle, (WINHTTP_STATUS_CALLBACK)CWinHttpRequest::HttpStatusCallback, dwNotificationFlags, 0) ? 1 : 0" (Indicator: "WinHttpSetStatusCallback"; Source: "00000000-00003992.00000001.89667.71BA1000.00000020.mdmp") Found reference to API "WinHttpSetOption( m_hHandle, 38, pProxyInfo, sizeof(WINHTTP_PROXY_INFO) )" (Indicator: "WinHttpSetOption"; Source: "00000000-00003992.00000001.89667.71BA1000.00000020.mdmp") Found reference to API "WinHttpSetOption( m_hHandle, 63, &optionBuffer, sizeof(optionBuffer) )" (Indicator: "WinHttpSetOption"; Source: "00000000-00003992.00000001.89667.71BA1000.00000020.mdmp") Found reference to API "WinHttpSetTimeouts(m_hHandle, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF)" (Indicator: "WinHttpSetTimeouts"; Source: "00000000-00003992.00000001.89667.71BA1000.00000020.mdmp") Found reference to API "::WinHttpSendRequest(m_hHandle, 0, 0, 0, 0, m_cbTotalBodyLength, (DWORD_PTR)this)" (Indicator: "WinHttpSendRequest"; Source: "00000000-00003992.00000001.89667.71BA1000.00000020.mdmp") Found reference to API "WinHttpQueryHeaders( m_hHandle, 22, 0, (LPVOID)lpOutBuffer, &dwSize, 0)" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00003992.00000001.89667.71BA1000.00000020.mdmp") Found reference to API "::WinHttpQueryHeaders( m_hHandle, 19 | 0x20000000, 0, &m_httpStatus, &cbStatusCode, 0)" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00003992.00000001.89667.71BA1000.00000020.mdmp") Found reference to API "::WinHttpQueryDataAvailable(m_hHandle, 0)" (Indicator: "WinHttpQueryDataAvailable"; Source: "00000000-00003992.00000001.89667.71BA1000.00000020.mdmp") Found reference to API "::WinHttpReadData(m_hHandle, (LPVOID)pNextBuffer, cbBytesAvailable, nullptr)" (Indicator: "WinHttpReadData"; Source: "00000000-00003992.00000001.89667.71BA1000.00000020.mdmp") Found reference to API "::WinHttpReceiveResponse(m_hHandle, 0)" (Indicator: "WinHttpReceiveResponse"; Source: "00000000-00003992.00000001.89667.71BA1000.00000020.mdmp")64:Tae0,Found reference to API "WSAStartup" (Indicator: "wsastartup"; Source: "00000000-00000416-00000C2C-378974457") Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00000416.00000000.87360.010A0000.00000002.mdmp") Found reference to API "WSAStartup" (Indicator: "wsastartup"; Source: "00000000-00000416.00000001.89158.0B480000.00000004.mdmp") Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00001368.00000000.87399.00A30000.00000002.mdmp, 00000000-00001368.00000001.89322.00A30000.00000002.mdmp, 00000000-00001368.00000002.91245.00A30000.00000002.mdmp") Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00003428.00000000.89476.01060000.00000002.mdmp") Found reference to API "WSAStartup" (Indicator: "wsastartup"; Source: "00000000-00003428.00000000.89476.0B880000.00000004.mdmp, 00000000-00003428.00000001.89674.0B880000.00000004.mdmp") Found reference to API "ote: There is some performance penalty associated with assembly bind failure logging." (Indicator: " bind "; Source: "00000000-00003668.00000000.86679.000C0000.00000004.mdmp, 00000000-00003668.00000001.87614.000C0000.00000004.mdmp") Found reference to API "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." (Indicator: " bind "; Source: "00000000-00003668.00000000.86679.000C0000.00000004.mdmp, 00000000-00003668.00000001.87614.000C0000.00000004.mdmp") Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00003668.00000000.86679.01E80000.00000002.mdmp") Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00003696.00000000.87243.00B30000.00000002.mdmp") Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00003756.00000000.87229.00880000.00000002.mdmp, 00000000-00003756.00000001.89154.00880000.00000002.mdmp, 00000000-00003756.00000002.91077.00880000.00000002.mdmp") Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00003992.00000000.87747.00D10000.00000002.mdmp, 00000000-00003992.00000001.89667.00D10000.00000002.mdmp, 00000000-00003992.00000002.91592.00D10000.00000002.mdmp") Found reference to API "ile System Bind Data" (Indicator: " bind "; Source: "00000000-00003992.00000001.89667.00200000.00000004.mdmp, 00000000-00003992.00000002.91592.00200000.00000004.mdmp") Found reference to API "GetHostName" (Indicator: "gethostname"; Source: "00000000-00003992.00000001.89667.71BA1000.00000020.mdmp")65:Ta7c7,Found URL "http://bihgkrr546ctjdn4mwr7x4bhvwz55sftx6xir6cwlfo6rhppd2eu7syd.onionwbemscripting.swbemlocatorwbemscripting.swbemlocatorwbemscripting.swbemlocatorselect" - Source: "00000000-00000416.00000001.89158.0B480000.00000004.mdmp") Found URL "http://bihgkrr546ctjdn4mwr7x4bhvwz55sftx6xir6cwlfo6rhppd2eu7syd.onionhttp://bihgkrr546ctjdn4mwr7x4bhvwz55sftx6xir6cwlfo6rhppd2eu7syd.onions-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\testapps-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2ac:\users\hapubws\appdata\local\temp\31839b57a4f11171d6abc8bbc4451ee4.exe" - Source: "00000000-00000416.00000001.89158.0B480000.00000004.mdmp") Found URL "https://theupdatetime.orghttps://theupdatetime.orgh?" - Source: "00000000-00000416.00000001.89158.0B480000.00000004.mdmp") Found URL "https://theupdatetime.org2026/09/15" - Source: "00000000-00000416.00000001.89158.0B480000.00000004.mdmp") Found URL "https://theupdatetime.orghttp://bihgkrr546ctjdn4mwr7x4bhvwz55sftx6xir6cwlfo6rhppd2eu7syd.onion20b1c1115005f5c4e010b00161801040700070818064b0c1a0200b1c1115494a5c031c0b02081a1750475310151f070b57051217441d47031d1512195d501615110b570d0a17550b1209150a45131d1315075a001044160a055b0c0b0a070b0920b1c1115005f5c4e010b00161801040700070818064b0c1a0200b1c1115494a5c031c0b02081a1750475310151f070b57051217441d47031d1512195d501615110b570d0a17550b1209150a45131d1315075a001044160a055b0c0b0a070b0920b1c1115005f5c4e010b00161801040700070818064b0c1a0200b1c1115494a5c031c0b02081a1750475310151f070b57051217441d47031d1512195d501615110b570d0a17550b1209150a45131d1315075a001044160a055b0c0b0a070bh" - Source: "00000000-00000416.00000001.89158.0B480000.00000004.mdmp") Found URL "https://theupdatetime.orghttp://bihgkrr546ctjdn4mwr7x4bhvwz55sftx6xir6cwlfo6rhppd2eu7syd.onioncurrent" - Source: "00000000-00000416.00000001.89158.0B480000.00000004.mdmp") Found URL "https://iplogger.com/2lhi5228282p0690063000020egoextender000l0000:\users\hapubws\appdata\roaming\microsoft\systemcertificates\myredsspcalrpccalrpccalrpc>" - Source: "00000000-00001368.00000001.89322.00320000.00000004.mdmp") Found URL "http://i.pki.goog/we1.crt0'iplogger.com*.iplogger.com0/0-0+%http://c.pki.goog/we1/4y3jdvkomeg.crl0wwkfwyxs" - Source: "00000000-00001368.00000001.89322.00320000.00000004.mdmp") Found URL "http://i.pki.goog/r4.crt0+$0" - Source: "00000000-00001368.00000001.89322.00320000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&globalsign" - Source: "00000000-00001368.00000001.89322.00320000.00000004.mdmp") Found URL "http://i.pki.goog/gsr1.crt0-&0$0" - Source: "00000000-00001368.00000001.89322.00320000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?::5jeqs[\:kmg" - Source: "00000000-00001368.00000001.89322.00320000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:globalsign" - Source: "00000000-00001368.00000001.89322.00320000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:2fbo" - Source: "00000000-00001368.00000001.89322.00320000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&:>4gglobalsign" - Source: "00000000-00001368.00000001.89322.00320000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?::pcg;eglgoogle" - Source: "00000000-00001368.00000001.89322.00320000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00001368.00000001.89322.00320000.00000004.mdmp") Found URL "http://g.symcd.com0e0c0a60301%http://www.geotrust.com/resources/cps06/0-0+%http://g.symcb.com/geotrustpca-g3.crl0symantecpki-1-697033ti^l" - Source: "00000000-00001368.00000001.89322.00320000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00001368.00000001.89322.00320000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czc=[oh=[" - Source: "00000000-00001368.00000001.89322.00320000.00000004.mdmp") Found URL "http://cps.ro0?1$0" - Source: "00000000-00001368.00000001.89322.00320000.00000004.mdmp") Found URL "http://isrg.trustid.ocsp.identrust.com0;/http://apps.identrust.com/roots/dstrootcax3.p7c0m0k0000." - Source: "00000000-00001368.00000001.89322.00320000.00000004.mdmp") Found URL "http://cps.root-x1.letsencrypt.org0<50301+http://crl.identrust.com/dstrootcax3crl.crl0ig'" - Source: "00000000-00001368.00000001.89322.00320000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00001368.00000001.89322.00320000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0izttpsalt" - Source: "00000000-00001368.00000001.89322.00320000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1english1sea" - Source: "00000000-00001368.00000001.89322.00320000.00000004.mdmp") Found URL "https://secure.comodo.com/cps0" - Source: "00000000-00001368.00000001.89322.00320000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com05addons.mozilla.orgwww.addons.mozilla.org0zsb)j9e/9ckxsalt" - Source: "00000000-00001368.00000001.89322.00320000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0%www.google.comgoogle.com0io]l,e9n0p1+0)" - Source: "00000000-00001368.00000001.89322.00320000.00000004.mdmp") Found URL "http://www.public-trust.com/cps/omniroot.html0w0u1gte" - Source: "00000000-00001368.00000001.89322.00320000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0dmxt*j]+xijom5o3y)%" - Source: "00000000-00001368.00000001.89322.00320000.00000004.mdmp") Found URL "http://ocsp.entrust.net03,0*0(" - Source: "00000000-00001368.00000001.89322.00320000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.11c)d[b" - Source: "00000000-00001368.00000001.89322.00320000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0w0u1staat" - Source: "00000000-00001368.00000001.89322.00320000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl0]ko)tsz'salt" - Source: "00000000-00001368.00000001.89322.00320000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.skype.comwww.login.skype.com0ynsl" - Source: "00000000-00001368.00000001.89322.00320000.00000004.mdmp") Found URL "http://cybertrust.omniroot.com/repository.cfm0w0u1gte" - Source: "00000000-00001368.00000001.89322.00320000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0j)z" - Source: "00000000-00001368.00000001.89322.00320000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1tampa1sea" - Source: "00000000-00001368.00000001.89322.00320000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0global" - Source: "00000000-00001368.00000001.89322.00320000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0\0z1staat" - Source: "00000000-00001368.00000001.89322.00320000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domorganisatielatestcrl-g2.crl0^tl*" - Source: "00000000-00001368.00000001.89322.00320000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0or" - Source: "00000000-00001368.00000001.89322.00320000.00000004.mdmp") Found URL "https://www.verisign.com/repository/cpsthis" - Source: "00000000-00001368.00000001.89322.00320000.00000004.mdmp") Found URL "https://www.verisign.com;" - Source: "00000000-00001368.00000001.89322.00320000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0:nzf(+pw)salt" - Source: "00000000-00001368.00000001.89322.00320000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.yahoo.comwww.login.yahoo.com0yvr,salt" - Source: "00000000-00001368.00000001.89322.00320000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/mail.google.comwww.mail.google.com0?=*k!\yro2;nki0!!salt" - Source: "00000000-00001368.00000001.89322.00320000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0kw(=n" - Source: "00000000-00001368.00000001.89322.00320000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0f$\_)$bf!2fxf" - Source: "00000000-00001368.00000001.89322.00320000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.1q7z?,entrust.net1@0>7www.entrust.net/cps_2048" - Source: "00000000-00001368.00000001.89322.00320000.00000004.mdmp") Found URL "http://ocsp.entrust.net0d=0;09000." - Source: "00000000-00001368.00000001.89322.00320000.00000004.mdmp") Found URL "http://www.digicert.com.my/cps.htm02+0)0'!http://crl.entrust.net/2048ca.crl09yk3y!:s" - Source: "00000000-00001368.00000001.89322.00320000.00000004.mdmp") Found URL "http://www.public-trust.com/cps/omniroot.html0w0u1gte" - Source: "00000000-00001368.00000001.89322.04BB0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0\0" - Source: "00000000-00001368.00000001.89322.04BB0000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0w0u1staat" - Source: "00000000-00001368.00000001.89322.04BB0000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl00ev" - Source: "00000000-00001368.00000001.89322.04BB0000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1english1sea" - Source: "00000000-00001368.00000001.89322.04BB0000.00000004.mdmp") Found URL "https://secure.comodo.com/cps0" - Source: "00000000-00001368.00000001.89322.04BB0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0-login.live.comwww.login.live.com0nwk1uy1un:tqg.,2fogsp" - Source: "00000000-00001368.00000001.89322.04BB0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0entrust.net1;092www.entrust.net/cps" - Source: "00000000-00001368.00000001.89322.04BB0000.00000004.mdmp") Found URL "http://ocsp.entrust.net03,0*0(" - Source: "00000000-00001368.00000001.89322.04BB0000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0v7.1ctj7+>.entrus2western" - Source: "00000000-00001368.00000001.89322.04BB0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0>ej-+\lu>gvpob\hzagxr" - Source: "00000000-00001368.00000001.89322.04BB0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?;f[gcom1" - Source: "00000000-00001368.00000001.89322.04BB0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?2fbcxx4bbz69:qbf:y" - Source: "00000000-00001368.00000001.89322.04BB0000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00001368.00000001.89322.04BB0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00001368.00000001.89322.04BB0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00001368.00000001.89322.04BB0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnk't" - Source: "00000000-00001368.00000001.89322.04BB0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00001368.00000001.89322.04BB0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00001368.00000001.89322.04BB0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00001368.00000001.89322.04BB0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l:n.gowu" - Source: "00000000-00001368.00000001.89322.04BB0000.00000004.mdmp") Found URL "http://i.pki.goog/we1.crt0'iplogger.com*.iplogger.com0/0-0+%http://c.pki.goog/we1/4y3jdvkomeg.crl0wwkfwyxs" - Source: "00000000-00001368.00000001.89322.04BB0000.00000004.mdmp") Found URL "http://i.pki.goog/r4.crt0+$0" - Source: "00000000-00001368.00000001.89322.04BB0000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&globalsign" - Source: "00000000-00001368.00000001.89322.04BB0000.00000004.mdmp") Found URL "http://i.pki.goog/gsr1.crt0-&0$0" - Source: "00000000-00001368.00000001.89322.04BB0000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:kzp.d$y/qm*[io89v:/nr^br:yhsix@h*p1google" - Source: "00000000-00001368.00000001.89322.04BB0000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&vj" - Source: "00000000-00001368.00000001.89322.04BB0000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:2oje," - Source: "00000000-00001368.00000001.89322.04BB0000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&:>4gglobalsign" - Source: "00000000-00001368.00000001.89322.04BB0000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?::=cggoogle" - Source: "00000000-00001368.00000001.89322.04BB0000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&:n4gvj" - Source: "00000000-00001368.00000001.89322.04BB0000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:3lssruuukssmt;" - Source: "00000000-00001368.00000001.89322.04BB0000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:" - Source: "00000000-00001368.00000001.89322.04BB0000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:google" - Source: "00000000-00001368.00000001.89322.04BB0000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&;p4g&za@2c" - Source: "00000000-00001368.00000001.89322.04BB0000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:globalsign" - Source: "00000000-00001368.00000001.89322.04BB0000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:2eeg" - Source: "00000000-00001368.00000001.89322.04BB0000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:," - Source: "00000000-00001368.00000001.89322.04BB0000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:wjarwyaqw>*2fbo23.140.1.2.123.140.1.2.1te20d[,/p/fus9/_/d/_" - Source: "00000000-00001368.00000001.89322.04BB0000.00000004.mdmp") Found URL "http://i.pki.goog/we1.crt0'iplogger.com*.iplogger.com0/0-0+%http://c.pki.goog/we1/4y3jdvkkk-_.cwwkfgek-_wyxs" - Source: "00000000-00001368.00000001.89322.04BB0000.00000004.mdmp") Found URL "http://j-_i./r/r4.crl0@az&globalsign" - Source: "00000000-00001368.00000001.89322.04BB0000.00000004.mdmp") Found URL "http://i.pki.goog/5j-_.c&0$0" - Source: "00000000-00001368.00000001.89322.04BB0000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,," - Source: "00000000-00001368.00000001.89322.04BB0000.00000004.mdmp") Found URL "https://iplogger.com/2lhi5228282p0690063000020egoextender000l0000:\users\hapubws\appdata\roaming\microsoft\systemcertificates\myredsspcalrpccalrpccalrpc>" - Source: "00000000-00001368.00000002.91245.00320000.00000004.mdmp") Found URL "http://i.pki.goog/we1.crt0'iplogger.com*.iplogger.com0/0-0+%http://c.pki.goog/we1/4y3jdvkomeg.crl0wwkfwyxs" - Source: "00000000-00001368.00000002.91245.00320000.00000004.mdmp") Found URL "http://i.pki.goog/r4.crt0+$0" - Source: "00000000-00001368.00000002.91245.00320000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&globalsign" - Source: "00000000-00001368.00000002.91245.00320000.00000004.mdmp") Found URL "http://i.pki.goog/gsr1.crt0-&0$0" - Source: "00000000-00001368.00000002.91245.00320000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?::5jeqs[\:kmg" - Source: "00000000-00001368.00000002.91245.00320000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:globalsign" - Source: "00000000-00001368.00000002.91245.00320000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:2fbo" - Source: "00000000-00001368.00000002.91245.00320000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00001368.00000002.91245.00320000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00001368.00000002.91245.00320000.00000004.mdmp") Found URL "http://g.symcd.com0e0c0a60301%http://www.geotrust.com/resources/cps06/0-0+%http://g.symcb.com/geotrustpca-g3.crl0symantecpki-1-697033ti^l" - Source: "00000000-00001368.00000002.91245.00320000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00001368.00000002.91245.00320000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czc=[oh=[" - Source: "00000000-00001368.00000002.91245.00320000.00000004.mdmp") Found URL "http://cps.ro0?1$0" - Source: "00000000-00001368.00000002.91245.00320000.00000004.mdmp") Found URL "http://isrg.trustid.ocsp.identrust.com0;/http://apps.identrust.com/roots/dstrootcax3.p7c0m0k0000." - Source: "00000000-00001368.00000002.91245.00320000.00000004.mdmp") Found URL "http://cps.root-x1.letsencrypt.org0<50301+http://crl.identrust.com/dstrootcax3crl.crl0ig'" - Source: "00000000-00001368.00000002.91245.00320000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00001368.00000002.91245.00320000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0izttpsalt" - Source: "00000000-00001368.00000002.91245.00320000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1english1sea" - Source: "00000000-00001368.00000002.91245.00320000.00000004.mdmp") Found URL "https://secure.comodo.com/cps0" - Source: "00000000-00001368.00000002.91245.00320000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com05addons.mozilla.orgwww.addons.mozilla.org0zsb)j9e/9ckxsalt" - Source: "00000000-00001368.00000002.91245.00320000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0%www.google.comgoogle.com0io]l,e9n0p1+0)" - Source: "00000000-00001368.00000002.91245.00320000.00000004.mdmp") Found URL "http://www.public-trust.com/cps/omniroot.html0w0u1gte" - Source: "00000000-00001368.00000002.91245.00320000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0dmxt*j]+xijom5o3y)%" - Source: "00000000-00001368.00000002.91245.00320000.00000004.mdmp") Found URL "http://ocsp.entrust.net03,0*0(" - Source: "00000000-00001368.00000002.91245.00320000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.11c)d[b" - Source: "00000000-00001368.00000002.91245.00320000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0w0u1staat" - Source: "00000000-00001368.00000002.91245.00320000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl0]ko)tsz'salt" - Source: "00000000-00001368.00000002.91245.00320000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.skype.comwww.login.skype.com0ynsl" - Source: "00000000-00001368.00000002.91245.00320000.00000004.mdmp") Found URL "http://cybertrust.omniroot.com/repository.cfm0w0u1gte" - Source: "00000000-00001368.00000002.91245.00320000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0j)z" - Source: "00000000-00001368.00000002.91245.00320000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1tampa1sea" - Source: "00000000-00001368.00000002.91245.00320000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0global" - Source: "00000000-00001368.00000002.91245.00320000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0\0z1staat" - Source: "00000000-00001368.00000002.91245.00320000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domorganisatielatestcrl-g2.crl0^tl*" - Source: "00000000-00001368.00000002.91245.00320000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0or" - Source: "00000000-00001368.00000002.91245.00320000.00000004.mdmp") Found URL "https://www.verisign.com/repository/cpsthis" - Source: "00000000-00001368.00000002.91245.00320000.00000004.mdmp") Found URL "https://www.verisign.com;" - Source: "00000000-00001368.00000002.91245.00320000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0:nzf(+pw)salt" - Source: "00000000-00001368.00000002.91245.00320000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.yahoo.comwww.login.yahoo.com0yvr,salt" - Source: "00000000-00001368.00000002.91245.00320000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/mail.google.comwww.mail.google.com0?