26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 54:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T494,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.NanoCore Sample f2b8ab95d31e… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample f2b8ab95d31e…. Malware family: Trojan.NanoCore. Threat score 100/100. 23/25 AV engines flagged this file. 15 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0","keywords":["Malicious","Trojan.NanoCore","malware analysis","sandbox report","threat intelligence","f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0"],"about":{"@type":"SoftwareApplication","name":"bUmn.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.NanoCore","antivirusDetections":{"malicious":23,"total":25},"behavioralIndicators":{"malicious":15,"suspicious":24},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T95e,Found reference to API "PipeClosed" (Indicator: "close"; Source: "sample.bin"), Found reference to API "PipeClosed" (Indicator: "pipe"; Source: "sample.bin"), Found reference to API "System.Runtime.InteropServices" (Indicator: "time"; Source: "sample.bin"), Found reference to API "CreateEncryptor" (Indicator: "creat"; Source: "sample.bin"), Found reference to API "CreateEncryptor" (Indicator: "tee"; Source: "sample.bin"), Found reference to API "ReadString" (Indicator: "read"; Source: "sample.bin"), Found reference to API "set_CreateNoWindow" (Indicator: "creat"; Source: "sample.bin"), Found reference to API "#=qKwlvi80KuDBelBsvucNuhRsqXRtqCfWqVH1dUPmd6_o=" (Indicator: "dup"; Source: "sample.bin"), Found reference to API "set_RemoteEndPoint" (Indicator: "tee"; Source: "sample.bin"), Found reference to API "SendAsync" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "Create__Instance__" (Indicator: "creat"; Source: "sample.bin"), Found reference to API "RuntimeMethodHandle" (Indicator: "time"; Source: "sample.bin"), Found reference to API "SetThreadExecutionState" (Indicator: "read"; Source: "sample.bin"), Found reference to API "SetThreadExecutionState" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "System.Threading" (Indicator: "read"; Source: "sample.bin"), Found reference to API "Disconnect" (Indicator: "connect"; Source: "sample.bin"), Found reference to API "get_RemoteEndPoint" (Indicator: "tee"; Source: "sample.bin"), Found reference to API "add_ThreadException" (Indicator: "read"; Source: "sample.bin"), Found reference to API "IAsyncResult" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "Write" (Indicator: "write"; Source: "sample.bin"), Found reference to API "CreateDirectory" (Indicator: "creat"; Source: "sample.bin"), Found reference to API "RegOpenKeyEx" (Indicator: "open"; Source: "sample.bin"), Found reference to API "EditorBrowsableState" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "OpenSubKey" (Indicator: "open"; Source: "sample.bin"), Found reference to API "FileAccess" (Indicator: "access"; Source: "sample.bin"), Found reference to API "GetKernelObjectSecurity" (Indicator: "security"; Source: "sample.bin"), Found reference to API "ReadSingle" (Indicator: "read"; Source: "sample.bin"), Found reference to API "Connected" (Indicator: "connect"; Source: "sample.bin")28:T7c1,Found reference to API (Indicator: "SetThreadExecutionState"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteFile"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBox"; Source: "sample.bin"), Found reference to API (Indicator: "CreateDirectory"; Source: "sample.bin"), Found reference to API (Indicator: "RegOpenKeyEx"; Source: "sample.bin"), Found reference to API (Indicator: "GetKernelObjectSecurity"; Source: "sample.bin"), Found reference to API (Indicator: "RegCloseKey"; Source: "sample.bin"), Found reference to API (Indicator: "SizeofResource"; Source: "sample.bin"), Found reference to API (Indicator: "CompareString"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessImageFileName"; Source: "sample.bin"), Found reference to API (Indicator: "QueueUserWorkItem"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcess"; Source: "sample.bin"), Found reference to API (Indicator: "NtSetInformationProcess"; Source: "sample.bin"), Found reference to API (Indicator: "FindResourceEx"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "LoadResource"; Source: "sample.bin"), Found reference to API (Indicator: "DnsQuery_A"; Source: "sample.bin"), Found reference to API (Indicator: "CreatePipe"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempFileName"; Source: "sample.bin"), Found reference to API (Indicator: "QueryDosDevice"; Source: "sample.bin"), Found reference to API (Indicator: "AllocConsole"; Source: "sample.bin"), Found reference to API (Indicator: "LockResource"; Source: "sample.bin"), Found reference to API (Indicator: "SetKernelObjectSecurity"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryValueEx"; Source: "sample.bin"), Found reference to API (Indicator: "CloseHandle"; Source: "sample.bin")29:T561,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00001792.00000001.80253.00591000.00000020.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00005812.00000000.75482.01EE0000.00000004.mdmp, 00000000-00005812.00000000.75482.02EE0000.00000004.mdmp, 00000000-00005812.00000001.77402.02EE0000.00000004.mdmp, 00000000-00005812.00000002.79327.02EE0000.00000004.mdmp, 00000000-00005812.00000003.84853.00870000.00000004.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00005812.00000000.75482.01EE0000.00000004.mdmp, 00000000-00005812.00000000.75482.02EE0000.00000004.mdmp, 00000000-00005812.00000001.77402.02EE0000.00000004.mdmp, 00000000-00005812.00000002.79327.02EE0000.00000004.mdmp, 00000000-00005812.00000003.84853.00870000.00000004.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00005812.00000000.75482.01EE0000.00000004.mdmp, 00000000-00005812.00000000.75482.02EE0000.00000004.mdmp, 00000000-00005812.00000001.77402.02EE0000.00000004.mdmp, 00000000-00005812.00000002.79327.02EE0000.00000004.mdmp, 00000000-00005812.00000003.84853.00870000.00000004.mdmp")2a:T73a,Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00005812.00000000.75482.01EE0000.00000004.mdmp, 00000000-00005812.00000000.75482.02EE0000.00000004.mdmp, 00000000-00005812.00000001.77402.02EE0000.00000004.mdmp, 00000000-00005812.00000002.79327.02EE0000.00000004.mdmp, 00000000-00005812.00000003.84853.00870000.00000004.mdmp") Found reference to API "Wow64GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00005812.00000000.75482.01EE0000.00000004.mdmp, 00000000-00005812.00000000.75482.02EE0000.00000004.mdmp, 00000000-00005812.00000001.77402.02EE0000.00000004.mdmp, 00000000-00005812.00000002.79327.02EE0000.00000004.mdmp, 00000000-00005812.00000003.84853.00870000.00000004.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00005812.00000000.75482.01EE0000.00000004.mdmp, 00000000-00005812.00000000.75482.02EE0000.00000004.mdmp, 00000000-00005812.00000001.77402.02EE0000.00000004.mdmp, 00000000-00005812.00000002.79327.02EE0000.00000004.mdmp, 00000000-00005812.00000003.84853.00870000.00000004.mdmp") Found reference to API "Wow64SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00005812.00000000.75482.01EE0000.00000004.mdmp, 00000000-00005812.00000000.75482.02EE0000.00000004.mdmp, 00000000-00005812.00000001.77402.02EE0000.00000004.mdmp, 00000000-00005812.00000002.79327.02EE0000.00000004.mdmp, 00000000-00005812.00000003.84853.00870000.00000004.