=*k!\yro2;nki0!!salt" - Source: "00000000-00001368.00000002.91245.00320000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0kw(=n" - Source: "00000000-00001368.00000002.91245.00320000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0f$\_)$bf!2fxf" - Source: "00000000-00001368.00000002.91245.00320000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.1q7z?,entrust.net1@0>7www.entrust.net/cps_2048" - Source: "00000000-00001368.00000002.91245.00320000.00000004.mdmp") Found URL "http://ocsp.entrust.net0d=0;09000." - Source: "00000000-00001368.00000002.91245.00320000.00000004.mdmp") Found URL "http://www.digicert.com.my/cps.htm02+0)0'!http://crl.entrust.net/2048ca.crl09yk3y!:s" - Source: "00000000-00001368.00000002.91245.00320000.00000004.mdmp") Found URL "http://www.public-trust.com/cps/omniroot.html0w0u1gte" - Source: "00000000-00001368.00000002.91245.04BB0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0\0" - Source: "00000000-00001368.00000002.91245.04BB0000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0w0u1staat" - Source: "00000000-00001368.00000002.91245.04BB0000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl00ev" - Source: "00000000-00001368.00000002.91245.04BB0000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1english1sea" - Source: "00000000-00001368.00000002.91245.04BB0000.00000004.mdmp") Found URL "https://secure.comodo.com/cps0" - Source: "00000000-00001368.00000002.91245.04BB0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0-login.live.comwww.login.live.com0nwk1uy1un:tqg.,2fogsp" - Source: "00000000-00001368.00000002.91245.04BB0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0entrust.net1;092www.entrust.net/cps" - Source: "00000000-00001368.00000002.91245.04BB0000.00000004.mdmp") Found URL "http://ocsp.entrust.net03,0*0(" - Source: "00000000-00001368.00000002.91245.04BB0000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0v7.1ctj7+>.entrus2western" - Source: "00000000-00001368.00000002.91245.04BB0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0>ej-+\lu>gvpob\hzagxr" - Source: "00000000-00001368.00000002.91245.04BB0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?;f[gcom1" - Source: "00000000-00001368.00000002.91245.04BB0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?2fbcxx4bbz69:qbf:y" - Source: "00000000-00001368.00000002.91245.04BB0000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00001368.00000002.91245.04BB0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00001368.00000002.91245.04BB0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00001368.00000002.91245.04BB0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnk't" - Source: "00000000-00001368.00000002.91245.04BB0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00001368.00000002.91245.04BB0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00001368.00000002.91245.04BB0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lowu" - Source: "00000000-00001368.00000002.91245.04BB0000.00000004.mdmp") Found URL "http://i.pki.goog/we1.crt0'iplogger.com*.iplogger.com0/0-0+%http://c.pki.goog/we1/4y3jdvkomeg.crl0wwkfwyxs" - Source: "00000000-00001368.00000002.91245.04BB0000.00000004.mdmp") Found URL "http://i.pki.goog/r4.crt0+$0" - Source: "00000000-00001368.00000002.91245.04BB0000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&globalsign" - Source: "00000000-00001368.00000002.91245.04BB0000.00000004.mdmp") Found URL "http://i.pki.goog/gsr1.crt0-&0$0" - Source: "00000000-00001368.00000002.91245.04BB0000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:kzp.d$y/qm*[io89v:/nr^br:yhsix@h*p13lssruuukssm4imzyaj" - Source: "00000000-00001368.00000002.91245.04BB0000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&vj" - Source: "00000000-00001368.00000002.91245.04BB0000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:2oje2fbof4!_c4!_" - Source: "00000000-00001368.00000002.91245.04BB0000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&&za@q" - Source: "00000000-00001368.00000002.91245.04BB0000.00000004.mdmp") Found URL "http://c.pki.go!_/r@az&globalsign" - Source: "00000000-00001368.00000002.91245.04BB0000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:google" - Source: "00000000-00001368.00000002.91245.04BB0000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:pl)z2ebe!_1[" - Source: "00000000-00001368.00000002.91245.04BB0000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:8.pki(washington1redmond1microsoft" - Source: "00000000-00001368.00000002.91245.04BB0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l;g.g2ekg\" - Source: "00000000-00001368.00000002.91245.04BB0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l;pjg[^" - Source: "00000000-00001368.00000002.91245.04BB0000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&," - Source: "00000000-00001368.00000002.91245.04BB0000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&v3jdvkomeg.crl0," - Source: "00000000-00001368.00000002.91245.04BB0000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&2obo," - Source: "00000000-00001368.00000002.91245.04BB0000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&h*,,," - Source: "00000000-00001368.00000002.91245.04BB0000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&vp/" - Source: "00000000-00001368.00000002.91245.04BB0000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&vroot" - Source: "00000000-00001368.00000002.91245.04BB0000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&*0(0&http://i.pki.goog/gsr1.crt0-&0$0" - Source: "00000000-00001368.00000002.91245.04BB0000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:globalsign" - Source: "00000000-00001368.00000002.91245.04BB0000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:._al" - Source: "00000000-00001368.00000002.91245.04BB0000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?eglobalsign" - Source: "00000000-00001368.00000002.91245.04BB0000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr._l0h*,,yu5,1[?ep[?:globalsign" - Source: "00000000-00001368.00000002.91245.04BB0000.00000004.mdmp") Found URL "http://i.pkic._g/.crt0-&0$0" - Source: "00000000-00001368.00000002.91245.04BB0000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:2fbo._p>6wp7._x?pl)z._l&._" - Source: "00000000-00001368.00000002.91245.04BB0000.00000004.mdmp") Found URL "http://i.pki.goog/we1.crt0'iplogger.com*.iplogger.com0/0-0+%http://c.pki.goog/we1/4y3jdvk/_.cwwkfwyxs" - Source: "00000000-00001368.00000002.91245.04BB0000.00000004.mdmp") Found URL "http:///_i./r/r4.crl0@az&globalsign" - Source: "00000000-00001368.00000002.91245.04BB0000.00000004.mdmp") Found URL "http://i.pki.goog//_.c&0$0" - Source: "00000000-00001368.00000002.91245.04BB0000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:lmem" - Source: "00000000-00001368.00000002.91245.04BB0000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&pl)z," - Source: "00000000-00001368.00000002.91245.04BB0000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&pl)z.3.12cbcdu-_kvj" - Source: "00000000-00001368.00000002.91245.04BB0000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:-_" - Source: "00000000-00001368.00000002.91245.04BB0000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:-_t+globalsign" - Source: "00000000-00001368.00000002.91245.04BB0000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:2obcglobalsign" - Source: "00000000-00001368.00000002.91245.04BB0000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:m*[io89v:peqvr\1rfe.3cb>jarwyaqw>*2ebo-_06-_fg-_/r-_ic-_tt2cbe._\" - Source: "00000000-00001368.00000002.91245.04BB0000.00000004.mdmp") Found URL "http://i.pki.goog/._rt$0" - Source: "00000000-00001368.00000002.91245.04BB0000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&._0" - Source: "00000000-00001368.00000002.91245.04BB0000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0yu5,1[?ep[?:;dbe2ohggoogle" - Source: "00000000-00001368.00000002.91245.04BB0000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:/_" - Source: "00000000-00001368.00000002.91245.04BB0000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?::-bo" - Source: "00000000-00001368.00000002.91245.04BB0000.00000004.mdmp") Found URL "http://bihgkrr546ctjdn4mwr7x4bhvwz55sftx6xir6cwlfo6rhppd2eu7syd.onionhapubws-pcwbemscripting.swbemlocatorc:\users\hapubws\appdata\local\temp\31839b57a4f11171d6abc8bbc4451ee4.exec:\users\hapubws\appdata\local\temp\31839b57a4f11171d6abc8bbc4451ee4.exec:\windows\system32\kernel32.dllc:\users\hapubws\appdata\local\tempc:\windows\system32\advapi32.dllc:\users\hapubws\appdata\local\temp\31839b57a4f11171d6abc8bbc445<<>><<>><<>><<>><<>>01^e*w*" - Source: "00000000-00003428.00000001.89674.0B880000.00000004.mdmp") Found URL "http://bihgkrr546ctjdn4mwr7x4bhvwz55sftx6xir6cwlfo6rhppd2eu7syd.onionhttp://bihgkrr546ctjdn4mwr7x4bhvwz55sftx6xir6cwlfo6rhppd2eu7syd.onions-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\testapps-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2ahttp://bihgkrr546ctjdn4mwr7x4bhvwz55sftx6xir6cwlfo6rhppd2eu7syd.onions-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2ac:\users\hapubws\appdata\local\temp\31839b57a4f11171d6abc8bbc4451ee4.exe" - Source: "00000000-00003428.00000001.89674.0B880000.00000004.mdmp") Found URL "https://theupdatetime.orghttps://theupdatetime.orgh?" - Source: "00000000-00003428.00000001.89674.0B880000.00000004.mdmp") Found URL "https://theupdatetime.org2026/09/15" - Source: "00000000-00003428.00000001.89674.0B880000.00000004.mdmp") Found URL "http://nsis.sf.net/nsis_errorerror" - Source: "00000000-00003756.00000001.89154.0040A000.00000004.mdmp") Found URL "http://api.ipify.org/?format=qqq/silent1023http://91.92.254.7/scripts/plus.php?ip=substr=five&s=ab/tostack/nocancelnsisdl.dllsyncupd.exehttp://jesuscolin.top/syncupd.exedownload_quietsuccesshttps://iplogger.com/1aiqk4software\broomcleanerinstallederror!" - Source: "00000000-00003756.00000002.91077.00260000.00000004.mdmp") Found URL "http://ssw.live.com/uploaddata.aspxsoftware\microsoft\windows" - Source: "00000000-00003992.00000001.89667.71BA1000.00000020.mdmp") Found URL "https://sqm.microsoft.com/sqm/%s/manifests/sqm%d.bintestmanifesturldisablemanifestdownload%s/?partner=%shttps://copyuploadedfilestofoldersamplingintervalupload" - Source: "00000000-00003992.00000001.89667.71BA1000.00000020.mdmp") Found URL "http:///default.htmtransfer-encoding:" - Source: "00000000-00003992.00000001.89667.71BA1000.00000020.mdmp") Found URL "https://%s:%d%swlc-extended-statusauthdocumentnotfoundcontent-encodinggzipunknownmachineguid" - Source: "00000000-00003992.00000001.89667.71BA1000.00000020.mdmp") Found URL "http://fontawesome.iohttp://fontawesome.io/license/vs_version_infostringfileinfo040904e4fileversion1.0.0.0productversion1.0.0.0programidcom.embarcadero.broomfiledescriptionbroomproductnamebroomvarfileinfotranslationembarcadero" - Source: "00000000-00003992.00000002.91592.00825000.00000002.mdmp") Found URL "http://fontawesome.iohttp://fontawesome.io/license/glassmusicsearchenvelopeheartstarstar_emptyuserfilmth_largeth_listremovezoom_inzoom_outsignaltrashhomefile_alttimeroaddownload_altdownloaduploadinboxplay_circlerepeatrefreshlist_altlockflagheadphonesvolume_offvolume_down" - Source: "00000000-00003992.00000002.91592.00825000.00000002.mdmp") Found URL "http://www.w3.org/1999/02/22-rdf-syntax-ns" - Source: "00000000-00003992.00000002.91592.00825000.00000002.mdmp") Found URL "http://sqm.microsoft.com/sqm/windowslive/sqmserver.dllsync" - Source: "00000000-00003992.00000002.91592.71B51000.00000020.mdmp")66:T407,Found string "Kerberos" (Indicator: "kerberos"; Source: "00000000-00000416.00000001.89158.001D0000.00000004.mdmp, 00000000-00000416.00000001.89158.00238000.00000004.mdmp") Found string ":\Windows\system32\kerberos.DLL" (Indicator: "kerberos"; Source: "00000000-00001368.00000001.89322.00320000.00000004.mdmp, 00000000-00001368.00000002.91245.00320000.00000004.mdmp") Found string "icrosoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00001368.00000001.89322.00320000.00000004.mdmp, 00000000-00001368.00000002.91245.00320000.00000004.mdmp") Found string "Microsoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00001368.00000001.89322.00320000.00000004.mdmp, 00000000-00001368.00000002.91245.00320000.00000004.mdmp") Found string "Kerberos" (Indicator: "kerberos"; Source: "00000000-00001368.00000001.89322.00320000.00000004.mdmp, 00000000-00001368.00000002.91245.00320000.00000004.mdmp") Found string "Kerberos" (Indicator: "kerberos"; Source: "00000000-00003428.00000001.89674.00170000.00000004.mdmp")67:T846,Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; File: "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d") Found reference to API "BitBlt" (Indicator: "BitBlt"; File: "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d") Found reference to API "CreateDCW" (Indicator: "CreateDC"; File: "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; File: "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; File: "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d") Found reference to API "GetDCEx" (Indicator: "GetDC"; File: "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; File: "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d") Found reference to API "GetDC" (Indicator: "GetDC"; File: "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; File: "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00003756.00000002.91077.00408000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00003992.00000000.87747.0081E000.00000004.mdmp, 00000000-00003992.00000002.91592.0081D000.00000004.mdmp") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; Source: "00000000-00003992.00000000.87747.0081E000.00000004.mdmp, 00000000-00003992.00000002.91592.0081D000.00000004.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00003992.00000000.87747.0081E000.00000004.mdmp, 00000000-00003992.00000002.91592.0081D000.00000004.mdmp") Found reference to API "GetDCEx" (Indicator: "GetDC"; Source: "00000000-00003992.00000000.87747.0081E000.00000004.mdmp, 00000000-00003992.00000002.91592.0081D000.00000004.mdmp")68:Ta4a,Found registry query API: "RegQueryValueExW" in file "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d" Found registry query API: "RegEnumValueW" in file "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d" Found registry query API: "RegQueryInfoKeyW" in file "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d" Found registry query API: "RegSaveKeyW" in file "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d" Found registry query API: "RegOpenKeyExW" in file "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d" Found registry query API: "RegEnumKeyExW" in file "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d" Found registry query API: "RegEnumKeyW" in file "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d" Found registry query API: "RegOpenKeyExW" in "00000000-00000416.00000001.89158.0B480000.00000004.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00000416.00000001.89158.0B480000.00000004.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00003428.00000001.89674.0B880000.00000004.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00003428.00000001.89674.0B880000.00000004.mdmp" Found registry query API: "RegEnumValueW" in "00000000-00003756.00000002.91077.00408000.00000002.mdmp" Found registry query API: "RegEnumKeyW" in "00000000-00003756.00000002.91077.00408000.00000002.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00003756.00000002.91077.00408000.00000002.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00003756.00000002.91077.00408000.00000002.mdmp" Found registry query API: "RegOpenKeyTransactedW" in "00000000-00003992.00000001.89667.71BA1000.00000020.mdmp, 00000000-00003992.00000002.91592.71B51000.00000020.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00003992.00000001.89667.71C09000.00000002.mdmp, 00000000-00003992.00000002.91592.71B68000.00000002.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00003992.00000001.89667.71C09000.00000002.mdmp" Found registry query API: "RegGetValueW" in "00000000-00003992.00000001.89667.71C09000.00000002.mdmp, 00000000-00003992.00000002.91592.71B68000.00000002.mdmp" Found registry query API: "RegEnumValueW" in "00000000-00003992.00000001.89667.71C09000.00000002.mdmp" Found registry query API: "RegQueryInfoKeyW" in "00000000-00003992.00000001.89667.71C09000.00000002.mdmp, 00000000-00003992.00000002.91592.71B68000.00000002.mdmp" Found registry query API: "RegOpenKeyExA" in "00000000-00003992.00000001.89667.71C09000.00000002.mdmp"69:T51d,Found reference to API "GetKeyState" (Indicator: "GetKeyState"; File: "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d") Found reference to API "MapVirtualKeyW" (Indicator: "MapVirtualKey"; File: "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d") Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; File: "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d") Found reference to API "GetKeyNameTextW" (Indicator: "GetKeyNameText"; File: "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d") Found reference to API "GetAsyncKeyState" (Indicator: "GetAsyncKeyState"; File: "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d") Found reference to API "GetAsyncKeyState" (Indicator: "GetAsyncKeyState"; Source: "00000000-00003992.00000000.87747.0081E000.00000004.mdmp, 00000000-00003992.00000002.91592.0081D000.00000004.mdmp") Found reference to API "GetKeyNameTextW" (Indicator: "GetKeyNameText"; Source: "00000000-00003992.00000000.87747.0081E000.00000004.mdmp, 00000000-00003992.00000002.91592.0081D000.00000004.mdmp") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; Source: "00000000-00003992.00000000.87747.0081E000.00000004.mdmp, 00000000-00003992.00000002.91592.0081D000.00000004.mdmp")6a:Tb41,Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; File: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; File: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; File: "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d") Found reference to API "NetWkstaGetInfo" (Indicator: "NetWkstaGetInfo"; File: "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d") Found reference to API "WTSQuerySessionInformationA" (Indicator: "WTSQuerySessionInformation"; File: "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d") Found reference to API "4121008,996,3216,,LookupAccountSidA,advapi32.dll,"252:48:36.312",RX=0,PX=0" (Indicator: "LookupAccountSid"; Source: "00000000-00000416.00000001.89158.00238000.00000004.mdmp") Found reference to API "NetUserGetInfo" (Indicator: "NetUserGetInfo"; Source: "00000000-00000416.00000001.89158.0B480000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00000416.00000001.89158.0B480000.00000004.mdmp") Found reference to API "LookupAccountNameW" (Indicator: "LookupAccountName"; Source: "00000000-00003428.00000000.89476.0B880000.00000004.mdmp, 00000000-00003428.00000001.89674.0B880000.00000004.mdmp") Found reference to API "WTSQuerySessionInformationW" (Indicator: "WTSQuerySessionInformation"; Source: "00000000-00003428.00000000.89476.0B880000.00000004.mdmp, 00000000-00003428.00000001.89674.0B880000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00003428.00000001.89674.0B880000.00000004.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "getLookupAccountName" (Indicator: "LookupAccountName"; Source: "00000000-00003992.00000001.89667.71BA1000.00000020.mdmp") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00003992.00000001.89667.71BA1000.00000020.mdmp, 00000000-00003992.00000001.89667.71C09000.00000002.mdmp, 00000000-00003992.00000002.91592.71B68000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00003992.00000001.89667.71C09000.00000002.mdmp, 00000000-00003992.00000002.91592.71B68000.00000002.mdmp") Found reference to API "LookupAccountNameW" (Indicator: "LookupAccountName"; Source: "00000000-00003992.00000001.89667.71C09000.00000002.mdmp")6b:Tf4f,"f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00003668) "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00003668) "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\* (UID: 00000000-00003668) "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\latestrock\* (UID: 00000000-00003668) "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\* (UID: 00000000-00003668) "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\* (UID: 00000000-00003668) "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" called "FindFirstFileW" with parameter %TEMP%\*.