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00005812.00000000.75482.01EE0000.00000004.mdmp, 00000000-00005812.00000000.75482.02EE0000.00000004.mdmp, 00000000-00005812.00000001.77402.02EE0000.00000004.mdmp, 00000000-00005812.00000002.79327.02EE0000.00000004.mdmp, 00000000-00005812.00000003.84853.00870000.00000004.mdmp")2b:T44b,Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00001792.00000001.80253.00591000.00000020.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00001792.00000001.80253.00591000.00000020.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001792.00000001.80253.00591000.00000020.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001792.00000001.80253.00591000.00000020.mdmp")2c:T8b0,Found XOR loop in file "pcimon.exe" at offset 35777; code bytes = 30d0 Found XOR loop in file "pcimon.exe" at offset 37674; code bytes = 30d0 Found XOR loop in file "pcimon.exe" at offset 37750; code bytes = 30d0 Found XOR loop in file "pcimon.exe" at offset 37774; code bytes = 30d0 Found XOR loop in file "pcimon.exe" at offset 37850; code bytes = 30d0 Found XOR loop in file "pcimon.exe" at offset 37986; code bytes = 30d0 Found XOR loop in file "pcimon.exe" at offset 39352; code bytes = 30d0 Found XOR loop in file "pcimon.exe" at offset 41003; code bytes = 30d0 Found XOR loop in file "pcimon.exe" at offset 186623; code bytes = 30d0 Found XOR loop in file "pcimon.exe" at offset 201530; code bytes = 30d0 Found XOR loop in file "pcimon.exe" at offset 150442; code bytes = 33c1 Found XOR loop in file "pcimon.exe" at offset 194737; code bytes = 33c1 Found XOR loop in file "pcimon.exe" at offset 9493; code bytes = 8030 Found XOR loop in file "DISMHOST.EXE.6AA909CD.bin" at offset 76665; code bytes = 30d0 Found XOR loop in file "DISMHOST.EXE.6AA909CD.bin" at offset 77648; code bytes = 8030 Found XOR loop in file "DISMHOST.EXE.6AA909CD.bin" at offset 77788; code bytes = 8030 Found XOR loop in file "DISMHOST.EXE.6AA909CD.bin" at offset 78978; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 35777; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 37674; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 37750; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 37774; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 37850; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 37986; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 39352; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 41003; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 186623; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 201530; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 150442; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 194737; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 9493; code bytes = 80302d:T330e,"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000000000001400000000000000000000000000000000000000000000000200000280fc4d004200004200000000000000000000000080000000000000001642005480a94e000100000000000000020000000c000000e00c4e00e00c4e00db0c4e00000000000000000000004a00000000014cf01e0000000000d4f11e0095e16e77f6771900feffffff435c72775059727794000000a0000000da0c4e00d80c4e009400000008f21e00fdfe6377d0ea1e001e947577d4f11e0092e02972c47ff519feffffff88f11e004c9c29725c0c00009cf11e005f9c29720000000000000000 (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006491d664000000006491d66400000000a8ef1e009f486f776691d66400000000c8ef1e00000000006691d664ccef1e004da368750000000000000000c8ef1e006491d664000000000000000004000000f8ef1e000fa368756491d664020000000000000000000000080000006491d664ffffffff010000800200000048f01e0042a26875e9fd0000080000006491d66402000000000000000100000002000000000000001d8d687500000000 (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000009c3f00a35c00000008434f00c4004a00020026001a00000000004a0000000000086d4a00e4f61e000c00000038014a000000000000eb4d00f8694a00106b4a0068ff4d00f06d4a00020000000000000048000000e8f61e0064f61e002c48ca6400004a00000000004b48ca641a6bc76b010000002c8d20650000000038374f0033374f0000000000a0f61e0060171965ffffffff4b48ca64aa48ca6400004a000000000040000000acf61e00e543ca6448e04e00e848ca64d26bc76b010000002c8d206500000000cb00000002000000d4f61e00a0fb1a65ffffffffe848ca64 (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000006b0020003100000000009c3f00a35c00000008434f00c4004a00020026001a00000000004a0000000000086d4a00e4f61e000c00000038014a000000000000eb4d00f8694a00106b4a0068ff4d00f06d4a00020000000000000048000000e8f61e0064f61e002c48ca6400004a00000000004b48ca641a6bc76b3f87d6641a6bc76b010000002c8d206500000000ccf61e0080f61e0028761665ffffffff3f87d6645d87d664f26bc76b010000002c8d206500000000ccf61e00a8f61e0028771665ffffffff5d87d6647b87d664ca6bc76b010000002c8d206500000000ccf61e00 (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000004f000100010000f51e00d4f41e00d4f41e00245973770000000030f51e000cb7e86400f51e00060000004cf51e000c876f7700000000020000004cf51e00626f727734876f779290757714d5206572c663770000000001000100060000000000b47508d5206580fc4d000000000050de206500000000bacb2bccb616f34c8990d74c2e8af50092907577f0f41e00186d6875d4f61e0095e16e7766791900feffffff34876f77c4b6e8644096e86448e04e00fcb6e8640100000088f51e00d9b6e8641cd520650100000048e04e00bcce6377000000000000000000000000b4f61e00 (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000000000001400000000000000000000000000000000000000000000000300000300134a00190000190000000000000000000000008000000000000000ad81002ce00c4e000100000000000000020000000c000000480f4e00480f4e00430f4e00000000000000000000004a0000000001b8f01e0000000000d4f61e0095e16e77f6771900feffffff435c72775059727794000000a0000000420f4e00400f4e00940000005cf21e00fdfe63773ceb1e0000000000d4f61e0092e02972c47ff519fefffffff4f11e004c9c29725c0c000008f21e005f9c29720000000000000000 (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000d2000000d20000000c0000003817510001000000020000000200000010000000d426206501000000383d20650100000040ee1e00d0ed1e00de44ca64a8e54f0000ee1e009f44ca64b844ca647e73c76bd0674e0040ee1e000100000000000000000000001cee1e001ce31965ffffffffb844ca647d44ca645673c76bd0674e0068f35000010000008a41d0641673c76bd0674e0008f9500000000000739fcf641e73c76bd0674e0008f9500000000000383d206500000000e1a7cf6400000000d0674e00 (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000ffffffff50ed1e00000000000000000034ed1e004ced1e000100000000000000020000000000000000000000a4ed1e00bb36d06488010000040000000030030000006e0000000000e936d064da70c76b020000000cee1e00000000004da06875840100009ced1e0084ed1e0018000000050000000030030000000000002c0300020000000cee1e0000000000b0ed1e00b0ead06480006e0000000000002c0300c8ed1e0015eed06480006e0000006e0000000000002c0300e8ed1e0007efd06480006e0000006e0000000000002c0300f0205100000000004cee1e00e3ecd064 (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000002010000020100000c000000280a4a0001000000020000000200000010000000d426206501000000383d20650100000060dc1e00f0db1e00de44ca64a8e54f0020dc1e009f44ca64b844ca645e41c76bd06b4e0060dc1e000100000000000000000000003cdc1e001ce31965ffffffffb844ca647d44ca643641c76bd06b4e0090645200010000008a41d064f641c76bd06b4e00e069520000000000739fcf64fe41c76bd06b4e00e069520000000000383d206500000000e1a7cf6400000000d06b4e00 (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000ca000000ca0000000c0000009806520001000000020000000200000010000000d426206501000000383d206501000000ecd91e007cd91e00de44ca64a8e54f00acd91e009f44ca64b844ca64d244c76b506c4e00ecd91e00010000000000000000000000c8d91e001ce31965ffffffffb844ca647d44ca64aa44c76b506c4e00a8ba5100010000008a41d0646a47c76b506c4e00400b4a0000000000739fcf647247c76b506c4e00400b4a0000000000383d206500000000e1a7cf6400000000506c4e00 (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000ea000000ea0000000c0000001082520001000000020000000200000010000000d426206501000000383d206501000000ecd91e007cd91e00de44ca64a8e54f00acd91e009f44ca64b844ca64d244c76bd06c4e00ecd91e00010000000000000000000000c8d91e001ce31965ffffffffb844ca647d44ca64aa44c76bd06c4e0050bc5100010000008a41d0646a47c76bd06c4e00f8bd510000000000739fcf647247c76bd06c4e00f8bd510000000000383d206500000000e1a7cf6400000000d06c4e00 (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000004010000040100000c00000050c5520001000000020000000200000010000000d426206501000000383d20650100000090ad1e0020ad1e00de44ca64a8e54f0050ad1e009f44ca64b844ca642e30c76bd06e4e0090ad1e000100000000000000000000006cad1e001ce31965ffffffffb844ca647d44ca640630c76bd06e4e00e03e5300010000008a41d064c630c76bd06e4e00a8c6520000000000739fcf64ce30c76bd06e4e00a8c6520000000000383d206500000000e1a7cf6400000000d06e4e00 (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000066040723a66a14307f0014307f00f4ed6604dc2ca66a1100000048257f00f8ed66041124a66a040000002400000010ee66045424a66a2400000014307f0010007f000600000028ee660428ee66040927a66a30ee66040927a66a0200000014307f00010000003cee6604fadba56a020000005cee6604c20aa66a010000000e00000014307f0010007f000000000002000000c0ee6604ad26a66a14307f00000000003c307f0010007f000000000014307f0001000000de0fa66a400000000500000010007f00000000000000000000000000ec0da66a0000000074577f0008000000 (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000028da1e00a414a66a0000000000000000b8436f0038da1e000723a66ab8436f00b8436f0058da1e00752aa66ab8436f000200000010006f00b8436f00000000000100000074da1e00d427a66a74da1e000927a66a04000000b8436f000200000080da1e00fadba56a04000000a0da1e00c20aa66a020000000e000000b8436f0010006f00000000000400000004db1e00ad26a66ab8436f0000000000e0436f0010006f000000000080436f0001000000b8436f000200000080346f00f8da1e0081a0a66a000000000000000080346f00010000006c876f0010006f00 (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000b3040723a66a04436f0004436f00f0e9b304dc2ca66a04436f000100000010006f0004436f000a00000010eab3042a28a66a04436f000400000010006f0004436f0000000000010000002ceab304d427a66a2ceab3040927a66a0200000004436f000100000038eab304fadba56a0200000058eab304c20aa66a010000000e00000004436f0010006f000000000002000000bceab304ad26a66a04436f000000000054436f0010006f00000000002c436f000200000004436f00010000001c326f00b0eab30481a0a66a00000000000000001100000064316f00c4466f00d4326f00 (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000001e000723a66ab0356f00b0356f00fcd11e00dc2ca66a1100000048256f0000d21e001124a66a040000002400000018d21e005424a66a24000000b0356f0010006f000600000030d21e0030d21e000927a66a38d21e000927a66a02000000b0356f000100000044d21e00fadba56a0200000064d21e00c20aa66a010000000e000000b0356f0010006f000000000002000000c8d21e00ad26a66ab0356f000000000060366f0010006f000000000000366f0002000000b0356f0001000000ff10000010006f000000000000000000000000001100000014306f0090726f00cc306f00 (UID: 00000000-00005812)2e:T6be,"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000660074002e004e00450054005c004600720061006d00650077006f0072006b005c00760032002e0030002e00350030003700320037005c006d00730063006f00720077006b0073002e0064006c006c002e0032002e0043006f006e00660069006700000007000007bcf8000050134a00 (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000636dab6a00002d00000000006c6dab6ac873c76bd8d7206558f11e0054f11e00ee2d28720d0c0000d8f01e00888cad6bd8d72065acf01e0040f11e001cf11e0058f11e00ecf01e00ff23ab6ac83bb46a2cf11e003117ab6a080000001c5c717714a17277ffffffff2400000014f11e00 (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000033003800310039003600350066003600630061003400660032006600310063006600360032003200360065003100310036003000340033003700350037003300330062006500640033006200630035003900330033003400640066006100630030002e00650078006500000002000002 (UID: 00000000-00005812)2f:T466,Found reference to API "GetWindowText" (Indicator: "GetWindowText"; Source: "00000000-00005812.00000000.75482.01EE0000.00000004.mdmp, 00000000-00005812.00000000.75482.02EE0000.00000004.mdmp, 00000000-00005812.00000001.77402.02EE0000.00000004.mdmp, 00000000-00005812.00000002.79327.02EE0000.00000004.mdmp, 00000000-00005812.00000003.84853.00870000.00000004.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00005812.00000000.75482.01EE0000.00000004.mdmp, 00000000-00005812.00000000.75482.02EE0000.00000004.mdmp, 00000000-00005812.00000001.77402.02EE0000.00000004.mdmp, 00000000-00005812.00000002.79327.02EE0000.00000004.mdmp, 00000000-00005812.00000003.84853.00870000.00000004.mdmp") Found reference to API "54495132,4056,109,,GetWindowTextW,user32.dll,"690:38:11.870",RX=0,PX=0" (Indicator: "GetWindowText"; Source: "00000000-00005812.00000003.84853.004A0000.00000004.mdmp") Found reference to API "2398514178,4676,109,,GetWindowTextW,user32.dll,"691:19:03.421",RX=0,PX=0" (Indicator: "GetWindowText"; Source: "00000000-00005812.00000003.84853.04670000.00000004.mdmp")30:T425,"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "CreateDirectoryW" with parameter %APPDATA%\733C94C5-CEBB-4F98-A75F-22A797D1D50B (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "CreateDirectoryW" with parameter %PROGRAMFILES%\PCI Monitor (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "CreateDirectoryW" with parameter %APPDATA%\733C94C5-CEBB-4F98-A75F-22A797D1D50B\Logs (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "CreateDirectoryW" with parameter %APPDATA%\733C94C5-CEBB-4F98-A75F-22A797D1D50B\Logs\%OSUSER% (UID: 00000000-00005812)31:T22d3,"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\mscorlib\9f895c66454577eff9c77442d0c84f71\mscorlib.ni.dll (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ole32.dll (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "LoadLibrary" with a parameter AdvApi32.dll (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System\ad92dab7f418877d6a1e0358ce35658a\System.ni.dll (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Drawing\ce3c98f2bf220ef17b0cf4233cac6ceb\System.Drawing.ni.dll (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\367e5b8a038ac76eba17528bb7b3688e\System.Windows.Forms.ni.dll (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\6f5bf6427122bfc30b5be76bcd651018\Microsoft.VisualBasic.ni.dll (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "LoadLibrary" with a parameter shfolder.dll (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\culture.dll (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\en-US\mscorrc.dll (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\en\mscorrc.dll (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Configuration\ad8dd536906e94c4bc9cb9b82285580b\System.Configuration.ni.dll (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Xml\77c1dc46ea139bf5e1eaa9b87ef03c7a\System.Xml.ni.dll (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "LoadLibrary" with a parameter C:\dnsapi.dll (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "LoadLibrary" with a parameter dnsapi.dll (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "LoadLibrary" with a parameter User32.dll (UID: 00000000-00005812) "schtasks.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00005736) "schtasks.