* (UID: 00000000-00003668) "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00003668) "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" called "FindNextFileW" with parameter 10D5CC3F-71C4-40D7-8173-E990C25C1412.Diagnose.Admin.0.etl (UID: 00000000-00003668) "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" called "FindNextFileW" with parameter 1df892bc-2ec3-4d0e-ac47-1eabbc40bce1.tmp (UID: 00000000-00003668) "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" called "FindNextFileW" with parameter 8578e504-fb9e-4973-8218-da2b499cb57d.tmp (UID: 00000000-00003668) "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" called "FindNextFileW" with parameter 99F9947D-30DB-4640-92C7-6BB2A24B05F1.Diagnose.Admin.0.etl (UID: 00000000-00003668) "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" called "FindNextFileW" with parameter a881a3c9-dc11-47c4-9cf5-94257bfac790.tmp (UID: 00000000-00003668) "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" called "FindNextFileW" with parameter AA7D7BE8-CE8F-4570-A39C-1992F0466AAE.Diagnose.Admin.0.etl (UID: 00000000-00003668) "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" called "FindNextFileW" with parameter AdobeARM.log (UID: 00000000-00003668) "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" called "FindNextFileW" with parameter AdobeARM_NotLocked.log (UID: 00000000-00003668) "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" called "FindNextFileW" with parameter AdobeSFX.log (UID: 00000000-00003668) "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" called "FindNextFileW" with parameter Adobe_ADMLogs (UID: 00000000-00003668) "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" called "FindNextFileW" with parameter ASPNETSetup_00001.log (UID: 00000000-00003668) "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" called "FindNextFileW" with parameter ASPNETSetup_00002.log (UID: 00000000-00003668) "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" called "FindNextFileW" with parameter c278146c-ed5a-46a3-b7ee-8da417122e54.tmp (UID: 00000000-00003668) "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" called "FindNextFileW" with parameter ccversion.tag (UID: 00000000-00003668) "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" called "FindNextFileW" with parameter chromesetup.msi (UID: 00000000-00003668)6c:T42f,"f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" called "CreateToolhelp32Snapshot" with parameters {"dwFlags": "4" "th32ProcessID": "0"} "InstallSetup5.exe" called "CreateToolhelp32Snapshot" with parameters {"dwFlags": "4" "th32ProcessID": "0"} "toolspub2.exe" called "CreateToolhelp32Snapshot" with parameters {"dwFlags": "4" "th32ProcessID": "0"} "toolspub2.exe" called "CreateToolhelp32Snapshot" with parameters {"dwFlags": "8" "th32ProcessID": "0"} "31839b57a4f11171d6abc8bbc4451ee4.exe" called "CreateToolhelp32Snapshot" with parameters {"dwFlags": "8" "th32ProcessID": "0"} "31839b57a4f11171d6abc8bbc4451ee4.exe" called "CreateToolhelp32Snapshot" with parameters {"dwFlags": "4" "th32ProcessID": "0"} "31839b57a4f11171d6abc8bbc4451ee4.exe" called "CreateToolhelp32Snapshot" with parameters {"dwFlags": "2" "th32ProcessID": "0"} "kos4.exe" called "CreateToolhelp32Snapshot" with parameters {"dwFlags": "4" "th32ProcessID": "0"} "Broom.exe" called "CreateToolhelp32Snapshot" with parameters {"dwFlags": "4" "th32ProcessID": "0"}6d:T766,Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; File: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; File: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00003756.00000002.91077.00408000.00000002.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00003756.00000002.91077.00408000.00000002.mdmp") Found reference to API "FindFirstFileExA" (Indicator: "FindFirstFile"; Source: "00000000-00003992.00000001.89667.71AAA000.00000004.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00003992.00000001.89667.71AAA000.00000004.mdmp") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00003992.00000001.89667.71AAA000.00000004.mdmp, 00000000-00003992.00000002.91592.71B2A000.00000002.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00003992.00000001.89667.71AAA000.00000004.mdmp, 00000000-00003992.00000001.89667.71C09000.00000002.mdmp, 00000000-00003992.00000001.89667.71CA4000.00000002.mdmp, 00000000-00003992.00000002.91592.71B2A000.00000002.mdmp, 00000000-00003992.00000002.91592.71B68000.00000002.mdmp") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00003992.00000001.89667.71C09000.00000002.mdmp, 00000000-00003992.00000001.89667.71CA4000.00000002.mdmp, 00000000-00003992.00000002.91592.71B68000.00000002.mdmp")6e:Teb9,Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; File: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "GetModuleHandle" (Indicator: "GetModuleHandle"; Source: "00000000-00001368.00000001.89322.00252000.00000020.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00001368.00000001.89322.00252000.00000020.mdmp") Found reference to API "Process32FirstW" (Indicator: "Process32First"; Source: "00000000-00003428.00000001.89674.0B880000.00000004.mdmp") Found reference to API "Process32NextW" (Indicator: "Process32Next"; Source: "00000000-00003428.00000001.89674.0B880000.00000004.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00003428.00000001.89674.0B880000.00000004.mdmp") Found reference to API "GetModuleHandle" (Indicator: "GetModuleHandle"; Source: "00000000-00003668.00000001.87614.02A80000.00000004.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00003668.00000001.87614.02A80000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003756.00000002.91077.00408000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00003756.00000002.91077.00408000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00003756.00000002.91077.00408000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003992.00000001.89667.71AAA000.00000004.mdmp, 00000000-00003992.00000001.89667.71C09000.00000002.mdmp, 00000000-00003992.00000002.91592.71B68000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00003992.00000001.89667.71AAA000.00000004.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00003992.00000001.89667.71AAA000.00000004.mdmp, 00000000-00003992.00000001.89667.71CA4000.00000002.mdmp")6f:T5ee,Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "GetModuleHandle" (Indicator: "GetModuleHandle"; Source: "00000000-00001368.00000001.89322.00252000.00000020.mdmp") Found reference to API "GetModuleHandle" (Indicator: "GetModuleHandle"; Source: "00000000-00003668.00000001.87614.02A80000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003756.00000002.91077.00408000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00003756.00000002.91077.00408000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003992.00000001.89667.71AAA000.00000004.mdmp, 00000000-00003992.00000001.89667.71C09000.00000002.mdmp, 00000000-00003992.00000002.91592.71B68000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00003992.00000001.89667.71AAA000.00000004.mdmp")70:T1015,Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; File: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d") Found reference to API "SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation"; File: "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; File: "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; File: "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; File: "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; File: "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00000416.00000001.89158.0B480000.00000004.mdmp") Found reference to API "GetTempPath" (Indicator: "GetTempPath"; Source: "00000000-00001368.00000001.89322.00252000.00000020.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00003428.00000000.89476.0B880000.00000004.mdmp, 00000000-00003428.00000001.89674.0B880000.00000004.mdmp") Found reference to API "GetTempPath" (Indicator: "GetTempPath"; Source: "00000000-00003668.00000001.87614.02A80000.00000004.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00003696.00000000.87243.0012C000.00000004.mdmp, 00000000-00003696.00000001.87336.0012C000.00000004.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; Source: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003756.00000001.89154.0040A000.00000004.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003756.00000001.89154.0040A000.00000004.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00003756.00000001.89154.0040A000.00000004.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00003756.00000002.91077.00408000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00003756.00000002.91077.00408000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00003756.00000002.91077.00408000.00000002.mdmp") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; Source: "00000000-00003756.00000002.91077.00408000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00003756.00000002.91077.00408000.00000002.mdmp") Found reference to API "SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation"; Source: "00000000-00003992.00000000.87747.0081E000.00000004.mdmp, 00000000-00003992.00000002.91592.0081D000.00000004.mdmp")71:T49e,Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; File: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00003428.00000001.89674.0B880000.00000004.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00003696.00000000.87243.0012C000.00000004.mdmp, 00000000-00003696.00000001.87336.0012C000.00000004.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00003756.00000002.91077.00408000.00000002.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00003992.00000001.89667.71AAA000.00000004.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00003992.00000001.89667.71AAA000.00000004.mdmp, 00000000-00003992.00000001.89667.71C09000.00000002.mdmp, 00000000-00003992.00000002.91592.71B68000.00000002.mdmp")72:T44c,Found reference to API "GetTickCount" (Indicator: "GetTickCount"; File: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "GetTickCount" (Indicator: "GetTickCount"; Source: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "GetTickCount" (Indicator: "GetTickCount"; Source: "00000000-00003756.00000002.91077.00408000.00000002.mdmp") Found reference to API "GetTickCount" (Indicator: "GetTickCount"; Source: "00000000-00003992.00000001.89667.71AAA000.00000004.mdmp, 00000000-00003992.00000001.89667.71C09000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount"; Source: "00000000-00003992.00000001.89667.71BA1000.00000020.mdmp, 00000000-00003992.00000001.89667.71C09000.00000002.mdmp, 00000000-00003992.00000001.89667.71CA4000.00000002.mdmp, 00000000-00003992.00000002.91592.71B2A000.00000002.mdmp, 00000000-00003992.00000002.91592.71B68000.00000002.mdmp") Found reference to API "(BOOL)g_pfnGetTickCount64" (Indicator: "GetTickCount"; Source: "00000000-00003992.00000001.89667.71BA1000.00000020.mdmp")73:T108d,Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe" (Indicator: "\Device\"; Source: "00000000-00000416.00000001.89158.001D0000.00000004.mdmp") Found string "indows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00000416.00000001.89158.001D0000.00000004.mdmp") Found string "indows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00000416.00000001.89158.001D0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00000416.00000001.89158.001D0000.00000004.mdmp") Found string "indows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00000416.00000001.89158.001D0000.00000004.mdmp") Found string "indows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00000416.00000001.89158.001D0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00000416.00000001.89158.001D0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00001368.00000001.89322.00320000.00000004.mdmp, 00000000-00001368.00000002.91245.00320000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe" (Indicator: "\Device\"; Source: "00000000-00003428.00000001.89674.00170000.00000004.mdmp") Found string "indows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00003428.00000001.89674.00170000.00000004.mdmp") Found string "indows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00003428.00000001.89674.00170000.00000004.mdmp") Found string "indows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00003428.00000001.89674.00170000.00000004.mdmp") Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00003428.00000001.89674.00170000.00000004.mdmp") Found string "indows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00003428.00000001.89674.00170000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00003428.00000001.89674.00170000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00003668.00000000.86679.000C0000.00000004.mdmp, 00000000-00003668.00000001.87614.000C0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00003668.00000001.87614.000C0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00003668.00000001.87614.000C0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00003668.00000001.87614.000C0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00003668.00000001.87614.000C0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00003668.00000001.87614.000C0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00003668.00000001.87614.000C0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Local\Temp\toolspub2.exe" (Indicator: "\Device\"; Source: "00000000-00003696.00000000.87243.00300000.00000040.mdmp, 00000000-00003696.00000001.87336.00300000.00000040.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00003756.00000002.91077.00260000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00003756.00000002.91077.00260000.00000004.mdmp")74:T71a,Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; File: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; File: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; File: "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; Source: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00003756.00000002.91077.00408000.00000002.mdmp") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; Source: "00000000-00003756.00000002.91077.00408000.00000002.mdmp") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; Source: "00000000-00003992.00000001.89667.71AAA000.00000004.mdmp, 00000000-00003992.00000002.91592.71B68000.00000002.mdmp") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00003992.00000001.89667.71AAA000.00000004.mdmp, 00000000-00003992.00000001.89667.71C09000.00000002.mdmp, 00000000-00003992.00000001.89667.71CA4000.00000002.mdmp, 00000000-00003992.00000002.91592.71B68000.00000002.mdmp") Found reference to API "?AllowedDeleteFileResult@ScenarioQosDelegatedSyncWrapper@QoS@@QAE_NJ@Z" (Indicator: "DeleteFile"; Source: "00000000-00003992.00000001.89667.71BA1000.00000020.mdmp") Found reference to API "?StartDeleteFile@ScenarioQosDelegatedSyncWrapper@QoS@@QAEXXZ" (Indicator: "DeleteFile"; Source: "00000000-00003992.00000001.89667.71BA1000.00000020.mdmp")75:T457,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00000416.00000001.89158.0B480000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00003428.00000001.89674.0B880000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00003992.00000001.89667.71C09000.00000002.mdmp, 00000000-00003992.00000002.91592.71B68000.00000002.mdmp") Found reference to API "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; Source: "00000000-00003992.00000001.89667.71C09000.00000002.mdmp") Found reference to API "RevertToSelf" (Indicator: "RevertToSelf"; Source: "00000000-00003992.00000001.89667.71C09000.00000002.mdmp") Found reference to API "ImpersonateLoggedOnUser" (Indicator: "ImpersonateLoggedOnUser"; Source: "00000000-00003992.00000001.89667.71C09000.00000002.mdmp") Found reference to API "GetSecurityDescriptorOwner" (Indicator: "GetSecurityDescriptorOwner"; Source: "00000000-00003992.00000001.89667.71C09000.00000002.mdmp")76:T61b,Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00003696.00000000.87243.0012C000.00000004.mdmp, 00000000-00003696.00000001.87336.0012C000.00000004.mdmp, 00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00003696.00000001.87336.00401000.00000020.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00003756.00000002.91077.00408000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00003992.00000001.89667.71AAA000.00000004.mdmp") Found reference to API "__crtTerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00003992.00000001.89667.71C09000.00000002.mdmp, 00000000-00003992.00000001.89667.71CA4000.00000002.mdmp, 00000000-00003992.00000002.91592.719E1000.00000020.mdmp, 00000000-00003992.00000002.91592.71B2A000.00000002.mdmp, 00000000-00003992.00000002.91592.71B68000.00000002.mdmp")77:Taa4,"f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "LDAPCLIENTINTEGRITY"; Value: "") "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEOLDHOSTRESOLUTIONORDER"; Value: "") "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEHOSTNAMEASALIAS"; Value: "") "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "IPV4LOOPBACKALTERNATIVE"; Value: "") "InstallSetup5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "LDAPCLIENTINTEGRITY"; Value: "") "InstallSetup5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEOLDHOSTRESOLUTIONORDER"; Value: "") "InstallSetup5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEHOSTNAMEASALIAS"; Value: "") "InstallSetup5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "IPV4LOOPBACKALTERNATIVE"; Value: "") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "")78:T112c,"f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0000000000") "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0100000000") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\483F7B2A"; Key: "SERVERS"; Value: "https://theupdatetime.org") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\483F7B2A"; Key: "UUID"; Value: "000000") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\483F7B2A"; Key: "FIRSTINSTALLDATE"; Value: "61DFA86A0000000000") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\483F7B2A"; Key: "SERVICEVERSION"; Value: "000000") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\483F7B2A"; Key: "PGDSE"; Value: "000000000000000000") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\483F7B2A"; Key: "SERVERSVERSION"; Value: "C30000000000000000") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\483F7B2A"; Key: "OSCAPTION"; Value: "Microsoft Windows 7 Professional") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\483F7B2A"; Key: "OSARCHITECTURE"; Value: "32-bit") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\483F7B2A"; Key: "ISADMIN"; Value: "3100000000") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\483F7B2A"; Key: "AV"; Value: "000000") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\483F7B2A"; Key: "PATCHTIME"; Value: "000000000000000000") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\483F7B2A"; Key: "CPU"; Value: "Intel(R) Xeon(R) Gold 6240R CPU @ 2.40GHz"), "31839b57a4f11171d6abc8bbc4451ee4.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\483F7B2A"; Key: "GPU"; Value: "VMware SVGA 3D"), "kos4.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\KOS4_RASAPI32"; Key: "ENABLEFILETRACING"; Value: "0000000000"), "kos4.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\KOS4_RASAPI32"; Key: "ENABLECONSOLETRACING"; Value: "0000000000"), "kos4.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\KOS4_RASAPI32"; Key: "FILETRACINGMASK"; Value: "0000FFFF00"), "kos4.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\KOS4_RASAPI32"; Key: "CONSOLETRACINGMASK"; Value: "0000FFFF00"), "kos4.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\KOS4_RASAPI32"; Key: "MAXFILESIZE"; Value: "0000100000"), "kos4.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\KOS4_RASAPI32"; Key: "FILEDIRECTORY"; Value: "%windir%\tracing"), "kos4.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\KOS4_RASMANCS"; Key: "ENABLEFILETRACING"; Value: "0000000000"), "kos4.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\KOS4_RASMANCS"; Key: "ENABLECONSOLETRACING"; Value: "0000000000"), "kos4.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\KOS4_RASMANCS"; Key: "FILETRACINGMASK"; Value: "0000FFFF00"), "kos4.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\KOS4_RASMANCS"; Key: "CONSOLETRACINGMASK"; Value: "0000FFFF00"), "kos4.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\KOS4_RASMANCS"; Key: "MAXFILESIZE"; Value: "0000100000"), "kos4.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\KOS4_RASMANCS"; Key: "FILEDIRECTORY"; Value: "%windir%\tracing"), "kos4.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\137\52C64B7E"; Key: "LANGUAGELIST"; Value: "en-US"), "Broom.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\BROOM"; Key: "KEY"; Value: "XZWEN-27MCX-Z9JD1-USCSW"), "Broom.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\BROOM"; Key: "DATE"; Value: "400CD6E40B99E64000")79:T457,"f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini" "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" reads file "C:\Users\%OSUSER%\Searches\desktop.ini" "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" reads file "C:\Users\%OSUSER%\Videos\desktop.ini" "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" reads file "C:\Users\%OSUSER%\Pictures\desktop.ini" "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" reads file "C:\Users\%OSUSER%\Contacts\desktop.ini" "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" reads file "C:\Users\%OSUSER%\Favorites\desktop.ini" "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" reads file "C:\Users\%OSUSER%\Music\desktop.ini" "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" reads file "C:\Users\%OSUSER%\Downloads\desktop.ini" "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" reads file "C:\Users\%OSUSER%\Documents\desktop.ini"7a:Ta54,"f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" wrote 50448 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\InstallSetup5.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" wrote 59392 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\toolspub2.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" wrote 18832 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\kos4.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe" wrote 42264 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\latestX.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "InstallSetup5.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\Broom.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ...7b:T52b,Found string "\\.\root\cimv2" (Indicator: "root\cimv2"; in Source: "00000000-00000416.00000001.89158.001D0000.00000004.mdmp, 00000000-00000416.00000001.89158.00238000.00000004.mdmp") Found string "WbemScripting.SWbemLocator" (Indicator: "wbemscripting."; in Source: "00000000-00000416.00000001.89158.001D0000.00000004.mdmp, 00000000-00000416.00000001.89158.0B480000.00000004.mdmp") Found string "root\cimv2" (Indicator: "root\cimv2"; in Source: "00000000-00000416.00000001.89158.001D0000.00000004.mdmp, 00000000-00000416.00000001.89158.00238000.00000004.mdmp") Found string "\\.\root\cimv2" (Indicator: "root\cimv2"; in Source: "00000000-00003428.00000001.89674.00170000.00000004.mdmp") Found string "WbemScripting.SWbemLocator" (Indicator: "wbemscripting."; in Source: "00000000-00003428.00000001.89674.00170000.00000004.mdmp, 00000000-00003428.00000001.89674.0B880000.00000004.mdmp") Found string "root\cimv2" (Indicator: "root\cimv2"; in Source: "00000000-00003428.00000001.89674.00170000.00000004.mdmp, 00000000-00003428.00000001.89674.001F1000.00000004.mdmp") Found string "WmiPrvSE.exe" (Indicator: "wmiprvse.exe"; in Source: "00000000-00003428.00000001.89674.0B880000.00000004.mdmp") Found string "wmiprvse.exe" (Indicator: "wmiprvse.exe"; in Source: "00000000-00003428.00000001.89674.0B880000.00000004.mdmp")7c:T418,RegCreateKeyExW RegDeleteKeyW GetUserNameW RegOpenKeyExW RegEnumKeyExW RegCloseKey OpenProcessToken RegDeleteValueW CreateDirectoryW GetFileSize LoadLibraryExW WinExec ExitThread GetModuleHandleW IsDebuggerPresent GetModuleFileNameW CreateThread GetProcAddress GetDriveTypeW FindNextFileW VirtualProtect VirtualAllocEx GetSystemInfo CreateProcessW GetVersionExW WriteFile GetTickCount ReadProcessMemory GetComputerNameW VirtualAlloc GetFileAttributesW LoadLibraryW CreateFileMappingW Sleep LockResource UnhandledExceptionFilter FindFirstFileW GetStartupInfoW DeleteFileW GetCommandLineW CreateFileW FindResourceW OpenProcess WriteProcessMemory LoadLibraryA MapViewOfFile ShellExecuteExW ShellExecuteW GetCursorPos SetWindowsHookExW GetLastActivePopup GetClipboardData FindWindowW SetKeyboardState FindWindowExW GetWindowThreadProcessId EnumPrintersW GetStartupInfoA TerminateProcess GetModuleHandleA DeleteFileA CopyFileW GetTempPathW RegEnumKeyW GetSystemDirectoryW GetTempFileNameW7d:Tda2,"is-G6U9O.tmp" renamed original file"C:\Program Files (x86)\BBuster\is-U88LC.tmp" to "%PROGRAMFILES%\(x86)\BBuster\unins000.exe" "is-G6U9O.tmp" renamed original file"C:\Program Files (x86)\BBuster\Lang\is-HQK4G.tmp" to "%PROGRAMFILES%\(x86)\BBuster\Lang\Afrikaans.dll" "is-G6U9O.tmp" renamed original file"C:\Program Files (x86)\BBuster\Lang\is-TDCVD.tmp" to "%PROGRAMFILES%\(x86)\BBuster\Lang\Brasil.dll" "is-G6U9O.tmp" renamed original file"C:\Program Files (x86)\BBuster\Lang\is-ALEI7.tmp" to "%PROGRAMFILES%\(x86)\BBuster\Lang\Bulgarian.dll" "is-G6U9O.tmp" renamed original file"C:\Program Files (x86)\BBuster\Lang\is-34PDF.tmp" to "%PROGRAMFILES%\(x86)\BBuster\Lang\Cesky.dll" "is-G6U9O.tmp" renamed original file"C:\Program Files (x86)\BBuster\Lang\is-0Q681.tmp" to "%PROGRAMFILES%\(x86)\BBuster\Lang\Chinese_Simp.dll" "is-G6U9O.tmp" renamed original file"C:\Program Files (x86)\BBuster\Lang\is-IAV81.tmp" to "%PROGRAMFILES%\(x86)\BBuster\Lang\Dansk.dll" "is-G6U9O.tmp" renamed original file"C:\Program Files (x86)\BBuster\Lang\is-3V0G9.tmp" to "%PROGRAMFILES%\(x86)\BBuster\Lang\Deutsch.dll" "is-G6U9O.tmp" renamed original file"C:\Program Files (x86)\BBuster\Lang\is-EK42P.tmp" to "%PROGRAMFILES%\(x86)\BBuster\Lang\Espanol.dll" "is-G6U9O.tmp" renamed original file"C:\Program Files (x86)\BBuster\Lang\is-R3GDI.tmp" to "%PROGRAMFILES%\(x86)\BBuster\Lang\Francais.dll" "is-G6U9O.tmp" renamed original file"C:\Program Files (x86)\BBuster\Lang\is-Q3QAN.tmp" to "%PROGRAMFILES%\(x86)\BBuster\Lang\Greek.dll" "is-G6U9O.tmp" renamed original file"C:\Program Files (x86)\BBuster\Lang\is-VLH0N.tmp" to "%PROGRAMFILES%\(x86)\BBuster\Lang\Hindi.dll" "is-G6U9O.tmp" renamed original file"C:\Program Files (x86)\BBuster\Lang\is-TB441.tmp" to "%PROGRAMFILES%\(x86)\BBuster\Lang\Italiano.dll" "is-G6U9O.tmp" renamed original file"C:\Program Files (x86)\BBuster\Lang\is-65JUR.tmp" to "%PROGRAMFILES%\(x86)\BBuster\Lang\Magyar.dll" "is-G6U9O.tmp" renamed original file"C:\Program Files (x86)\BBuster\Lang\is-N4SO7.tmp" to "%PROGRAMFILES%\(x86)\BBuster\Lang\Nederlands.dll" "is-G6U9O.tmp" renamed original file"C:\Program Files (x86)\BBuster\Lang\is-52GNA.tmp" to "%PROGRAMFILES%\(x86)\BBuster\Lang\Polski.dll" "is-G6U9O.tmp" renamed original file"C:\Program Files (x86)\BBuster\Lang\is-K54K0.tmp" to "%PROGRAMFILES%\(x86)\BBuster\Lang\Portugues.dll" "is-G6U9O.tmp" renamed original file"C:\Program Files (x86)\BBuster\Lang\is-K409M.tmp" to "%PROGRAMFILES%\(x86)\BBuster\Lang\Romana.dll" "is-G6U9O.tmp" renamed original file"C:\Program Files (x86)\BBuster\Lang\is-T5BLA.tmp" to "%PROGRAMFILES%\(x86)\BBuster\Lang\Slovenian.dll" "is-G6U9O.tmp" renamed original file"C:\Program Files (x86)\BBuster\Lang\is-CMHBP.tmp" to "%PROGRAMFILES%\(x86)\BBuster\Lang\Suomi_Finnish.dll" "is-G6U9O.tmp" renamed original file"C:\Program Files (x86)\BBuster\Lang\is-J4M9D.tmp" to "%PROGRAMFILES%\(x86)\BBuster\Lang\Turkish.dll" "is-G6U9O.tmp" renamed original file"C:\Program Files (x86)\BBuster\Lang\is-OQ0VO.tmp" to "%PROGRAMFILES%\(x86)\BBuster\Lang\Ukranian.dll" "is-G6U9O.tmp" renamed original file"C:\Program Files (x86)\BBuster\Lang\is-8NOQO.tmp" to "%PROGRAMFILES%\(x86)\BBuster\Lang\Vietnamese.dll" "is-G6U9O.tmp" renamed original file"C:\Program Files (x86)\BBuster\Help\is-9VBMS.tmp" to "%PROGRAMFILES%\(x86)\BBuster\Help\IsoBuster.chm" "is-G6U9O.tmp" renamed original file"C:\Program Files (x86)\BBuster\Plugins\is-E08L8.tmp" to "%PROGRAMFILES%\(x86)\BBuster\Plugins\libwim-15.dll"7e:T12ec,"powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIatwYJKoZIhvcNAQcCoIIaqDCCGqQCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNRAgEAAgEAAgEAAgEAAgEAMCEwCQYFKw4DAhoFAAQUvSVTZwxcxUqDUoxiH97RfI559SygghV6MIIEuzCCA6OgAwIBAgITMwAAAF3JyvZpIzdoUAAAAAAAXTANBgkqhk" "cchString": "9410" "dwFlags": "1" "pbBinary": "30821ab706092a864886f70d010702a0821aa830821aa4020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414bd2553670c5cc54a83528c621fded17c8e79f52ca082157a308204bb308203a3a0030201020213330000005dc9caf6692337685000000000005d300d06092a864886f70d01010505003077310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f66742054696d652d5374616d7020504341301e170d3134303532333137313331375a170d3135303832333137313331375a3081ab310b3009060355040613025553310b30090603550408130257413110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f505231273025060355040b131e6e436970686572204453452045534e3a374432452d333738322d42304637312530230603550403131c4d6963726f736f66742054696d652d5374616d70205365727669636530820122300d06092a864886f70d01010105000382010f003082010a0282010100abba7a2faf541f74f40d73b2e00b8558ecababbf4700fe8d3731f21c933ea6bace1be6514068d48018d758635d033736fb835870dec43336b05f077f7dfdf758ab5a976e45ceb8f11b3d52cfa53d05439ba0b13472d3eff331bc2e688e2a350b2e74b0efe42b557265958f67f4a3c8ef0311a7dc0b3ca16c0eff618c4292e456c391b18ff6aed7c1e3e8a81901a21760bf43987a2a5a6a34c8920d3fe05c1db77fb05a1dbdcc6c6a11431e020d5b42e96d4b630b39fb52a3ec7a26d2a2304763d2f8ea15d8692e9e26e94e4f1cb3d2e260263f6e5d9214905e346d78047c52519b0b0176eb41005953cedb8dd649856c823b7ec4e98746b2393cf15ed86f72ff0203010001a382010930820105301d0603551d0e04160414d754e615d9d35dca24d50118f07864997b684c33301f0603551d230418301680142334f8d95246700aed40fb76fbb32bb0c335b30f30540603551d1f044d304b3049a047a0458643687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963726f736f667454696d655374616d705043412e63726c305806082b06010505070101044c304a304806082b06010505073002863c687474703a2f2f7777772e6d6963726f" "pcbBinary": "bb1a0000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIatwYJKoZIhvcNAQcCoIIaqDCCGqQCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNR" "cchString": "9410" "dwFlags": "1" "pbBinary": "30821ab706092a864886f70d010702a0821aa830821aa4020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414bd2553670c5cc54a83528c621fded17c8e79f52ca082157a308204bb308203a3a0030201020213330000005dc9caf6692337685000000000005d300d06092a864886f70d01010505003077310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f66742054696d652d5374616d7020504341301e170d3134303532333137313331375a170d3135303832333137313331375a3081ab310b3009060355040613025553310b30090603550408130257413110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f505231273025060355040b131e6e436970686572204453452045534e3a374432452d333738322d42304637312530230603550403131c4d6963726f736f66742054696d652d5374616d70205365727669636530820122300d06092a864886f70d01010105000382010f003082010a0282010100abba7a2faf541f74f40d73b2e00b8558ecababbf4700fe8d3731f21c933ea6bace1be6514068d48018d758635d033736fb835870dec43336b05f077f7dfdf758ab5a976e45ceb8f11b3d52cfa53d05439ba0b13472d3eff331bc2e688e2a350b2e74b0efe42b557265958f67f4a3c8ef0311a7dc0b3ca16c0eff618c4292e456c391b18ff6aed7c1e3e8a81901a21760bf43987a2a5a6a34c8920d3fe05c1db77fb05a1dbdcc6c6a11431e020d5b42e96d4b630b39fb52a3ec7a26d2a2304763d2f8ea15d8692e9e26e94e4f1cb3d2e260263f6e5d9214905e346d78047c52519b0b0176eb41005953cedb8dd649856c823b7ec4e98746b2393cf15ed86f72ff0203010001a382010930820105301d0603551d0e04160414d754e615d9d35dca24d50118f07864997b684c33301f0603551d230418301680142334f8d95246700aed40fb76fbb32bb0c335b30f30540603551d1f044d304b3049a047a0458643687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963726f736f667454696d655374616d705043412e63726c305806082b06010505070101044c304a304806082b06010505073002863c687474703a2f2f7777772e6d6963726f" "pcbBinary": "bb1a0000" "pdwFlags": "01000000"}7f:T4af,Found string "nslookup: WSAStartup:%0" (Indicator: "nslookup"; Source: "00000000-00001956.00000001.69447.05880000.00000002.mdmp") Found string "nslookup [-opt ...] # interactive mode using default server" (Indicator: "nslookup"; Source: "00000000-00001956.00000001.69447.05880000.00000002.mdmp") Found string "nslookup [-opt ...] - server # interactive mode using 'server'" (Indicator: "nslookup"; Source: "00000000-00001956.00000001.69447.05880000.00000002.mdmp") Found string "nslookup [-opt ...] host # just look up 'host' using default server" (Indicator: "nslookup"; Source: "00000000-00001956.00000001.69447.05880000.00000002.mdmp") Found string "nslookup [-opt ...] host server # just look up 'host' using 'server'" (Indicator: "nslookup"; Source: "00000000-00001956.00000001.69447.05880000.00000002.mdmp") Found string "nslookup" (Indicator: "nslookup"; Source: "00000000-00001956.00000001.69447.05880000.00000002.mdmp") Found string "nslookup.exe" (Indicator: "nslookup"; Source: "00000000-00001956.00000001.69447.05880000.00000002.mdmp") Found string "nslookup.exe.mui" (Indicator: "nslookup"; Source: "00000000-00001956.00000001.69447.05880000.00000002.mdmp")80:T96d,"kos4.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "kos4.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "kos4.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "kos4.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "kos4.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "kos4.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "kos4.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "kos4.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "kos4.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "kos4.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "kos4.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "kos4.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "kos4.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "kos4.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "kos4.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "kos4.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "kos4.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "kos4.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "kos4.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "kos4.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "kos4.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "kos4.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "") "kos4.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS"; Key: "") "kos4.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS"; Key: "") "kos4.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "")81:T10b4,"is-G6U9O.tmp" called "MoveFileA" with parameter %PROGRAMFILES%\(x86)\BBuster\is-U88LC.tmp & %PROGRAMFILES%\(x86)\BBuster\unins000.exe (UID: 00000000-00006016) "is-G6U9O.tmp" called "MoveFileA" with parameter %PROGRAMFILES%\(x86)\BBuster\Lang\is-HQK4G.tmp & %PROGRAMFILES%\(x86)\BBuster\Lang\Afrikaans.dll (UID: 00000000-00006016) "is-G6U9O.tmp" called "MoveFileA" with parameter %PROGRAMFILES%\(x86)\BBuster\Lang\is-TDCVD.tmp & %PROGRAMFILES%\(x86)\BBuster\Lang\Brasil.dll (UID: 00000000-00006016) "is-G6U9O.tmp" called "MoveFileA" with parameter %PROGRAMFILES%\(x86)\BBuster\Lang\is-ALEI7.tmp & %PROGRAMFILES%\(x86)\BBuster\Lang\Bulgarian.dll (UID: 00000000-00006016) "is-G6U9O.tmp" called "MoveFileA" with parameter %PROGRAMFILES%\(x86)\BBuster\Lang\is-34PDF.tmp & %PROGRAMFILES%\(x86)\BBuster\Lang\Cesky.dll (UID: 00000000-00006016) "is-G6U9O.tmp" called "MoveFileA" with parameter %PROGRAMFILES%\(x86)\BBuster\Lang\is-0Q681.tmp & %PROGRAMFILES%\(x86)\BBuster\Lang\Chinese_Simp.dll (UID: 00000000-00006016) "is-G6U9O.tmp" called "MoveFileA" with parameter %PROGRAMFILES%\(x86)\BBuster\Lang\is-IAV81.tmp & %PROGRAMFILES%\(x86)\BBuster\Lang\Dansk.dll (UID: 00000000-00006016) "is-G6U9O.tmp" called "MoveFileA" with parameter %PROGRAMFILES%\(x86)\BBuster\Lang\is-3V0G9.tmp & %PROGRAMFILES%\(x86)\BBuster\Lang\Deutsch.dll (UID: 00000000-00006016) "is-G6U9O.tmp" called "MoveFileA" with parameter %PROGRAMFILES%\(x86)\BBuster\Lang\is-EK42P.tmp & %PROGRAMFILES%\(x86)\BBuster\Lang\Espanol.dll (UID: 00000000-00006016) "is-G6U9O.tmp" called "MoveFileA" with parameter %PROGRAMFILES%\(x86)\BBuster\Lang\is-R3GDI.tmp & %PROGRAMFILES%\(x86)\BBuster\Lang\Francais.dll (UID: 00000000-00006016) "is-G6U9O.tmp" called "MoveFileA" with parameter %PROGRAMFILES%\(x86)\BBuster\Lang\is-Q3QAN.tmp & %PROGRAMFILES%\(x86)\BBuster\Lang\Greek.dll (UID: 00000000-00006016) "is-G6U9O.tmp" called "MoveFileA" with parameter %PROGRAMFILES%\(x86)\BBuster\Lang\is-VLH0N.tmp & %PROGRAMFILES%\(x86)\BBuster\Lang\Hindi.dll (UID: 00000000-00006016) "is-G6U9O.tmp" called "MoveFileA" with parameter %PROGRAMFILES%\(x86)\BBuster\Lang\is-TB441.tmp & %PROGRAMFILES%\(x86)\BBuster\Lang\Italiano.dll (UID: 00000000-00006016) "is-G6U9O.tmp" called "MoveFileA" with parameter %PROGRAMFILES%\(x86)\BBuster\Lang\is-65JUR.tmp & %PROGRAMFILES%\(x86)\BBuster\Lang\Magyar.dll (UID: 00000000-00006016) "is-G6U9O.tmp" called "MoveFileA" with parameter %PROGRAMFILES%\(x86)\BBuster\Lang\is-N4SO7.tmp & %PROGRAMFILES%\(x86)\BBuster\Lang\Nederlands.dll (UID: 00000000-00006016) "is-G6U9O.tmp" called "MoveFileA" with parameter %PROGRAMFILES%\(x86)\BBuster\Lang\is-52GNA.tmp & %PROGRAMFILES%\(x86)\BBuster\Lang\Polski.dll (UID: 00000000-00006016) "is-G6U9O.tmp" called "MoveFileA" with parameter %PROGRAMFILES%\(x86)\BBuster\Lang\is-K54K0.tmp & %PROGRAMFILES%\(x86)\BBuster\Lang\Portugues.dll (UID: 00000000-00006016) "is-G6U9O.tmp" called "MoveFileA" with parameter %PROGRAMFILES%\(x86)\BBuster\Lang\is-K409M.tmp & %PROGRAMFILES%\(x86)\BBuster\Lang\Romana.dll (UID: 00000000-00006016) "is-G6U9O.tmp" called "MoveFileA" with parameter %PROGRAMFILES%\(x86)\BBuster\Lang\is-T5BLA.tmp & %PROGRAMFILES%\(x86)\BBuster\Lang\Slovenian.dll (UID: 00000000-00006016) "is-G6U9O.tmp" called "MoveFileA" with parameter %PROGRAMFILES%\(x86)\BBuster\Lang\is-CMHBP.tmp & %PROGRAMFILES%\(x86)\BBuster\Lang\Suomi_Finnish.dll (UID: 00000000-00006016) "is-G6U9O.tmp" called "MoveFileA" with parameter %PROGRAMFILES%\(x86)\BBuster\Lang\is-J4M9D.tmp & %PROGRAMFILES%\(x86)\BBuster\Lang\Turkish.dll (UID: 00000000-00006016) "is-G6U9O.tmp" called "MoveFileA" with parameter %PROGRAMFILES%\(x86)\BBuster\Lang\is-OQ0VO.tmp & %PROGRAMFILES%\(x86)\BBuster\Lang\Ukranian.dll (UID: 00000000-00006016) "is-G6U9O.tmp" called "MoveFileA" with parameter %PROGRAMFILES%\(x86)\BBuster\Lang\is-8NOQO.tmp & %PROGRAMFILES%\(x86)\BBuster\Lang\Vietnamese.dll (UID: 00000000-00006016) "is-G6U9O.tmp" called "MoveFileA" with parameter %PROGRAMFILES%\(x86)\BBuster\Online\is-RV3PT.tmp & %PROGRAMFILES%\(x86)\BBuster\Online\IsoBuster Online.html (UID: 00000000-00006016) "is-G6U9O.tmp" called "MoveFileA" with parameter %PROGRAMFILES%\(x86)\BBuster\Online\is-U15F1.tmp & %PROGRAMFILES%\(x86)\BBuster\Online\Order Now.html (UID: 00000000-00006016)82:T1338,Observed system executable string:"1,"fusion","GAC",01,"WinRT","NotApp",13,"System Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll",03,"System.Core Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll",03,"System.Configuration Version=4.0.0.0 Culture=neutral PublicKeyToken=b03f5f7f11d50a3a","C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll",03,"System.Xml Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll",0" [Source: kos4.exe.log] Observed system executable string:"1,"fusion","GAC",01,"WinRT","NotApp",13,"System Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll",03,"System.Core Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll",0" [Source: SecuriteInfo.com.Trojan.MulDropNET.43.6599.26850.exe.log] Observed system executable string:"3,"System Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll",0" [Source: SecuriteInfo.com.Trojan.MulDropNET.43.6599.26850.exe.log] Observed system executable string:"3,"System.Core Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll",0" [Source: SecuriteInfo.com.Trojan.MulDropNET.43.6599.26850.exe.log] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00007704-00000C25-36467732] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00007704-00000C25-36722874] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00007704-00000C25-36785975] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00007704-00000C25-36833967] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00007704-00000C25-36924478] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00007704-00000C25-36959194] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00007704-00000C25-36993024] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00007704-00000C25-37054717] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00007704-00000C25-37159949] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00007704-00000C25-37194574] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00007704-00000C25-37243794] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00007704-00000C25-37257275] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll" [Source: 00000000-00007704-00000C25-37272706] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00007704-00000C25-37331685] Observed system executable string:"%WINDIR%\system32\UXTHEME.dll" [Source: 00000000-00001876-00000C25-39160391] Observed system executable string:"%WINDIR%\system32\USERENV.dll" [Source: 00000000-00001876-00000C25-39176662] Observed system executable string:"%WINDIR%\system32\SETUPAPI.dll" [Source: 00000000-00001876-00000C25-39191555] Observed system executable string:"%WINDIR%\system32\APPHELP.dll" [Source: 00000000-00001876-00000C25-39406597] Observed system executable string:"%WINDIR%\system32\PROPSYS.dll" [Source: 00000000-00001876-00000C25-39422586] Observed system executable string:"%WINDIR%\system32\DWMAPI.dll" [Source: 00000000-00001876-00000C25-39470368] Observed system executable string:"%WINDIR%\system32\CRYPTBASE.dll" [Source: 00000000-00001876-00000C25-39484014]83:Tf6a,"is-FVO5J.tmp" has type "data" - Location: [%PROGRAMFILES%\(x86)\BBuster\is-FVO5J.tmp] "is-9VBMS.tmp" has type "MS Windows HtmlHelp Data" - Location: [%PROGRAMFILES%\(x86)\BBuster\Help\is-9VBMS.tmp] "is-E08L8.tmp" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows" - Location: [%PROGRAMFILES%\(x86)\BBuster\Plugins\is-E08L8.tmp] "is-U88LC.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows" - Location: [%PROGRAMFILES%\(x86)\BBuster\is-U88LC.tmp] "is-G6U9O.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows" - Location: [%TEMP%\is-QGNRO.tmp\is-G6U9O.tmp] "is-DTE8N.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" - Location: [%PROGRAMFILES%\(x86)\BBuster\Plugins\is-DTE8N.tmp] "is-EK42P.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB) for MS Windows" - Location: [%PROGRAMFILES%\(x86)\BBuster\Lang\is-EK42P.tmp] "is-R3GDI.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB) for MS Windows" - Location: [%PROGRAMFILES%\(x86)\BBuster\Lang\is-R3GDI.tmp] "is-TB441.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB) for MS Windows" - Location: [%PROGRAMFILES%\(x86)\BBuster\Lang\is-TB441.tmp] "is-Q3QAN.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB) for MS Windows" - Location: [%PROGRAMFILES%\(x86)\BBuster\Lang\is-Q3QAN.tmp] "is-3V0G9.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB) for MS Windows" - Location: [%PROGRAMFILES%\(x86)\BBuster\Lang\is-3V0G9.tmp] "is-TDCVD.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB) for MS Windows" - Location: [%PROGRAMFILES%\(x86)\BBuster\Lang\is-TDCVD.tmp] "is-N4SO7.