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00005736)32:Tc0e1,"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionAndSpinCount (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter IsProcessorFeaturePresent (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter _set_error_mode (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter ?set_terminate@@YAP6AXXZP6AXXZ@Z (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter _get_terminate (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter FindActCtxSectionStringW (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter SetLoadedByMscoree (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GetCLRFunction (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GetTraceLoggerHandle (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GetTraceEnableLevel (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GetTraceEnableFlags (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter TraceEvent (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter IEE (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter IEE_RetAddr (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GetStartupFlags (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GetStartupFlags_RetAddr (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GetHostConfigurationFile (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GetHostConfigurationFile_RetAddr (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GetCORVersion_RetAddr (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GetCORVersion (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GetCORSystemDirectory (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GetCORSystemDirectory_RetAddr (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter RtlUnwind (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter SetThreadStackGuarantee (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter AddVectoredContinueHandler (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter RemoveVectoredContinueHandler (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GetWriteWatch (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter ResetWriteWatch (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter CreateMemoryResourceNotification (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter QueryMemoryResourceNotification (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GetVersionEx (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GetVersionExW (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter CryptAcquireContextA (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter CryptGetHashParam (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter CryptExportKey (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter CryptGenKey (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter CryptGetKeyParam (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter CryptVerifySignatureA (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter CryptSignHashA (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter CryptGetProvParam (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter CryptGetUserKey (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter CryptEnumProvidersA (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GetMetaDataInternalInterface (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GetMetaDataInternalInterface_RetAddr (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter RegisterWindowMessage (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter RegisterWindowMessageW (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter AdjustWindowRectEx (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter lstrlen (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter lstrlenW (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter RegisterClass (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter RegisterClassW (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter CreateWindowEx (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter SetWindowLong (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter SetWindowLongW (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GetWindowLong (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GetWindowLongW (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter CallWindowProc (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter CallWindowProcW (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GetParent (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter IsAppThemedW (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter CreateActCtx (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter CreateActCtxA (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GetWindowTextLength (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GetWindowTextLengthW (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GetWindowText (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GetWindowTextW (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GetUserObjectInformation (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GetUserObjectInformationA (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GetClassInfo (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GetClassInfoW (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter DefWindowProc (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GetStartupInfo (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GetStartupInfoW (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GetWindowPlacement (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GetDC (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GetDeviceCaps (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter ReleaseDC (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter CreateIconFromResourceEx (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter SendMessage (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter SendMessageW (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GetSystemMenu (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter EnableMenuItem (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter SetWindowPos (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter RedrawWindow (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter ShowWindow (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter PostMessage (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter PostMessageW (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter OleInitialize (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter CoRegisterMessageFilter (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter PeekMessage (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter PeekMessageW (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter IsWindowUnicode (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GetMessageW (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter TranslateMessage (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter DispatchMessageW (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GetFocus (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GetModuleFileName (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter SetCurrentDirectory (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter SetCurrentDirectoryW (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter FindResourceEx (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter FindResourceExA (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter LoadResource (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter SizeofResource (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter LockResource (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter CryptSetKeyParam (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter CryptDecrypt (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter CryptEncrypt (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter CreateMutex (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter CreateMutexW (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter RegOpenKeyExA (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter SetErrorMode (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter CreateDirectory (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter CreateDirectoryW (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter DeleteFile (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter CopyFile (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter CopyFileW (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter RegSetValueEx (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter DllGetClassObject_RetAddr (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GetSidSubAuthorityCount (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GetSidSubAuthority (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter DllGetClassObjectInternal (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GetTempPath (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GetTempFileName (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GetTempFileNameW (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GetCurrentDirectory (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter CreateProcess (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter CreateProcessW (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter DeleteFileA (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter CreateIoCompletionPort (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter PostQueuedCompletionStatus (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter NtGetCurrentProcessorNumber (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter SetThreadExecutionState (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter LoadLibraryShim_RetAddr (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter LoadLibraryShim (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter ConvertLangIdToCultureName (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GetForegroundWindow (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter EnumProcesses (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter EnumProcessesW (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GetKeyboardLayout (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GlobalMemoryStatusEx (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter RegisterRawInputDevices (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter SetClipboardViewer (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter SendMessageA (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter WSASocket (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter setsockopt (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter WSAEventSelect (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter ioctlsocket (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter closesocket (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter ND_RI2 (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter ND_RI2_RetAddr (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GetComputerName (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GetComputerNameW (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter ConvertStringSecurityDescriptorToSecurityDescriptor (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter ConvertStringSecurityDescriptorToSecurityDescriptorW (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter CreateFileMapping (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter CreateFileMappingW (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter MapViewOfFile (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter VirtualQuery (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter CreateWellKnownSidW (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter OpenMutex (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter OpenMutexW (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GetProcessTimes (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GetProcessTimesW (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter inet_addr (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter WaitMessage (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter DnsQuery_A (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter getaddrinfo (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter freeaddrinfo (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter FormatMessage (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter SwitchToThread (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter OleGetClipboard (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter CoGetObjectContext (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GlobalLock (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GlobalUnlock (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GlobalFree (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter bind (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter WSAGetOverlappedResult (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GetRawInputData (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter GetKeyboardState (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter MapVirtualKeyEx (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter MapVirtualKeyExA (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter ToUnicodeEx (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "GetProcAddress" with a parameter ToUnicodeExW (UID: 00000000-00005812) "schtasks.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005736) "schtasks.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00005736) "schtasks.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00005736) "schtasks.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005736) "schtasks.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005736) "schtasks.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005736) "schtasks.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00005736) "schtasks.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005932) "schtasks.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005932) "schtasks.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005932) "schtasks.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005932)33:T84d,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00001792.00000001.80253.00591000.00000020.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00005812.00000000.75482.01EE0000.00000004.mdmp, 00000000-00005812.00000000.75482.02EE0000.00000004.mdmp, 00000000-00005812.00000001.77402.02EE0000.00000004.mdmp, 00000000-00005812.00000002.79327.02EE0000.00000004.mdmp, 00000000-00005812.00000003.84853.00870000.00000004.mdmp") Found reference to API "Wow64GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00005812.00000000.75482.01EE0000.00000004.mdmp, 00000000-00005812.00000000.75482.02EE0000.00000004.mdmp, 00000000-00005812.00000001.77402.02EE0000.00000004.mdmp, 00000000-00005812.00000002.79327.02EE0000.00000004.mdmp, 00000000-00005812.00000003.84853.00870000.00000004.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00005812.00000000.75482.01EE0000.00000004.mdmp, 00000000-00005812.00000000.75482.02EE0000.00000004.mdmp, 00000000-00005812.00000001.77402.02EE0000.00000004.mdmp, 00000000-00005812.00000002.79327.02EE0000.00000004.mdmp, 00000000-00005812.00000003.84853.00870000.00000004.mdmp") Found reference to API "Wow64SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00005812.00000000.75482.01EE0000.00000004.mdmp, 00000000-00005812.00000000.75482.02EE0000.00000004.mdmp, 00000000-00005812.00000001.77402.02EE0000.00000004.mdmp, 00000000-00005812.00000002.79327.02EE0000.00000004.mdmp, 00000000-00005812.00000003.84853.00870000.00000004.