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB) for MS Windows" - Location: [%PROGRAMFILES%\(x86)\BBuster\Lang\is-N4SO7.tmp] "is-K54K0.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB) for MS Windows" - Location: [%PROGRAMFILES%\(x86)\BBuster\Lang\is-K54K0.tmp] "is-K409M.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB) for MS Windows" - Location: [%PROGRAMFILES%\(x86)\BBuster\Lang\is-K409M.tmp] "is-52GNA.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB) for MS Windows" - Location: [%PROGRAMFILES%\(x86)\BBuster\Lang\is-52GNA.tmp] "is-65JUR.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB) for MS Windows" - Location: [%PROGRAMFILES%\(x86)\BBuster\Lang\is-65JUR.tmp] "is-ALEI7.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB) for MS Windows" - Location: [%PROGRAMFILES%\(x86)\BBuster\Lang\is-ALEI7.tmp] "is-J4M9D.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB) for MS Windows" - Location: [%PROGRAMFILES%\(x86)\BBuster\Lang\is-J4M9D.tmp] "is-CMHBP.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB) for MS Windows" - Location: [%PROGRAMFILES%\(x86)\BBuster\Lang\is-CMHBP.tmp] "is-T5BLA.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB) for MS Windows" - Location: [%PROGRAMFILES%\(x86)\BBuster\Lang\is-T5BLA.tmp] "is-8NOQO.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB) for MS Windows" "is-HQK4G.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB) for MS Windows" - Location: [%PROGRAMFILES%\(x86)\BBuster\Lang\is-HQK4G.tmp] "is-OQ0VO.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB) for MS Windows" - Location: [%PROGRAMFILES%\(x86)\BBuster\Lang\is-OQ0VO.tmp] "is-VLH0N.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB) for MS Windows" - Location: [%PROGRAMFILES%\(x86)\BBuster\Lang\is-VLH0N.tmp]84:T486,Observed import api "WNetCloseEnum" which can "ends a network resource enumeration" [Source: is-U88LC.tmp] Observed import api "WNetEnumResource" which can "continues an enumeration of network resources" [Source: is-U88LC.tmp] Observed import api "WNetGetUniversalName" which can "takes a drive-based path for a network resource and returns an information structure that contains a more universal form of the name" [Source: is-U88LC.tmp] Observed import api "WNetOpenEnum" which can "starts an enumeration of network resources or existing connections." [Source: is-U88LC.tmp] Observed import api "WNetCloseEnum" which can "ends a network resource enumeration" [Source: is-G6U9O.tmp] Observed import api "WNetEnumResource" which can "continues an enumeration of network resources" [Source: is-G6U9O.tmp] Observed import api "WNetGetUniversalName" which can "takes a drive-based path for a network resource and returns an information structure that contains a more universal form of the name" [Source: is-G6U9O.tmp] Observed import api "WNetOpenEnum" which can "starts an enumeration of network resources or existing connections." [Source: is-G6U9O.tmp]85:Td2c,"SecuriteInfo.com.Trojan.MulDropNET.43.6599.26850.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00007704) "SecuriteInfo.com.Trojan.MulDropNET.43.6599.26850.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00007704) "SecuriteInfo.com.Trojan.MulDropNET.43.6599.26850.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00007704) "SecuriteInfo.com.Trojan.MulDropNET.43.6599.26850.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00007704) "SecuriteInfo.com.Trojan.MulDropNET.43.6599.26850.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00007704) "SecuriteInfo.com.Trojan.MulDropNET.43.6599.26850.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00007704) "SecuriteInfo.com.Trojan.MulDropNET.43.6599.26850.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00007704) "SecuriteInfo.com.Trojan.MulDropNET.43.6599.26850.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00007704) "SecuriteInfo.com.Trojan.MulDropNET.43.6599.26850.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00007704) "SecuriteInfo.com.Trojan.MulDropNET.43.6599.26850.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00007704) "SecuriteInfo.com.Trojan.MulDropNET.43.6599.26850.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00007704) "SecuriteInfo.com.Trojan.MulDropNET.43.6599.26850.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00007704) "SecuriteInfo.com.Trojan.MulDropNET.43.6599.26850.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00007704) "SecuriteInfo.com.Trojan.MulDropNET.43.6599.26850.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00007704) "SecuriteInfo.com.Trojan.MulDropNET.43.6599.26850.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00007704) "SecuriteInfo.com.Trojan.MulDropNET.43.6599.26850.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00007704) "SecuriteInfo.com.Trojan.MulDropNET.43.6599.26850.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00007704) "SecuriteInfo.com.Trojan.MulDropNET.43.6599.26850.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00007704) "SecuriteInfo.com.Trojan.MulDropNET.43.6599.26850.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00007704) "SecuriteInfo.com.Trojan.MulDropNET.43.6599.26850.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00007704) "SecuriteInfo.com.Trojan.MulDropNET.43.6599.26850.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00007704) "SecuriteInfo.com.Trojan.MulDropNET.43.6599.26850.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00007704) "SecuriteInfo.com.Trojan.MulDropNET.43.6599.26850.exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00007704) "SecuriteInfo.com.Trojan.MulDropNET.43.6599.26850.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00007704)86:T410,file/memory contains long string with (Indicator: "BitBlt"; File: "is-FVO5J.tmp") file/memory contains long string with (Indicator: "CreateCompatibleDC"; File: "is-FVO5J.tmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00001876.00000001.69287.00408000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00001956.00000000.67528.0081E000.00000004.mdmp, 00000000-00001956.00000002.71366.0081D000.00000004.mdmp") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; Source: "00000000-00001956.00000000.67528.0081E000.00000004.mdmp, 00000000-00001956.00000002.71366.0081D000.00000004.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00001956.00000000.67528.0081E000.00000004.mdmp, 00000000-00001956.00000002.71366.0081D000.00000004.mdmp") Found reference to API "GetDCEx" (Indicator: "GetDC"; Source: "00000000-00001956.00000000.67528.0081E000.00000004.mdmp, 00000000-00001956.00000002.71366.0081D000.00000004.mdmp")87:T42c,file/memory contains long string with (Indicator: "RegQueryValue"; File: "is-FVO5J.tmp") file/memory contains long string with (Indicator: "RegOpenKey"; File: "is-FVO5J.tmp") file/memory contains long string with (Indicator: "RegEnumKey"; File: "is-FVO5J.tmp") file/memory contains long string with (Indicator: "RegEnumValue"; File: "is-FVO5J.tmp") file/memory contains long string with (Indicator: "RegQueryInfoKey"; File: "is-FVO5J.tmp") file/memory contains long string with (Indicator: "RegSaveKey"; File: "is-FVO5J.tmp") Found reference to API "RegEnumValueW" (Indicator: "RegEnumValue"; Source: "00000000-00001876.00000001.69287.00408000.00000002.mdmp") Found reference to API "RegEnumKeyW" (Indicator: "RegEnumKey"; Source: "00000000-00001876.00000001.69287.00408000.00000002.mdmp") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; Source: "00000000-00001876.00000001.69287.00408000.00000002.mdmp") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; Source: "00000000-00001876.00000001.69287.00408000.00000002.mdmp")88:T592,Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: is-U88LC.tmp] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: is-U88LC.tmp] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: is-U88LC.tmp] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: is-U88LC.tmp] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: is-U88LC.tmp] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: is-G6U9O.tmp] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: is-G6U9O.tmp] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: is-G6U9O.tmp] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: is-G6U9O.tmp] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: is-G6U9O.tmp]89:T477,"is-G6U9O.tmp" called "FileTimeToLocalFileTime" with parameter 0034d1f5ae98d901 & 005c72497498d901 (UID: 00000000-00006016) "is-G6U9O.tmp" called "FileTimeToSystemTime" (UID: 00000000-00006016) "is-G6U9O.tmp" called "FileTimeToLocalFileTime" (UID: 00000000-00006016) "is-G6U9O.tmp" called "FileTimeToLocalFileTime" with parameter 00980f9a2798d901 & 00c0b0edec97d901 (UID: 00000000-00006016) "is-G6U9O.tmp" called "FileTimeToLocalFileTime" with parameter 00070c65d595d901 & 002fadb89a95d901 (UID: 00000000-00006016) "is-G6U9O.tmp" called "FileTimeToLocalFileTime" with parameter 0057a4b47699d901 & 007f45083c99d901 (UID: 00000000-00006016) "is-G6U9O.tmp" called "FileTimeToLocalFileTime" with parameter 0084cfceddccd101 & 00ac7022a3ccd101 (UID: 00000000-00006016) "is-G6U9O.tmp" called "FileTimeToLocalFileTime" with parameter 0094c00352c6d801 & 00bc615717c6d801 (UID: 00000000-00006016) "is-G6U9O.tmp" called "FileTimeToLocalFileTime" with parameter 0069c9727dbed601 & 00916ac642bed601 (UID: 00000000-00006016) "is-G6U9O.tmp" called "FileTimeToLocalFileTime" with parameter 0035419654b7d601 & 005de2e919b7d601 (UID: 00000000-00006016)8a:T7f0,"SecuriteInfo.com.Trojan.MulDropNET.43.6599.26850.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\InstallSetup5.exe" (Handle: 1516) "SecuriteInfo.com.Trojan.MulDropNET.43.6599.26850.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\toolspub2.exe" (Handle: 1552) "SecuriteInfo.com.Trojan.MulDropNET.43.6599.26850.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe" (Handle: 1148) "toolspub2.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\toolspub2.exe" (Handle: 408) "toolspub2.exe" wrote 512 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\toolspub2.exe" (Handle: 408) "toolspub2.exe" wrote 29184 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\toolspub2.exe" (Handle: 408) "31839b57a4f11171d6abc8bbc4451ee4.exe" wrote 4 bytes to a remote process "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" (Handle: 1016) "kos4.exe" wrote 4024 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\LzmwAqmV.exe" (Handle: 2568) "kos4.exe" wrote 8 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\LzmwAqmV.exe" (Handle: 2568) "kos4.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\LzmwAqmV.exe" (Handle: 2568) "LzmwAqmV.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\is-QGNRO.tmp\is-G6U9O.tmp" (Handle: 584) "is-G6U9O.tmp" wrote 4 bytes to a remote process "C:\Windows\SysWOW64\net.exe" (Handle: 1180) "is-G6U9O.tmp" wrote 4 bytes to a remote process "C:\Program Files (x86)\BBuster\BBuster.exe" (Handle: 1176) "is-G6U9O.tmp" wrote 4 bytes to a remote process "C:\Program Files (x86)\BBuster\BBuster.exe" (Handle: 1156) "net.exe" wrote 4 bytes to a remote process "C:\Windows\SysWOW64\net1.exe" (Handle: 464) "31839b57a4f11171d6abc8bbc4451ee4.exe" wrote 4 bytes to a remote process "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" (Handle: 712)8b:T9d4,Spawned process "SecuriteInfo.com.Trojan.MulDropNET.43.6599.26850.exe" (UID: 00000000-00007704) Spawned process "InstallSetup5.exe" (UID: 00000000-00001876) Spawned process "toolspub2.exe" (UID: 00000000-00005224) Spawned process "31839b57a4f11171d6abc8bbc4451ee4.exe" (UID: 00000000-00007544) Spawned process "kos4.exe" (UID: 00000000-00001168) Spawned process "Broom.exe" (UID: 00000000-00001956) Spawned process "latestX.exe" (UID: 00000000-00006412) Spawned process "toolspub2.exe" (UID: 00000000-00007528) Spawned process "LzmwAqmV.exe" (UID: 00000000-00002440) Spawned process "is-G6U9O.tmp" with commandline "/SL4 $60310 "%TEMP%\\LzmwAqmV.exe" 4751447 79360" (UID: 00000000-00006016) Spawned process "net.exe" with commandline "helpmsg 3" (UID: 00000000-00007732) Spawned process "BBuster.exe" with commandline "-i" (UID: 00000000-00007960) Spawned process "net1.exe" with commandline "%WINDIR%\\system32\\net1 helpmsg 3" (UID: 00000000-00006348) Spawned process "WerFault.exe" with commandline "-pss -s 440 -p 7960 -ip 7960" (UID: 00000000-00007360) Spawned process "WerFault.exe" with commandline "-u -p 7960 -s 660" (UID: 00000000-00006684) Spawned process "WerFault.exe" with commandline "-u -p 7960 -s 660" (UID: 00000000-00002828) Spawned process "powershell.exe" with commandline "powershell -nologo -noprofile" (UID: 00000000-00006668) Spawned process "BBuster.exe" with commandline "-s" (UID: 00000000-00006824) Spawned process "WerFault.exe" with commandline "-pss -s 504 -p 6824 -ip 6824" (UID: 00000000-00007436) Spawned process "WerFault.exe" with commandline "-u -p 6824 -s 668" (UID: 00000000-00006460) Spawned process "WerFault.exe" with commandline "-u -p 6824 -s 668" (UID: 00000000-00007652) Spawned process "WerFault.exe" with commandline "-pss -s 400 -p 6668 -ip 6668" (UID: 00000000-00003984) Spawned process "WerFault.exe" with commandline "-u -p 6668 -s 2208" (UID: 00000000-00002596) Spawned process "WerFault.exe" with commandline "-u -p 6668 -s 2208" (UID: 00000000-00007228) Spawned process "31839b57a4f11171d6abc8bbc4451ee4.exe" (UID: 00000000-00005248) Spawned process "powershell.exe" with commandline "powershell -nologo -noprofile" (UID: 00000000-00007024) Spawned process "WerFault.exe" with commandline "-pss -s 512 -p 7024 -ip 7024" (UID: 00000000-00001116) Spawned process "WerFault.exe" with commandline "-u -p 7024 -s 2464" (UID: 00000000-00006664) Spawned process "WerFault.exe" with commandline "-u -p 7024 -s 2464" (UID: 00000000-00006448)1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791322882823,"unified_at":"2026-10-06T21:41:22.823Z","metadata":{"hashes":{"sha256":"f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d","sha1":"f27c46e0e5bf076326392f0f4e1976f8ecd6db35","md5":"699c65fed2ca6370f86d5da5f70ee9c2","sha512":"87c847e190fbac40ccc8a21c16ab120a74c71b1d157137935c8305725715f14b76b823e098b1d44b6b94b040183c2a76f9a6bfe0788ce19eee7866c2936e9692","ssdeep":"196608:p4449wWScdoaUS52mpMJ3pQHfI3rp0wbGo+rcjDxg1DW3Xap/5kXf7Snruf2K21s:v49wWddo1SJpMJZ53t5DftPQrNrdYj","ssdeep_chunks":["196608:p4449wW","196608:4449wWS","196608:449wWSc","196608:49wWScd","196608:9wWScdo","196608:wWScdoa","196608:WScdoaU","196608:ScdoaUS","196608:cdoaUS5","196608:doaUS52","196608:oaUS52m","196608:aUS52mp","196608:US52mpM","196608:S52mpMJ","196608:52mpMJ3","196608:2mpMJ3p","196608:mpMJ3pQ","196608:pMJ3pQH","196608:MJ3pQHf","196608:J3pQHfI","196608:3pQHfI3","196608:pQHfI3r","196608:QHfI3rp","196608:HfI3rp0","196608:fI3rp0w","196608:I3rp0wb","196608:3rp0wbG","196608:rp0wbGo","196608:p0wbGo+","196608:0wbGo+r","196608:wbGo+rc","196608:bGo+rcj","196608:Go+rcjD","196608:o+rcjDx","196608:+rcjDxg","196608:rcjDxg1","196608:cjDxg1D","196608:jDxg1DW","196608:Dxg1DW3","196608:xg1DW3X","196608:g1DW3Xa","196608:1DW3Xap","196608:DW3Xap/","196608:W3Xap/5","196608:3Xap/5k","196608:Xap/5kX","196608:ap/5kXf","196608:p/5kXf7","196608:/5kXf7S","196608:5kXf7Sn","196608:kXf7Snr","196608:Xf7Snru","196608:f7Snruf","196608:7Snruf2","196608:Snruf2K","196608:nruf2K2","196608:ruf2K21","196608:uf2K21s","393216:p4449wW","393216:4449wWS","393216:449wWSc","393216:49wWScd","393216:9wWScdo","393216:wWScdoa","393216:WScdoaU","393216:ScdoaUS","393216:cdoaUS5","393216:doaUS52","393216:oaUS52m","393216:aUS52mp","393216:US52mpM","393216:S52mpMJ","393216:52mpMJ3","393216:2mpMJ3p","393216:mpMJ3pQ","393216:pMJ3pQH","393216:MJ3pQHf","393216:J3pQHfI","393216:3pQHfI3","393216:pQHfI3r","393216:QHfI3rp","393216:HfI3rp0","393216:fI3rp0w","393216:I3rp0wb","393216:3rp0wbG","393216:rp0wbGo","393216:p0wbGo+","393216:0wbGo+r","393216:wbGo+rc","393216:bGo+rcj","393216:Go+rcjD","393216:o+rcjDx","393216:+rcjDxg","393216:rcjDxg1","393216:cjDxg1D","393216:jDxg1DW","393216:Dxg1DW3","393216:xg1DW3X","393216:g1DW3Xa","393216:1DW3Xap","393216:DW3Xap/","393216:W3Xap/5","393216:3Xap/5k","393216:Xap/5kX","393216:ap/5kXf","393216:p/5kXf7","393216:/5kXf7S","393216:5kXf7Sn","393216:kXf7Snr","393216:Xf7Snru","393216:f7Snruf","393216:7Snruf2","393216:Snruf2K","393216:nruf2K2","393216:ruf2K21","393216:uf2K21s","196608:v49wWdd","196608:49wWddo","196608:9wWddo1","196608:wWddo1S","196608:Wddo1SJ","196608:ddo1SJp","196608:do1SJpM","196608:o1SJpMJ","196608:1SJpMJZ","196608:SJpMJZ5","196608:JpMJZ53","196608:pMJZ53t","196608:MJZ53t5","196608:JZ53t5D","196608:Z53t5Df","196608:53t5Dft","196608:3t5DftP","196608:t5DftPQ","196608:5DftPQr","196608:DftPQrN","196608:ftPQrNr","196608:tPQrNrd","196608:PQrNrdY","196608:QrNrdYj"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"latestrock.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":13166080,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1699071312000,"last_seen":1789447574000,"last_multi_scan":1789447574000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["commodity","criminal","smokeloader","downloader","evasive","coinminer","pua","windows-server-utility"]},"stats":{"av":{"malicious_count":17,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":2,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":114},"sandbox_signatures":{"informative_count":356,"suspicious_count":26,"malicious_count":21,"total":403},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Malware/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W32.MalwareX","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"IL:Trojan.ClipBanker.56","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"IL:Trojan.ClipBanker.56 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/Agent.UZA trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"VirTool/MSIL.Obfuscator.su","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Ransomware ( 005a8b921 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"high_entropy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/ILAgent-I","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"malicious","threat_name":"Trojan-FVZC!699C65FED2CA","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/MSIL_Kryptik.FFY.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Genus.UAZ","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Agent.Win32.3758185","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"IL:Trojan.ClipBanker","sources":[{"report_type":"quickscan","report_id":""}]},{"value":"SmokeLoader","sources":[{"report_type":"qsp","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Found Native API in Dotnet file"},{"type":"informative","value":"Imports GetCommandLine API"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Able to execute applications using .NET process API"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to start a process (Dotnet)"},{"type":"informative","value":"PE file contains large number of import functions"},{"type":"informative","value":"Contains native function calls (syscalls strings)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"informative","value":"Contains ability to execute a WMI query"},{"type":"suspicious","value":"Found a reference to a WMI query string known to be used for VM detection"},{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"informative","value":"Contains ability to execute WMI queries (Dotnet)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains ability to create a HTTP or FTP session (API string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"Possibly checks for known debuggers/analysis tools"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve information about MS-DOS device names (API string)"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Reads system-defined device setup information from registry"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"suspicious","value":"Contains ability to query CPU information"},{"type":"suspicious","value":"Contains ability to retrieve a module handle"},{"type":"informative","value":"Contains ability to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"suspicious","value":"Contains ability to measure performance"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Able to utilize the Windows bcrypt cryptographic API"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"},{"type":"informative","value":"Found XOR operators (encryption/decryption)"},{"type":"informative","value":"Calls an API typically used to convert data from string to binary"},{"type":"informative","value":"PE file contains zero-size sections"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Dotnet file resource with suspicious entropy"},{"type":"informative","value":"Contains ability to load content from resource"},{"type":"informative","value":"PE file contains zero-sized sections"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"},{"type":"informative","value":"Able to perform SQL operations"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"tactic":"Reconnaissance","technique":"Credentials","attack_id":"T1589.