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00005812.00000000.75482.01EE0000.00000004.mdmp, 00000000-00005812.00000000.75482.02EE0000.00000004.mdmp, 00000000-00005812.00000001.77402.02EE0000.00000004.mdmp, 00000000-00005812.00000002.79327.02EE0000.00000004.mdmp, 00000000-00005812.00000003.84853.00870000.00000004.mdmp")34:T1eb5,"Software\\Microsoft\\Windows\\CurrentVersion\\Run" in Source: 6000069-#_qjIje6jGWLd2EOkfZXKqBbg_~#_qKwlvi80KuDBelBsvucNuhRsqXRtqCfWqVH1dUPmd6_o_ "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System" in Source: 600007d-#_qjIje6jGWLd2EOkfZXKqBbg_~#_q_WoKv7McWxMc2YtmbiVaCw_ "SOFTWARE\\Microsoft\\Cryptography" in Source: 600007f-#_qjIje6jGWLd2EOkfZXKqBbg_~#_qArVl3RpI3eEiVf0qXoqrWw_ "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00001792.00000001.80253.00591000.00000020.mdmp "Software\Microsoft\.NETFramework" in Source: 00000000-00005812.00000000.75482.01EE0000.00000004.mdmp 00000000-00005812.00000001.77402.01EE0000.00000004.mdmp 00000000-00005812.00000002.79327.01EE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\." in Source: 00000000-00005812.00000000.75482.01EE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework" in Source: 00000000-00005812.00000000.75482.01EE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\DbgJITDebugLaunchSetting" in Source: 00000000-00005812.00000000.75482.01EE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\DbgManagedDebugger" in Source: 00000000-00005812.00000000.75482.01EE0000.00000004.mdmp "System\CurrentControlSet\Control\Lsa" in Source: 00000000-00005812.00000000.75482.01EE0000.00000004.mdmp 00000000-00005812.00000001.77402.01EE0000.00000004.mdmp 00000000-00005812.00000002.79327.01EE0000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography" in Source: 00000000-00005812.00000000.75482.01EE0000.00000004.mdmp 00000000-00005812.00000001.77402.01EE0000.00000004.mdmp 00000000-00005812.00000002.79327.01EE0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00005812.00000000.75482.01EE0000.00000004.mdmp 00000000-00005812.00000001.77402.01EE0000.00000004.mdmp 00000000-00005812.00000002.79327.01EE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\." in Source: 00000000-00005812.00000000.75482.01EE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00005812.00000000.75482.01EE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA" in Source: 00000000-00005812.00000000.75482.01EE0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00005812.00000000.75482.01EE0000.00000004.mdmp 00000000-00005812.00000001.77402.01EE0000.00000004.mdmp 00000000-00005812.00000002.79327.01EE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\." in Source: 00000000-00005812.00000000.75482.01EE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00005812.00000000.75482.01EE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\PCI Monitor" in Source: 00000000-00005812.00000000.75482.01EE0000.00000004.mdmp "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\." in Source: 00000000-00005812.00000000.75482.01EE0000.00000004.mdmp "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00005812.00000000.75482.01EE0000.00000004.mdmp "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\PCI Monitor" in Source: 00000000-00005812.00000000.75482.01EE0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00005812.00000001.77402.004A0000.00000004.mdmp 00000000-00005812.00000002.79327.004A0000.00000004.mdmp 00000000-00005812.00000003.84853.004A0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00005812.00000001.77402.004A0000.00000004.mdmp 00000000-00005812.00000002.79327.004A0000.00000004.mdmp 00000000-00005812.00000003.84853.004A0000.00000004.mdmp "Read?HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersionH" in Source: 00000000-00005812.00000001.77402.004A0000.00000004.mdmp 00000000-00005812.00000002.79327.004A0000.00000004.mdmp 00000000-00005812.00000003.84853.004A0000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005812.00000001.77402.01EE0000.00000004.mdmp 00000000-00005812.00000002.79327.01EE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\." in Source: 00000000-00005812.00000001.77402.01EE0000.00000004.mdmp 00000000-00005812.00000002.79327.01EE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005812.00000001.77402.01EE0000.00000004.mdmp 00000000-00005812.00000002.79327.01EE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\InstallationType" in Source: 00000000-00005812.00000001.77402.01EE0000.00000004.mdmp 00000000-00005812.00000002.79327.01EE0000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\" in Source: 00000000-00005812.00000001.77402.01EE0000.00000004.mdmp 00000000-00005812.00000002.79327.01EE0000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance" in Source: 00000000-00005812.00000001.77402.01EE0000.00000004.mdmp 00000000-00005812.00000002.79327.01EE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance\." in Source: 00000000-00005812.00000001.77402.01EE0000.00000004.mdmp 00000000-00005812.00000002.79327.01EE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance" in Source: 00000000-00005812.00000001.77402.01EE0000.00000004.mdmp 00000000-00005812.00000002.79327.01EE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance\Library" in Source: 00000000-00005812.00000001.77402.01EE0000.00000004.mdmp 00000000-00005812.00000002.79327.01EE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance\IsMultiInstance" in Source: 00000000-00005812.00000001.77402.01EE0000.00000004.mdmp 00000000-00005812.00000002.79327.01EE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance\First Counter" in Source: 00000000-00005812.00000001.77402.01EE0000.00000004.mdmp 00000000-00005812.00000002.79327.01EE0000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\.net clr networking\Performance" in Source: 00000000-00005812.00000001.77402.01EE0000.00000004.mdmp 00000000-00005812.00000002.79327.01EE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance\." in Source: 00000000-00005812.00000001.77402.01EE0000.00000004.mdmp 00000000-00005812.00000002.79327.01EE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance" in Source: 00000000-00005812.00000001.77402.01EE0000.00000004.mdmp 00000000-00005812.00000002.79327.01EE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance\CategoryOptions" in Source: 00000000-00005812.00000001.77402.01EE0000.00000004.mdmp 00000000-00005812.00000002.79327.01EE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance\FileMappingSize" in Source: 00000000-00005812.00000001.77402.01EE0000.00000004.mdmp 00000000-00005812.00000002.79327.01EE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance\Counter Names" in Source: 00000000-00005812.00000001.77402.01EE0000.00000004.mdmp 00000000-00005812.00000002.79327.01EE0000.00000004.mdmp35:T6a4,"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ole32.dll" - [base:0; Status:c0000135] "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" failed to load missing module "%WINDIR%\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" failed to load missing module "%WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" failed to load missing module "%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" failed to load missing module "%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" failed to load missing module "%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" failed to load missing module "C:\dnsapi.dll" - [base:0; Status:c0000135]36:T27fd,"Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00001792.00000001.80253.00591000.00000020.mdmp "SOFTWARE\Microsoft\Cryptography" in Source: 