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1589/001","identifiers":[{"type":"informative","value":"Attempts to steal credentials via Security Account Manager (SAM) modules"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"}]},{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Short-term SSL certificate detected"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"},{"type":"informative","value":"Contains reference to multiple windows system processes"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Connects to LPC ports"},{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"},{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads rich edit control libraries"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"},{"type":"malicious","value":"The analysis spawned a process that was identified as malicious"},{"type":"malicious","value":"The analysis extracted a file that was identified as malicious"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"},{"type":"suspicious","value":"Contains ability to retrieve the contents of the STARTUPINFO structure"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"suspicious","value":"Modifies proxy settings"},{"type":"informative","value":"Contains ability to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Dotnet code contains ability to modify/delete registry"},{"type":"informative","value":"Contains ability to create/load registry keys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to start a service (API string)"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"Contains reference to Windows Startup folder"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"},{"type":"informative","value":"Contains reference to Hijacked CLSID(s)"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"},{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate another user on the local machine (API string)"},{"type":"informative","value":"Imports system security related APIs"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify process memory (API string)"},{"type":"informative","value":"Creates a thread in a self process"},{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Found PE header in memory"},{"type":"malicious","value":"Writes data to a remote process"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"malicious","value":"Writes shellcode to a remote process"},{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"informative","value":"Contains ability to unmap view of a section from a process (API string)"},{"type":"malicious","value":"Sets thread context in a remote process (often injection or process hollowing)"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"}]},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Contains ability to enumerate volumes (API string)"},{"type":"informative","value":"Attempts to read volume data via DOS device path"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"informative","value":"Calls an API typically used to remove a directory"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"tactic":"Defense Evasion","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Able to detect if debugger is present"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Contains ability to query local/system time as file time"},{"type":"suspicious","value":"Calls an API typically used to query local/system time as file time"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"},{"type":"informative","value":"Contains ability to set file attributes (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Able to permanently delete files from the Recycle Bin"},{"type":"informative","value":"Contains ability to empty the recycle bin (API string)"},{"type":"informative","value":"Imports SHEmptyRecycleBin API"},{"type":"informative","value":"Contains ability to modify file system redirection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"},{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Contains reference to method used by Windows shell items (API string)"},{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual/sandbox environment"},{"type":"informative","value":"Contains a Wine emulator-related string"},{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Triggers a burst of requests to the same API (API Hammering)"},{"type":"informative","value":"Contains ability to detect sandbox (imports API)"},{"type":"informative","value":"Contains ability to detect virtual environment (API)"},{"type":"informative","value":"Able to identify virtual/sandbox environment devices"},{"type":"informative","value":"Able to identify sandbox environment running process"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"},{"type":"informative","value":"Tries to map intranet network resources to internet zone"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"suspicious","value":"Contains escaped byte string (often part of obfuscated shellcode)"},{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Contains ability to decode string content at runtime (Dotnet)"},{"type":"informative","value":"Contains ability to load content into memory (Dotnet)"},{"type":"informative","value":"Able to load content into memory (.NET)"},{"type":"informative","value":"Able to decode string content at runtime (.NET)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"},{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy sections"},{"type":"suspicious","value":"PE file has unusual entropy resources"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"},{"type":"malicious","value":"PE file contains executable resources"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"tactic":"Defense Evasion","technique":"Junk Code Insertion","attack_id":"T1027.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/016","sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – Anomalous PE file structure"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about pressed keystrokes (API string)"},{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"},{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"},{"type":"informative","value":"Found strings related to keylogger"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Able to determine the valid logical drives on the computer"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Contains references to file movement (imports API)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Touches files in program files directory"},{"type":"informative","value":"Contains ability to verify if file exist on disk (API string)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Able to retrieve the valid logical drives on the computer"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve system network configuration"},{"type":"informative","value":"Detected Suricata Alert - External IP Lookup"},{"type":"malicious","value":"Attempts to identify external IP address"},{"type":"informative","value":"Contains ability to retrieve configuration of a workstation (API string)"},{"type":"informative","value":"Contains ability to free the memory used by network management functions (API string)"},{"type":"malicious","value":"Found a reference to an external IP address lookup service"},{"type":"malicious","value":"Tries to identify its external IP address"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Scanning for window names"},{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"References to WMI query strings used for process discovery"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Calls an API used to retrieve process information"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Process launched with changed environment"},{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"malicious","value":"Spawns many processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to enumerate running processes using Tasklist"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Contains ability to retrieve system language"},{"type":"informative","value":"Contains ability to retrieve system language (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Able to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to query machine time"},{"type":"informative","value":"Contains ability to query the machine timezone"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Contains ability to query the system locale"},{"type":"informative","value":"Able to query system locale information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Queries for Borland Delphi related registry entry"},{"type":"informative","value":".NET code is able to query registry"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Contains ability to query registry keys (API string)"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Dotnet code contains ability to query registry"},{"type":"informative","value":"Reads Windows Trust Settings"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"}]},{"tactic":"Discovery","technique":"Network Share Discovery","attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","identifiers":[{"type":"informative","value":"Imports windows networking related APIs"},{"type":"informative","value":"Contains ability to query information about shared network resources (API string)"},{"type":"malicious","value":"Contains ability to discover network shares"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Contains ability to retrieve remote session information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"tactic":"Discovery","technique":"Local Account","attack_id":"T1087.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1087/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about user accounts on a server (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to query service configuration on system (API string)"},{"type":"informative","value":"Queries services related registry keys"},{"type":"informative","value":"Able to enumerate service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","identifiers":[{"type":"informative","value":"Contains ability to retrieve SID for the specified name (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"tactic":"Discovery","technique":"Domain Groups","attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"References Windows LDAP client module"},{"type":"informative","value":"Loads Windows LDAP client module"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"},{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"},{"type":"informative","value":"Calls an API typically used to move file or directory"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1021.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1021/001","identifiers":[{"type":"informative","value":"Contains ability to perform remote desktop activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Calls an API typically used to register an interface (RPC)"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Calls an API possibly used to take screenshots"},{"type":"informative","value":"Able to capture screen (API string)"},{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Writes log files"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Able to capture drag-drop file operations"},{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"},{"type":"informative","value":"YARA signature match - Compress data using CryptoPP library"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"},{"type":"informative","value":"May execute SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Able to download remote files (.NET)"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to transfer files using SCP"},{"type":"informative","value":"Drops temp files"},{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"}]},{"tactic":"Command and Control","technique":"Multi-hop Proxy","attack_id":"T1090.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/003","sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"},{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains ability to provide interface for network protocols (Dotnet)"},{"type":"informative","value":"Contains reference to Windows internet services (API string)"},{"type":"informative","value":"GETs files from a webserver"},{"type":"informative","value":"Communicates with HTTP webserver (GET/POST requests)"},{"type":"informative","value":"GETs files from a webserver (HTTPS)"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Contains reference to Windows HTTP services (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"},{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"},{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"},{"type":"informative","value":"Uses HTTPS for communication"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains ability to perform encryption/decryption using RSA algorithm"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Able to perform scheduled transfer (API string)"},{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"informative","value":"Contains ability to upload file/data"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Calls an API used to open a process handle"},{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"},{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains ability to perform encryption (API string)"},{"type":"informative","value":"Contains reference to crypto DLLs"},{"type":"informative","value":"Contains reference to cryptographic keys"},{"type":"informative","value":"Able to import cryptographic keys (seen in ransomware)"}],"sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","sources":[{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"tactic":"Persistence","technique":"DLL Search Order Hijacking","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","sources":[{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"tactic":"Privilege Escalation","technique":"Thread Local Storage","attack_id":"T1055.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/005","sources":[{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"tactic":"Defense Evasion","technique":"Code Signing Policy Modification","attack_id":"T1553.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/006","sources":[{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Renames files"},{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","sources":[{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"tactic":"Impact","technique":"Data Manipulation","attack_id":"T1565","attack_id_wiki":"https://attack.mitre.org/techniques/T1565","identifiers":[{"type":"malicious","value":"Writes to the hosts file"}],"sources":[{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]}],"sandbox_signatures":[{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (On Sensor) detected file with high confidence","description":"\"Portable Executable (On Sensor) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-12","sources":[{"report_type":"qsp","report_id":""}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (Cloud) detected file with high confidence","description":"\"Portable Executable (Cloud) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-16","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains native function calls (syscalls strings)","description":"Found reference to API \"tEEh\" (Indicator: \"tee\"; Source: \"sample.bin\"), Found reference to API \"Select * from Win32_ComputerSystem\" (Indicator: \"select\"; Source: \"sample.bin\"), Found reference to API \"lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet\" (Indicator: \"read\"; Source: \"sample.bin\"), Found reference to API \"lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet\" (Indicator: \"time\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-5000","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"Select * from Win32_ComputerSystem\" (Source: sample.bin, Indicator: \"select * from win32_computersystem\")","origin":"sample.bin","mitre_attack_id":"T1213","id":"string-16","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"b2.bm\", Heuristic match: \")b.tc\", Heuristic match: \"?c0czl\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00003668.00000000.86679.000C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"$68","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"$69","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; File: \"f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d\")\n Found reference to API \"GetLogicalDriveStringsW\" (Indicator: \"GetLogicalDriveStrings\"; File: \"f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d\")\n Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00003992.00000001.89667.71AAA000.00000004.mdmp, 00000000-00003992.00000002.91592.71B68000.00000002.mdmp\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00003992.00000001.89667.71AAA000.00000004.mdmp, 00000000-00003992.00000002.91592.71B68000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve the valid logical drives on the computer","description":"Observed import api \"GetLogicalDriveStringsW\" which can be \"used to retrieve a list of available drives (logical drives) in the system\" [Source: Broom.exe]","origin":"Static Parser","mitre_attack_id":"T1083","relevance":5,"id":"static-192","sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"$6a","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to read volume data via DOS device path","description":"\"f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe\" tries to directly access volume data \"C:\"\n \"f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe\" tries to directly access volume data \"Z:\"\n \"InstallSetup5.exe\" tries to directly access volume data \"C:\"\n \"InstallSetup5.exe\" tries to directly access volume data \"Z:\"\n \"Broom.exe\" tries to directly access volume data \"C:\"\n \"Broom.exe\" tries to directly access volume data \"Z:\"","origin":"API Call","mitre_attack_id":"T1006","relevance":1,"id":"api-306","sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to steal credentials via Security Account Manager (SAM) modules","description":"\"31839b57a4f11171d6abc8bbc4451ee4.exe\" loaded module \"%WINDIR%\\System32\\samcli.dll\" at 73860000\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" loaded module \"%WINDIR%\\System32\\samlib.dll\" at 74120000\n \"Broom.exe\" loaded module \"%WINDIR%\\System32\\samcli.dll\" at 73860000","origin":"Loaded Module","mitre_attack_id":"T1589.001","relevance":3,"id":"module-19","sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$6b","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"$6c","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"000000000010000000000100fffffe7f03000000080000004a020000000001000600004f\"}\n \"InstallSetup5.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"000000000010000000000100fffffe7f03000000080000004a020000000001000600004f\"}\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"000000000010000000000100fffffe7f03000000080000004a020000000001000600004f\"}\n \"Broom.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"000000000010000000000100fffffe7f03000000080000004a020000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; File: \"f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d\")\n Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; File: \"f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d\")\n Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"00000000-00003756.00000002.91077.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to detect sandbox (imports API)","description":"Found GetCursorPos() in an import section (Source: Broom.exe)","origin":"Static Parser","mitre_attack_id":"T1497","relevance":1,"id":"static-132","sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"$6d","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$6e","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00000416.00000001.89158.0B480000.00000004.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00003428.00000001.89674.0B880000.00000004.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00003756.00000002.91077.00408000.00000002.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00003992.00000001.89667.71AAA000.00000004.mdmp, 00000000-00003992.00000001.89667.71C09000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve SID for the specified name (API string)","description":"Found reference to API \"LookupAccountNameW\" (Indicator: \"LookupAccountName\"; Source: \"00000000-00003428.00000000.89476.0B880000.00000004.mdmp, 00000000-00003428.00000001.89674.0B880000.00000004.mdmp\")\n Found reference to API \"getLookupAccountName\" (Indicator: \"LookupAccountName\"; Source: \"00000000-00003992.00000001.89667.71BA1000.00000020.mdmp\")\n Found reference to API \"LookupAccountNameW\" (Indicator: \"LookupAccountName\"; Source: \"00000000-00003992.00000001.89667.71C09000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1087","relevance":1,"id":"string-452","sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"$6f","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"00000000-00003696.00000001.87336.00401000.00000020.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00003696.00000001.87336.00401000.00000020.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00003756.00000002.91077.00408000.00000002.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00003992.00000001.89667.71AAA000.00000004.mdmp, 00000000-00003992.00000001.89667.71C09000.00000002.mdmp, 00000000-00003992.00000002.91592.71B68000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00003992.00000001.89667.71C09000.00000002.mdmp, 00000000-00003992.00000002.91592.71B2A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$70","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about MS-DOS device names (API string)","description":"Found reference to API \"QueryDosDeviceW\" (Indicator: \"QueryDosDevice\"; File: \"f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-227","sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; File: \"f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d\")\n Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00003992.00000001.89667.71C09000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"$71","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; File: \"f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d\")\n Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00000416.00000001.89158.0B480000.00000004.mdmp\")\n Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00003428.00000000.89476.0B880000.00000004.mdmp, 00000000-00003428.00000001.89674.0B880000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00003756.00000002.91077.00408000.00000002.mdmp\")\n Found reference to API \"GetSystemMetricsForDpi\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00003992.00000000.87747.00822000.00000004.mdmp, 00000000-00003992.00000001.89667.00822000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"$72","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"passwordFormat=\"Hashed\"\" (Indicator: \"password\"; Source: \"00000000-00001368.00000001.89322.00320000.00000004.mdmp, 00000000-00001368.00000002.91245.00320000.00000004.mdmp\")\n Found string \"passwordAttemptWindow=\"10\"\" (Indicator: \"password\"; Source: \"00000000-00001368.00000001.89322.00320000.00000004.mdmp, 00000000-00001368.00000002.91245.00320000.00000004.mdmp\")\n Found string \"passwordStrengthRegularExpression=\"\" />\" (Indicator: \"password\"; Source: \"00000000-00001368.00000001.89322.00320000.00000004.mdmp, 00000000-00001368.00000002.91245.00320000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"Broom.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"}]},{"level":"informative","category":"System Destruction","name":"Able to permanently delete files from the Recycle Bin","description":"Found string \"SHEmptyRecycleBinA\" (File: \"f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d\")\n Found string \"SHEmptyRecycleBinA\" (Source: \"00000000-00003992.00000000.87747.0081E000.00000004.mdmp, 00000000-00003992.00000002.91592.0081D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-922","sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteKeyW\" in file \"f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d\"\n Found registry deletion API: \"RegDeleteValueW\" in file \"f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d\"\n Found registry deletion API: \"RegDeleteKeyExW\" in \"00000000-00003756.00000001.89154.0040A000.00000004.mdmp\"\n Found registry deletion API: \"RegDeleteValueW\" in \"00000000-00003756.00000002.91077.00408000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteKeyW\" in \"00000000-00003756.00000002.91077.00408000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteKeyExW\" in \"00000000-00003992.00000000.87747.00822000.00000004.mdmp, 00000000-00003992.00000001.89667.00822000.00000004.mdmp, 00000000-00003992.00000002.91592.71B51000.00000020.mdmp\"\n Found registry deletion API: \"RegDeleteValueW\" in \"00000000-00003992.00000001.89667.71C09000.00000002.mdmp, 00000000-00003992.00000002.91592.71B68000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"31839b57a4f11171d6abc8bbc4451ee4.exe\" called an API \"AdjustTokenPrivileges\"on file: C:\\Windows\\System32\\tzres.dll\" (UID: 00000000-00000416), \"kos4.exe\" called an API \"AdjustTokenPrivileges\"on file: C:\\Windows\\System32\\cryptsp.dll\" (UID: 00000000-00001368)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: Broom.exe]\n Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: InstallSetup5.exe]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$73","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"ImpersonateLoggedOnUser\" (Indicator: \"ImpersonateLoggedOnUser\"; Source: \"00000000-00003992.00000001.89667.71C09000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"$74","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; File: \"f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d\")\n Found reference to API \"SetWindowsHookExW\" (Indicator: \"SetWindowsHook\"; File: \"f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d\")\n Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; File: \"f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d\")\n Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; Source: \"00000000-00003992.00000000.87747.0081E000.00000004.mdmp, 00000000-00003992.00000002.91592.0081D000.00000004.mdmp, 00000000-00003992.00000002.91592.71B68000.00000002.mdmp\")\n Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; Source: \"00000000-00003992.00000000.87747.0081E000.00000004.mdmp, 00000000-00003992.00000002.91592.0081D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"LookupPrivilegeValueW\" (Indicator: \"LookupPrivilegeValue\"; File: \"f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d\")\n Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; File: \"f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d\")\n Found reference to API \"SeShutdownPrivilege\" (Indicator: \"SeShutdownPrivilege\"; Source: \"00000000-00003756.00000001.89154.0040A000.00000004.mdmp\")\n Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; Source: \"00000000-00003756.00000002.91077.00408000.00000002.mdmp\")\n Found reference to API \"LookupPrivilegeValueW\" (Indicator: \"LookupPrivilegeValue\"; Source: \"00000000-00003756.00000002.91077.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d\")\n Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00003756.00000002.91077.00408000.00000002.mdmp\")\n Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00003992.00000001.89667.71AAA000.00000004.mdmp, 00000000-00003992.00000001.89667.71C09000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; File: \"f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d\")\n Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00003756.00000002.91077.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$75","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00001368-00000C2C-394127391","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"$76","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"00000000-00003696.00000001.87336.00401000.00000020.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00003696.00000001.87336.00401000.00000020.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00003756.00000002.91077.00408000.00000002.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00003992.00000001.89667.71AAA000.00000004.mdmp, 00000000-00003992.00000001.89667.71C09000.00000002.mdmp, 00000000-00003992.00000001.89667.71CA4000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"System Security","name":"Contains reference to Hijacked CLSID(s)","description":"Observed string: \"CLSID\\{D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D}\" (Indicator: \"{D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D}\") in Source: 00000000-00003992.00000001.89667.00200000.00000004.mdmp\n 00000000-00003992.00000002.91592.00200000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1546.015","relevance":1,"id":"string-342","sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"kos4.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe\" opened \"\\Device\\KsecDD\"\n \"InstallSetup5.exe\" opened \"\\Device\\KsecDD\"\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" opened \"\\Device\\KsecDD\"\n \"kos4.exe\" opened \"\\Device\\KsecDD\"\n \"Broom.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$77","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$78","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to free the memory used by network management functions (API string)","description":"Found reference to API \"NetApiBufferFree\" (Indicator: \"NetApiBufferFree\"; File: \"f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d\")\n Found reference to API \"NetApiBufferFree\" (Indicator: \"NetApiBufferFree\"; Source: \"00000000-00000416.00000001.89158.0B480000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-223","sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; File: \"f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d\")\n Found reference to API \"InitiateShutdownW\" (Indicator: \"InitiateShutdown\"; Source: \"00000000-00003756.00000001.89154.0040A000.00000004.mdmp\")\n Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; Source: \"00000000-00003756.00000002.91077.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to multiple windows system processes","description":"Found strings \"csrss.exe,smss.exe,wininit.exe,winlogon.exe,services.exe\" (Source: \"00000000-00003428.00000001.89674.0B880000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":3,"id":"string-455","sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; File: \"f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d\")\n Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; File: \"f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00003992.00000001.89667.71C09000.00000002.mdmp\")\n Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00003992.00000001.89667.71C09000.00000002.mdmp\")\n Found reference to API \"OpenMutexW\" (Indicator: \"OpenMutex\"; Source: \"00000000-00003992.00000001.89667.71C09000.00000002.mdmp, 00000000-00003992.00000002.91592.71B68000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"Broom.exe\" has type \"PE32 executable for MS Windows 5.00 (GUI) Intel i386 11 sections\"- Location: [%TEMP%\\Broom.exe]- [targetUID: 00000000-00003756]\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" has type \"PE32 executable for MS Windows 5.01 (GUI) Intel i386 3 sections\"- Location: [%TEMP%\\31839b57a4f11171d6abc8bbc4451ee4.exe]- [targetUID: 00000000-00003668]\n \"InstallSetup5.exe\" has type \"PE32 executable for MS Windows 4.00 (GUI) Intel i386 Nullsoft Installer self-extracting archive 5 sections\"- Location: [%TEMP%\\InstallSetup5.exe]- [targetUID: 00000000-00003668]\n \"toolspub2.exe\" has type \"PE32 executable for MS Windows 5.01 (GUI) Intel i386 3 sections\"- Location: [%TEMP%\\toolspub2.exe]- [targetUID: 00000000-00003668]\n \"kos4.exe\" has type \"PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 3 sections\"- Location: [%TEMP%\\kos4.exe]- [targetUID: 00000000-00003668]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d\" was detected as \"Microsoft Visual C# v7.0 / Basic .NET\"\n \"Broom.exe\" was detected as \"Borland Delphi 4.0\"\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"toolspub2.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"kos4.exe\" was detected as \"Microsoft Visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"kos4.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"Broom.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d\" has section name .text with entropy \"7.938341089881197\"\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" has section name .text with entropy \"7.996305375958465\"\n \"toolspub2.exe\" has section name .text with entropy \"7.3307828845600485\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"}]},{"level":"suspicious","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO External IP Lookup Domain (iplogger .com in TLS SNI)\" (SID: 2047718, Rev: 6, Severity: 2) categorized as \"Device Retrieving External IP Address Detected\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-1","sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"16/24 Antivirus vendors marked sample as malicious (66% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"suspicious","category":"General","name":"PE file has unusual entropy resources","description":"\"Broom.exe\" has resource with unusual entropy \"VCLSTYLE:7.955538924242702\"\n \"Broom.exe\" has resource with unusual entropy \"RT_BITMAP:7.204507547582926\"\n \"Broom.exe\" has resource with unusual entropy \"RT_RCDATA:7.886367032655639\"\n \"Broom.exe\" has resource with unusual entropy \"RT_RCDATA:7.58418098582544\"\n \"Broom.exe\" has resource with unusual entropy \"RT_RCDATA:7.808588808062177\"\n \"Broom.exe\" has resource with unusual entropy \"RT_RCDATA:7.758325192927498\"\n \"Broom.exe\" has resource with unusual entropy \"RT_RCDATA:7.5191733345079514\"\n \"Broom.exe\" has resource with unusual entropy \"RT_RCDATA:7.665567395404698\"\n \"Broom.exe\" has resource with unusual entropy \"RT_RCDATA:7.631838602120624\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":5,"id":"static-92","sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"$79","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"Broom.exe\" has type \"PE32 executable for MS Windows 5.00 (GUI) Intel i386 11 sections\"- Location: [%TEMP%\\Broom.exe]- [targetUID: 00000000-00003756]\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" has type \"PE32 executable for MS Windows 5.01 (GUI) Intel i386 3 sections\"- Location: [%TEMP%\\31839b57a4f11171d6abc8bbc4451ee4.exe]- [targetUID: 00000000-00003668]\n \"InstallSetup5.exe\" has type \"PE32 executable for MS Windows 4.00 (GUI) Intel i386 Nullsoft Installer self-extracting archive 5 sections\"- Location: [%TEMP%\\InstallSetup5.exe]- [targetUID: 00000000-00003668]\n \"toolspub2.exe\" has type \"PE32 executable for MS Windows 5.01 (GUI) Intel i386 3 sections\"- Location: [%TEMP%\\toolspub2.exe]- [targetUID: 00000000-00003668]\n \"kos4.exe\" has type \"PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 3 sections\"- Location: [%TEMP%\\kos4.exe]- [targetUID: 00000000-00003668]","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$7a","origin":"API Call","mitre_attack_id":"T1105","relevance":5,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 104.21.76.57 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – Anomalous PE file structure","description":"YARA signature for null IAT Directory of PE process \"00000000-00003500\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":1,"id":"yara-153","sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"$7b","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"InstallSetup5.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsdC725.tmp\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"InstallSetup5.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsdC725.tmp\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"31839b57a4f11171d6abc8bbc4451ee4.exe\" claimed CRC 4400054 while the actual is CRC 4370054\n \"kos4.exe\" claimed CRC 314377 while the actual is CRC 48678","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$7c","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"toolspub2.exe\" called \"CreateProcessA\" with parameter \"\"%TEMP%\\toolspub2.exe\"\" - (UID: 00000000-00003696)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"malicious","category":"Exploit/Shellcode","name":"Writes shellcode to a remote process","description":"Wrote 73 instructions to a remote process","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1055","relevance":8,"id":"stream-38","sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"16/24 Antivirus vendors marked sample as malicious (66% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"20/27 Antivirus vendors marked dropped file \"kos4.exe\" as malicious (classified as \"IL:Trojan.MSILZilla\" with 74% detection rate)","origin":"Binary File","mitre_attack_id":"T1204.002","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"20/27 Antivirus vendors marked spawned process \"kos4.exe\" (PID: 1368) as malicious (classified as \"IL:Trojan.MSILZilla\" with 74% detection rate)","origin":"Monitored Target","mitre_attack_id":"T1204.002","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"malicious","category":"Network Related","name":"Attempts to identify external IP address","description":"\"iplogger.com\"","origin":"Network Traffic","mitre_attack_id":"T1016","relevance":6,"id":"network-24","sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"YARA signature \"MALWARE_Win_DLInjector04\" matched file \"sample.bin\" as \"Detects downloader / injector\"\n YARA signature \"MALWARE_Win_DLInjector04\" matched file \"kos4.exe\" as \"Detects downloader / injector\"","origin":"YARA Signature","relevance":9,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"},{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns many processes","description":"Spawned process \"f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d.exe\" (UID: 00000000-00003668)\n Spawned process \"InstallSetup5.exe\" (UID: 00000000-00003756)\n Spawned process \"toolspub2.exe\" (UID: 00000000-00003696)\n Spawned process \"31839b57a4f11171d6abc8bbc4451ee4.exe\" (UID: 00000000-00000416)\n Spawned process \"kos4.exe\" (UID: 00000000-00001368)\n Spawned process \"toolspub2.exe\" (UID: 00000000-00003500)\n Spawned process \"Broom.exe\" (UID: 00000000-00003992)\n Spawned process \"31839b57a4f11171d6abc8bbc4451ee4.exe\" (UID: 00000000-00003428)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6aa8cd934fe71c8af80bb479"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to remove a directory","description":"\"LzmwAqmV.exe\" called \"RemoveDirectoryA\" with parameter %TEMP%\\is-QGNRO.tmp (UID: 00000000-00002440)","origin":"API Call","mitre_attack_id":"T1070.004","relevance":3,"id":"api-121","sources":[{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"file/memory contains long string with (Indicator: \"CreateThread\"; File: \"is-FVO5J.tmp\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00001876.00000001.69287.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load content into memory (Dotnet)","description":"Observed namespace \"System.IO.MemoryStream\" and TypeReference \".ctor\" in \"SecuriteInfo.com.Trojan.MulDropNET.43.6599.26850\"\n Observed namespace \"System.IO.MemoryStream\" and TypeReference \"ToArray\" in \"SecuriteInfo.com.Trojan.MulDropNET.43.6599.26850\"\n Observed namespace \"System.IO.MemoryStream\" and TypeReference \".ctor\" in \"kos4.exe\"\n Observed namespace \"System.IO.MemoryStream\" and TypeReference \"ToArray\" in \"kos4.exe\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-107","sources":[{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Renames files","description":"$7d","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \"BSS\" is zero\n Raw size of \".tls\" is zero\n Raw size of \".reloc\" is zero\n Raw size of \".ndata\" is zero\n Raw size of \".bss\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to convert data from string to binary","description":"$7e","origin":"API Call","mitre_attack_id":"T1027","relevance":3,"id":"api-229","sources":[{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode string content at runtime (Dotnet)","description":"Observed function \"FromBase64String\" in \"SecuriteInfo.com.Trojan.MulDropNET.43.6599.26850\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-106","sources":[{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00001956.00000001.69447.03320000.00000004.mdmp, 00000000-00001956.00000002.71366.03320000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00001168.00000000.67482.04FB0000.00000004.mdmp\")\n Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00001168.00000000.67482.04FB0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"Uses RsaCryptoServiceProvider to encrypt and decrypt\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00001168.00000000.67482.04FB0000.00000004.mdmp\")\n Found string \"description=\"Uses RsaCryptoServiceProvider to encrypt and decrypt\"\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00001168.00000000.67482.04FB0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-352","sources":[{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"Cryptographic Related","name":"Found XOR operators (encryption/decryption)","description":"Found string \"l)/QtY:????? Z@@ (B[00 %\\(( h] ^ _ ` haPNG\" (Indicator: \" ^ \"; File: \"is-FVO5J.tmp\")\n Found string \"$ ^ 1$a(+5LY\" (Indicator: \" ^ \"; File: \"is-FVO5J.tmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-624","sources":[{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"Contains base64 string in header \"/order/tuc19\" in header \"GET /order/tuc19.exe HTTP/1.1Host: stim.graspalace.comConnection: Keep-Alive\"\n Contains base64 string in header \"stim\" in header \"GET /order/tuc19.exe HTTP/1.1Host: stim.graspalace.comConnection: Keep-Alive\"\n Contains base64 string in header \"Keep\" in header \"GET /order/tuc19.exe HTTP/1.1Host: stim.graspalace.comConnection: Keep-Alive\"","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"file/memory contains long string with (Indicator: \"GetSystemTime\"; File: \"is-FVO5J.tmp\")\n Found reference to API \"GetSystemTimes\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00001956.00000000.67528.00822000.00000004.mdmp, 00000000-00001956.00000001.69447.00822000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersion@KERNEL32.dll at 3782-1-004C9820","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume/memory size (API string)","description":"file/memory contains long string with (Indicator: \"GetDiskFreeSpace\"; File: \"is-FVO5J.tmp\")\n Found reference to API \"GetDiskFreeSpaceExA\" (Indicator: \"GetDiskFreeSpace\"; File: \"is-G6U9O.tmp.2146476303\")\n Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00001876.00000001.69287.00408000.00000002.mdmp\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00001876.00000001.69287.0040A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"GetMonitorInfoA\" (Indicator: \"GetMonitorInfo\"; File: \"00000000-00006016.00000000.68461.00401000.00000020.mdmp\")\n Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; File: \"toolspub2.exe.1363130796\")\n Found reference to API \"ExpandEnvironmentStringsW\" (Indicator: \"ExpandEnvironmentStrings\"; Source: \"00000000-00001876.00000001.69287.00408000.00000002.mdmp\")\n Found reference to API \"WTSRegisterSessionNotification\" (Indicator: \"WTSRegisterSessionNotification\"; Source: \"00000000-00001956.00000000.67528.00822000.00000004.mdmp, 00000000-00001956.00000001.69447.00822000.00000004.mdmp\")\n Found reference to API \"GetNativeSystemInfo\" (Indicator: \"GetNativeSystemInfo\"; Source: \"00000000-00001956.00000000.67528.00822000.00000004.mdmp, 00000000-00001956.00000001.69447.00822000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"file/memory contains long string with (Indicator: \"GetSystemTime\"; File: \"is-FVO5J.tmp\")\n Found reference to API \"GetSystemTimes\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00001956.00000000.67528.00822000.00000004.mdmp, 00000000-00001956.00000001.69447.00822000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language (API string)","description":"Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; File: \"00000000-00006016.00000000.68461.00401000.00000020.mdmp\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00001876.00000001.69287.0040A000.00000004.mdmp\")\n Found reference to API \"GetKeyboardLayoutList\" (Indicator: \"GetKeyboardLayoutList\"; Source: \"00000000-00001956.00000000.67528.0081E000.00000004.mdmp, 00000000-00001956.00000002.71366.0081D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system network configuration","description":"$7f","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-430","sources":[{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"powershell.exe\" queries volume information of \"C:\\\" at 00000000-00006668-00000C15-65928531","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$80","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"General","name":"An application crash occurred","description":"Report process \"WerFault.exe\" was created by \"svchost.exe\"\n Report process \"WerFault.exe\" was created by \"BBuster.exe\"\n Report process \"WerFault.exe\" was created by \"powershell.exe\"","origin":"Monitored Target","id":"target-2","sources":[{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"General","name":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)","description":"\"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00006668)\n \"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00007024)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":1,"id":"api-179","sources":[{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"31839b57a4f11171d6abc8bbc4451ee4.