00000000-00005812.00000000.75482.01EE0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00005812.00000000.75482.01EE0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00005812.00000000.75482.01EE0000.00000004.mdmp "Software\Microsoft\.NETFramework" in Source: 00000000-00005812.00000000.75482.01EE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\." in Source: 00000000-00005812.00000000.75482.01EE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework" in Source: 00000000-00005812.00000000.75482.01EE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\DbgJITDebugLaunchSetting" in Source: 00000000-00005812.00000000.75482.01EE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\DbgManagedDebugger" in Source: 00000000-00005812.00000000.75482.01EE0000.00000004.mdmp "System\CurrentControlSet\Control\Lsa" in Source: 00000000-00005812.00000000.75482.01EE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\." in Source: 00000000-00005812.00000000.75482.01EE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00005812.00000000.75482.01EE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA" in Source: 00000000-00005812.00000000.75482.01EE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\." in Source: 00000000-00005812.00000000.75482.01EE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00005812.00000000.75482.01EE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\PCI Monitor" in Source: 00000000-00005812.00000000.75482.01EE0000.00000004.mdmp "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\." in Source: 00000000-00005812.00000000.75482.01EE0000.00000004.mdmp "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00005812.00000000.75482.01EE0000.00000004.mdmp "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\PCI Monitor" in Source: 00000000-00005812.00000000.75482.01EE0000.00000004.mdmp "Read?HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersionH" in Source: 00000000-00005812.00000001.77402.004A0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00005812.00000001.77402.004A0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00005812.00000001.77402.004A0000.00000004.mdmp "Software\Microsoft\.NETFramework" in Source: 00000000-00005812.00000001.77402.01EE0000.00000004.mdmp "System\CurrentControlSet\Control\Lsa" in Source: 00000000-00005812.00000001.77402.01EE0000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography" in Source: 00000000-00005812.00000001.77402.01EE0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00005812.00000001.77402.01EE0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00005812.00000001.77402.01EE0000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005812.00000001.77402.01EE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\." in Source: 00000000-00005812.00000001.77402.01EE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005812.00000001.77402.01EE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\InstallationType" in Source: 00000000-00005812.00000001.77402.01EE0000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\" in Source: 00000000-00005812.00000001.77402.01EE0000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance" in Source: 00000000-00005812.00000001.77402.01EE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance\." in Source: 00000000-00005812.00000001.77402.01EE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance" in Source: 00000000-00005812.00000001.77402.01EE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance\Library" in Source: 00000000-00005812.00000001.77402.01EE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance\IsMultiInstance" in Source: 00000000-00005812.00000001.77402.01EE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance\First Counter" in Source: 00000000-00005812.00000001.77402.01EE0000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\.net clr networking\Performance" in Source: 00000000-00005812.00000001.77402.01EE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance\." in Source: 00000000-00005812.00000001.77402.01EE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance" in Source: 00000000-00005812.00000001.77402.01EE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance\CategoryOptions" in Source: 00000000-00005812.00000001.77402.01EE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance\FileMappingSize" in Source: 00000000-00005812.00000001.77402.01EE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance\Counter Names" in Source: 00000000-00005812.00000001.77402.01EE0000.00000004.mdmp "Read?HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersionH" in Source: 00000000-00005812.00000002.79327.004A0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00005812.00000002.79327.004A0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00005812.00000002.79327.004A0000.00000004.mdmp "Software\Microsoft\.NETFramework" in Source: 00000000-00005812.00000002.79327.01EE0000.00000004.mdmp "System\CurrentControlSet\Control\Lsa" in Source: 00000000-00005812.00000002.79327.01EE0000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography" in Source: 00000000-00005812.00000002.79327.01EE0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00005812.00000002.79327.01EE0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00005812.00000002.79327.01EE0000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005812.00000002.79327.01EE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\." in Source: 00000000-00005812.00000002.79327.01EE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005812.00000002.79327.01EE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\InstallationType" in Source: 00000000-00005812.00000002.79327.01EE0000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\" in Source: 00000000-00005812.00000002.79327.01EE0000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance" in Source: 00000000-00005812.00000002.79327.01EE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance\." in Source: 00000000-00005812.00000002.79327.01EE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance" in Source: 00000000-00005812.00000002.79327.01EE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance\Library" in Source: 00000000-00005812.00000002.79327.01EE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance\IsMultiInstance" in Source: 00000000-00005812.00000002.79327.01EE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance\First Counter" in Source: 00000000-00005812.00000002.79327.01EE0000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\.net clr networking\Performance" in Source: 00000000-00005812.00000002.79327.01EE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance\." in Source: 00000000-00005812.00000002.79327.01EE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance" in Source: 00000000-00005812.00000002.79327.01EE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance\CategoryOptions" in Source: 00000000-00005812.00000002.79327.01EE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance\FileMappingSize" in Source: 00000000-00005812.00000002.79327.01EE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance\Counter Names" in Source: 00000000-00005812.00000002.79327.01EE0000.00000004.mdmp "Read?HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersionH" in Source: 00000000-00005812.00000003.84853.004A0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00005812.00000003.84853.004A0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00005812.00000003.84853.004A0000.00000004.mdmp37:T1b6b,"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6ab50000 "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" loaded module "VERSION.DLL" at base 