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\" - (UID: 00000000-00007544)\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" called \"NtCreateNamedPipeFile\" (UID: 00000000-00007544)\n \"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.133435806737252333.6668.DefaultAppDomain.powershell\" - (UID: 00000000-00006668)\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\" - (UID: 00000000-00005248)\n \"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.133435809414098004.7024.DefaultAppDomain.powershell\" - (UID: 00000000-00007024)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"General","name":"Calls an API typically used to move file or directory","description":"$81","origin":"API Call","mitre_attack_id":"T1570","relevance":1,"id":"api-224","sources":[{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"stim.graspalace.com\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"General","name":"Contains ability to create/load registry keys (API string)","description":"Found reference to API \"RegCreateKeyEx\" (Indicator: \"RegCreateKey\"; File: \"00000000-00006016.00000000.68461.00401000.00000020.mdmp\")\n file/memory contains long string with (Indicator: \"RegCreateKey\"; File: \"is-FVO5J.tmp\")\n file/memory contains long string with (Indicator: \"RegConnectRegistry\"; File: \"is-FVO5J.tmp\")\n file/memory contains long string with (Indicator: \"RegLoadKey\"; File: \"is-FVO5J.tmp\")\n Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00001876.00000001.69287.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"General","name":"Contains ability to impersonate another user on the local machine (API string)","description":"Found reference to API \"User authentication using Basic authentication scheme failed. %n%n Additional Data %n Unexpected error received from LogonUser %1: %%%1.\" (Indicator: \"LogonUser\"; Source: \"00000000-00001956.00000001.69447.05880000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-225","sources":[{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"file/memory contains long string with (Indicator: \"GetProcessHeap\"; File: \"is-EK42P.tmp\")\n file/memory contains long string with (Indicator: \"GetProcessHeap\"; File: \"is-R3GDI.tmp\")\n file/memory contains long string with (Indicator: \"GetProcessHeap\"; File: \"is-Q3QAN.tmp\")\n file/memory contains long string with (Indicator: \"GetProcessHeap\"; File: \"is-N4SO7.tmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00001876.00000001.69287.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"General","name":"Dotnet code contains ability to query registry","description":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"OpenSubKey\" in \"SecuriteInfo.com.Trojan.MulDropNET.43.6599.26850\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"OpenSubKey\" in \"kos4.exe\"","origin":"Static Parser","mitre_attack_id":"T1012","relevance":1,"id":"static-138","sources":[{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET /order/tuc19.exe HTTP/1.1\nHost: stim.graspalace.com\nConnection: Keep-Alive\" Response ==> HTTP/1.1 200 OK\nDate: Sat\n 04 Nov 2023 04:21:32 GMT\nContent-Type: application/octet-stream\nContent-Length: 5054318\nConnection: keep-alive\nContent-Description: File Transfer\nContent-Disposition: attachment; filename=tuc19.exe\nContent-Transfer-Encoding: binary\nExpires: 0\nCache-Control: must-revalidate\nPragma: public\nCF-Cache-Status: DYNAMIC\nReport-To: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v3?s=50T8IrZQuogRpab832B%2FRseDNbNq7%2Fmc17he4Sp2B1XytjQPmTW5Tr5Apvke1Bvhpdqj%2FTkVc2Tx66e1wLgYRFw55M%2BX8PLwgmoH2mFNr8DH6e8rCDNTXw9PndK9MP%2FGO6GvVF2Z\"}]\n\"group\":\"cf-nel\"\n\"max_age\":604800}\nNEL: {\"success_fraction\":0\n\"report_to\":\"cf-nel\"\n\"max_age\":604800}\nServer: cloudflare\nCF-RAY: 820a12193baaf9f1-SJC\nalt-svc: h3=\":443\"; ma=86400 with response body ==>4D5A50000200000004000F00FFFF0000B80000000000000040001A00000000000000000000000000000000000000000000000000000000000000000000010000.......","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"is-G6U9O.tmp\" loaded module \"%WINDIR%\\SysWOW64\\riched20.dll\" at 72360000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-2","sources":[{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\SysWOW64\\amsi.dll\" at 73600000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"General","name":"May execute SQL queries","description":"\"Select * from Win32_ComputerSystem\" (Source: SecuriteInfo.com.Trojan.MulDropNET.43.6599.26850, Indicator: \"select * from win32_computersystem\")","origin":"File/Memory","mitre_attack_id":"T1005","relevance":1,"id":"string-605","sources":[{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"is-E08L8.tmp\" has high imagebase \"0x6ad80000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe\" [Source: 00000000-00007544-00000BC0-60648876]\n Observed system executable string:\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" [Source: 00000000-00007544-00000C41-49126767010]\n Observed system executable string:\"%WINDIR%\\System32\\cmd.exe\" [Source: 00000000-00006412-00000BC0-76288961]\n Observed system executable string:\"%WINDIR%\\System32\\schtasks.exe\" [Source: 00000000-00006412-00000BC0-77492088]\n Observed system executable string:\"\"%WINDIR%\\system32\\net.exe\" helpmsg 3\" [Source: 00000000-00006016-00000C40-6784788044]\n Observed system executable string:\"%WINDIR%\\SysWOW64\\net1.exe\" [Source: 00000000-00007732-00000BC0-59729154]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"$82","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"SecuriteInfo.com.Trojan.MulDropNET.43.6599.26850.exe\" creates a thread in process \"-1\" (Handle: 4294967295)\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" creates a thread in process \"-1\" (Handle: 4294967295)\n \"kos4.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"$83","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"kos4.exe\" called \"NtQueueApcThread\" (UID: 00000000-00001168)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in program files directory","description":"\"latestX.exe\" touched file \"C:\\Program Files\\Google\\Chrome\\updater.exe\"\n \"is-G6U9O.tmp\" touched file \"C:\\Program Files (x86)\\BBuster\\Lang\\is-HQK4G.tmp\"\n \"is-G6U9O.tmp\" touched file \"C:\\Program Files (x86)\\BBuster\\Lang\\is-T5BLA.tmp\"\n \"is-G6U9O.tmp\" touched file \"C:\\Program Files (x86)\\BBuster\\Plugins\\is-E08L8.tmp\"\n \"is-G6U9O.tmp\" touched file \"C:\\Program Files (x86)\\BBuster\\Plugins\\is-KLM1E.tmp\"\n \"is-G6U9O.tmp\" touched file \"C:\\Program Files (x86)\\BBuster\\Plugins\\is-7HG3J.tmp\"\n \"is-G6U9O.tmp\" touched file \"C:\\Program Files (x86)\\BBuster\\Plugins\\is-DTE8N.tmp\"\n \"is-G6U9O.tmp\" touched file \"C:\\Program Files (x86)\\BBuster\\is-FVO5J.tmp\"\n \"is-G6U9O.tmp\" touched file \"C:\\Program Files (x86)\\BBuster\\unins000.dat\"","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-113","sources":[{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"kos4.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\kos4.exe.log\"\n \"kos4.exe\" writes a file \"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0\\UsageLogs\\kos4.exe.log\"\n \"is-G6U9O.tmp\" writes a file \"C:\\Program Files (x86)\\BBuster\\unins000.dat\"\n \"is-G6U9O.tmp\" writes a file \"%PROGRAMFILES%\\(x86)\\BBuster\\unins000.dat\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP webserver (GET/POST requests)","description":"Found http requests in header \"GET /order/tuc19.exe\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a HTTP or FTP session (API string)","description":"Found reference to API \"Handle %1 created by InternetConnect: SessionHandle=%2, Server=%4:%5, %7, Flags=%8\" (Indicator: \"InternetConnect\"; Source: \"00000000-00001956.00000001.69447.05880000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-538","sources":[{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"CreateNamedPipe\" (Indicator: \"CreateNamedPipe\"; File: \"00000000-00006016.00000000.68461.00401000.00000020.mdmp\")\n file/memory contains long string with (Indicator: \"CreatePipe\"; File: \"is-FVO5J.tmp\")\n Found reference to API \"AppendData (or AddSubdirectory or CreatePipeInstance)\" (Indicator: \"CreatePipe\"; Source: \"00000000-00001956.00000001.69447.05880000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"Network Related","name":"Contains ability to transfer files using SCP","description":"Observed string: \"\\L9TA0L1ResWFK=2[syB[c@]6\"scPIImsssL9S6L/z^.*F=1\\?P9\nsb;8G%]qD1|s=(E[MDRVTt$4$S$$$P,$$P6D$$,$P<$cS|$_$,$PhXD$X$t$4$$U,$\\t$4$$P$\\D$\\$$4$T^SWK3[4$\\$V$TY$$$,PUbmuB9AnpVQvHnL$Y$RTT$ZR$\\$UH7l$,$$$Z!\"<$$$V,$S,\\$$$t$$PQYPt$X$\\t$$VPX4$\\D$\\$4$$PU]$\\4$X4$34$14$34$\\LGG=I9/sGY SvHzz7SK|n*s@D*J. L%2\"s|vXdL^~J|%hDqsxE~imussLmL\" (Indicator: \"\"scp\") in Source: is-FVO5J.tmp","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-577","sources":[{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"Found reference to API \"Handle %1 created by InternetOpenURL: SessionHandle=%2,URL=%4, Headers=%6, Flags=%7\" (Indicator: \"InternetOpen\"; Source: \"00000000-00001956.00000001.69447.05880000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-539","sources":[{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"Network Related","name":"GETs files from a webserver (HTTPS)","description":"GET /2lhi52 HTTP/1.1Host: iplogger.com\n Connection: Keep-Alive\n\n GET /service/msn/livetile/singletile?market=en-US&source=appxmanifest&tenant=amp&vertical=sports HTTP/1.1Connection: Keep-Alive\n User-Agent: Microsoft-WNS/10.0\n Host: assets.msn.com\n\n GET /service/msn/livetile/singletile?market=en-US&source=appxmanifest&tenant=amp&vertical=finance HTTP/1.1Connection: Keep-Alive\n User-Agent: Microsoft-WNS/10.0\n Host: assets.msn.com\n\n GET /raw/cZ2J3Upi HTTP/1.1Accept: */*\n Connection: close\n Host: pastebin.com\n User-Agent: cpp-httplib/0.9","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"Network Related","name":"Imports windows networking related APIs","description":"$84","origin":"Static Parser","mitre_attack_id":"T1135","relevance":1,"id":"static-86","sources":[{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x00000303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://iplogger.com/2lhi52\n Found HTTPS GET request to https://assets.msn.com/service/msn/livetile/singletile?market=en-US&source=appxmanifest&tenant=amp&vertical=sports\n Found HTTPS GET request to https://assets.msn.com/service/msn/livetile/singletile?market=en-US&source=appxmanifest&tenant=amp&vertical=finance\n Found HTTPS GET request to https://pastebin.com/raw/cZ2J3Upi","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to modify file system redirection (API string)","description":"Found reference to API \"Wow64DisableWow64FsRedirection\" (Indicator: \"Wow64DisableWow64FsRedirection\"; File: \"is-G6U9O.tmp.2146476303\")\n Found reference to API \"Wow64RevertWow64FsRedirection\" (Indicator: \"Wow64RevertWow64FsRedirection\"; File: \"is-G6U9O.tmp.2146476303\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-553","sources":[{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\"Broom.exe\" called \"CreateCompatibleBitmap\" (UID: 00000000-00001956)\n \"Broom.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"469830245\"\n \"cx\": \"32\"\n \"cy\": \"32\"}\n \"Broom.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"469830245\"\n \"cx\": \"16\"\n \"cy\": \"16\"}\n \"Broom.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"469830245\"\n \"cx\": \"64\"\n \"cy\": \"16\"}\n \"Broom.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"469830245\"\n \"cx\": \"64\"\n \"cy\": \"64\"}\n \"Broom.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"469830245\"\n \"cx\": \"4800\"\n \"cy\": \"64\"}\n \"Broom.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"33622352\"\n \"cx\": \"320\"\n \"cy\": \"20\"}\n \"Broom.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"33622352\"\n \"cx\": \"5\"\n \"cy\": \"215\"}\n \"Broom.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"33622352\"\n \"cx\": \"320\"\n \"cy\": \"5\"}\n \"Broom.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"33622352\"\n \"cx\": \"293\"\n \"cy\": \"20\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"kos4.exe\" called \"GetComputerNameW\" (UID: 00000000-00001168)\n \"is-G6U9O.tmp\" called \"GetComputerNameA\" (UID: 00000000-00006016)\n \"is-G6U9O.tmp\" called \"GetComputerNameW\" (UID: 00000000-00006016)\n \"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00006668)\n \"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00007024)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"kos4.exe\" called \"GetUserNameExW\" (UID: 00000000-00001168)\n \"is-G6U9O.tmp\" called \"GetUserNameA\" (UID: 00000000-00006016)\n \"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$85","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$86","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate running processes using Tasklist","description":"Observed string: \"tasklist.exe\" [Source: 00000000-00001956.00000001.69447.05880000.00000002.mdmp]\n Observed string: \"tasklist.exe.mui\" [Source: 00000000-00001956.00000001.69447.05880000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-517","sources":[{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"$87","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"GetAsyncKeyState\" (Indicator: \"GetAsyncKeyState\"; Source: \"00000000-00001956.00000000.67528.0081E000.00000004.mdmp, 00000000-00001956.00000002.71366.0081D000.00000004.mdmp\")\n Found reference to API \"GetKeyNameTextW\" (Indicator: \"GetKeyNameText\"; Source: \"00000000-00001956.00000000.67528.0081E000.00000004.mdmp, 00000000-00001956.00000002.71366.0081D000.00000004.mdmp\")\n Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; Source: \"00000000-00001956.00000000.67528.0081E000.00000004.mdmp, 00000000-00001956.00000002.71366.0081D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"00000000-00006016.00000000.68461.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; File: \"toolspub2.exe.1363130796\")\n Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; File: \"toolspub2.exe.1363130796\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00001876.00000001.69287.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"\"Software\\Microsoft\\Windows\\CurrentVersion\\App Paths\\\" (Indicator: \"microsoft\\windows\\currentversion\\app paths\") in Source: 28332-730-0046A324\n \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 49596-3376-00466E74\n \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 49596-557-00461F40","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found strings related to keylogger","description":"Found string \"Xu|.m*t `'(+N\" (Indicator: \"\"; File: \"is-FVO5J.tmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-556","sources":[{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetCommandLine API","description":"Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: LzmwAqmV.exe]\n Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: is-U88LC.tmp]\n Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: is-G6U9O.tmp]\n Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: is-DTE8N.tmp]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete registry key/value (API string)","description":"Found reference to API \"RegDeleteKeyExA\" (Indicator: \"RegDeleteKey\"; File: \"00000000-00006016.00000000.68461.00401000.00000020.mdmp\")\n file/memory contains long string with (Indicator: \"RegDeleteValue\"; File: \"is-FVO5J.tmp\")\n file/memory contains long string with (Indicator: \"RegDeleteKey\"; File: \"is-FVO5J.tmp\")\n Found reference to API \"RegDeleteValueW\" (Indicator: \"RegDeleteValue\"; Source: \"00000000-00001876.00000001.69287.00408000.00000002.mdmp\")\n Found reference to API \"RegDeleteKeyW\" (Indicator: \"RegDeleteKey\"; Source: \"00000000-00001876.00000001.69287.00408000.00000002.mdmp\")\n Found reference to API \"RegDeleteKeyExW\" (Indicator: \"RegDeleteKey\"; Source: \"00000000-00001876.00000001.69287.0040A000.00000004.mdmp\")\n Found reference to API \"RegDeleteKeyExW\" (Indicator: \"RegDeleteKey\"; Source: \"00000000-00001956.00000000.67528.00822000.00000004.mdmp, 00000000-00001956.00000001.69447.00822000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"$88","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"kos4.exe.log\" - Location: [%LOCALAPPDATA%\\Microsoft\\CLR_v4.0\\UsageLogs\\kos4.exe.log]- [targetUID: 00000000-00001168]\n Dropped file: \"ModuleAnalysisCache\" - Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache]- [targetUID: 00000000-00006668]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"Unusual Characteristics","name":"Found Delphi 4 - Delphi 2006 artifact","description":"\"is-U88LC.tmp\" has a PE timestamp using the buggy magic timestamp 0x2A425E19. The real compilation date is probably Thu Jan 1 00:00:00 1970\n \"is-G6U9O.tmp\" has a PE timestamp using the buggy magic timestamp 0x2A425E19. The real compilation date is probably Tue Jan 7 01:19:04 1997","origin":"Static Parser","relevance":10,"id":"static-19","sources":[{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"\"#c:\\windows\\system32\\licensingui.exe\" (Indicator: \"licensingui.exe\")","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".text\n .text with unusual entropies 7.93834108988\n 7.33078288456","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":3,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"suspicious","category":"Environment Awareness","name":"Calls an API typically used to query local/system time as file time","description":"$89","origin":"API Call","mitre_attack_id":"T1070.006","relevance":3,"id":"api-223","sources":[{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to measure performance","description":"rdtsc at 63099-12584-005D06DF","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":10,"id":"stream-6","sources":[{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query CPU information","description":"cpuid at 63099-17745-0069A217\n cpuid at 63099-24665-007AF782","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":10,"id":"stream-13","sources":[{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve a module handle","description":"GetModuleHandleA@KERNEL32.dll at 3782-1-004C9820","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-121","sources":[{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure","description":"GetStartupInfoW@KERNEL32.dll at 41223-1-00407EA8\n GetStartupInfoA@KERNEL32.dll at 63099-27094-0080EAD3\n GetStartupInfoW@KERNEL32.dll at 63099-1-00407EB8\n GetStartupInfoA@KERNEL32.dll at 3782-1-004C9820","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1543","relevance":5,"id":"stream-133","sources":[{"report_type":"sandbox","report_id":"6545c54ffc6da3c2150f3f04"}]},{"level":"suspicious","category":"Exploit/Shellcode","name":"Contains escaped byte string (often part of obfuscated shellcode)","description":"\"\\% https://www.isobuster.com/help/custom_file_signature_rules\\% Various common file types to demonstrate the use of rulesLZANIM\\|.lza\\xFF\\xD8\\xFF\\o(2)\\xE?\\o()\\xFE\\o()\\|.jpgGIF\\o(2)8\\o()\\#\\x??\\o()\\|.gif\\#ID3\\|.mp3MM\\x00\\x2A\\|.kdc\\x4F\\x67\\x67\\x53\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\|.oggSFW/|.sfw\\x60\\xEA\\o(2)\\p(8)\\x10\\x00\\x02\\o()\\#\\x??\\o()\\|.arjgzip-\\>\\=1\\s(-1)\\<\\=9.\\>\\=1\\s(-1)\\<\\=9.\\>\\=1\\s(-1)\\<\\=9\\|.gz\\xEF\\xBB\\xBF\\f(4,