74a70000 "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORWKS.DLL" at base 64ca0000 "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" loaded module "USER32.DLL" at base 75bf0000 "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" loaded module "MSCOREE.DLL" at base 6bad0000 "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" loaded module "NTDLL" at base 776d0000 "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" loaded module "ADVAPI32.DLL" at base 75b40000 "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" loaded module "SHELL32.DLL" at base 76530000 "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" loaded module "OLE32.DLL" at base 77180000 "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" loaded module "KERNEL32.DLL" at base 775f0000 "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 77820000 "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" loaded module "PROFAPI.DLL" at base 755e0000 "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MSCORLIB\9F895C66454577EFF9C77442D0C84F71\MSCORLIB.NI.DLL" at base 641a0000 "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" loaded module "CRYPTBASE.DLL" at base 754d0000 "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74320000 "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM\AD92DAB7F418877D6A1E0358CE35658A\SYSTEM.NI.DLL" at base 639f0000 "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.DRAWING\CE3C98F2BF220EF17B0CF4233CAC6CEB\SYSTEM.DRAWING.NI.DLL" at base 69ca0000 "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.WINDOWS.FORMS\367E5B8A038AC76EBA17528BB7B3688E\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 62e10000 "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORJIT.DLL" at base 6aa50000 "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.VISUALBAS#\6F5BF6427122BFC30B5BE76BCD651018\MICROSOFT.VISUALBASIC.NI.DLL" at base 69b00000 "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" loaded module "GDI32.DLL" at base 75cc0000 "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" loaded module "UXTHEME.DLL" at base 74320000 "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" loaded module "DWMAPI.DLL" at base 73e40000 "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" loaded module "CRYPTSP.DLL" at base 74fe0000 "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74d70000 "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" loaded module "BCRYPT.DLL" at base 750f0000 "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" loaded module "SHFOLDER.DLL" at base 72220000 "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\DIASYMREADER.DLL" at base 6bca0000 "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75480000 "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" loaded module "RPCRT4.DLL" at base 77840000 "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 77820000 "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" loaded module "RPCRTREMOTE.DLL" at base 75570000 "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" loaded module "NTDLL.DLL" at base 776d0000 "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CULTURE.DLL" at base 72210000 "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" loaded module "SSPICLI.DLL" at base 75460000 "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" loaded module "PSAPI.DLL" at base 75fd0000 "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" loaded module "WS2_32.DLL" at base 75fe0000 "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74fa0000 "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 74b00000 "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 74f90000 "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CONFIGURATION\AD8DD536906E94C4BC9CB9B82285580B\SYSTEM.CONFIGURATION.NI.DLL" at base 6a740000 "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.XML\77C1DC46EA139BF5E1EAA9B87EF03C7A\SYSTEM.XML.NI.DLL" at base 628d0000 "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" loaded module "DNSAPI.DLL" at base 74e60000 "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" loaded module "IPHLPAPI.DLL" at base 73930000 "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" loaded module "RASADHLP.DLL" at base 71c90000 "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" loaded module "OLEAUT32.DLL" at base 76180000 "schtasks.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74320000 "schtasks.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6ab50000 "schtasks.exe" loaded module "RPCRT4.DLL" at base 77840000 "schtasks.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 77820000 "schtasks.exe" loaded module "ADVAPI32.DLL" at base 75b40000 "schtasks.exe" loaded module "CLBCATQ.DLL" at base 772e0000 "schtasks.exe" loaded module "%WINDIR%\SYSTEM32\TASKSCHD.DLL" at base 73be0000 "schtasks.exe" loaded module "SSPICLI.DLL" at base 7546000038:T40f,"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0" was detected as "Eazfuscator" and name: "Protector" "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0" was detected as ".NET" and name: "Library" "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0" was detected as "VB.NET" and name: "Compiler" "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0" was detected as "Microsoft Linker" and name: "Linker" "pcimon.exe" was detected as "Eazfuscator" and name: "Protector" "pcimon.exe" was detected as ".NET" and name: "Library" "pcimon.exe" was detected as "VB.NET" and name: "Compiler" "pcimon.exe" was detected as "Microsoft Linker" and name: "Linker" "DISMHOST.EXE.6AA909CD.bin" was detected as "Eazfuscator" and name: "Protector" "DISMHOST.EXE.6AA909CD.bin" was detected as ".NET" and name: "Library" "DISMHOST.EXE.6AA909CD.bin" was detected as "VB.NET" and name: "Compiler" "DISMHOST.EXE.6AA909CD.bin" was detected as "Microsoft Linker" and name: "Linker"39:Tc19,"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "pcimon.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "DISMHOST.EXE.6AA909CD.bin" file has an entrypoint instructions - "call 0x100a7e6,jmp 0x10097f4,int3 ,int3 ,int3 ,int3 ,int3 ,push 0x14,push 0x1010878,call 0x1009d10,and dword ptr [ebp - 4], 0,dec dword ptr [ebp + 0x10],js 0x1009afc,mov ecx, dword ptr [ebp + 8],sub ecx, dword ptr [ebp + 0xc],mov dword ptr [ebp + 8], ecx,call dword ptr [ebp + 0x14],jmp 0x1009abc,mov eax, dword ptr [ebp - 0x14],mov dword ptr [ebp - 0x1c], eax,mov eax, dword ptr [ebp - 0x1c],mov eax, dword ptr [eax],mov dword ptr [ebp - 0x20], eax,mov eax, dword ptr [ebp - 0x20],cmp dword ptr [eax], 0xe06d7363,je 0x1009af3,mov dword ptr [ebp - 0x24], 0,mov eax, dword ptr [ebp - 0x24],ret ,call dword ptr [0x1001210],mov esp, dword ptr [ebp - 0x18],"3a:Td64,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll" [Source: 00000000-00005812-00000C2B-183202782] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_32\mscorlib\9f895c66454577eff9c77442d0c84f71\mscorlib.ni.dll" [Source: 00000000-00005812-00000C2B-184121110] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ole32.dll" [Source: 00000000-00005812-00000C2B-184225418] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00005812-00000C2B-184389942] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_32\System\ad92dab7f418877d6a1e0358ce35658a\System.ni.dll" [Source: 00000000-00005812-00000C2B-185086372] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Drawing\ce3c98f2bf220ef17b0cf4233cac6ceb\System.Drawing.ni.dll" [Source: 00000000-00005812-00000C2B-185172026] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\367e5b8a038ac76eba17528bb7b3688e\System.Windows.Forms.ni.dll" [Source: 00000000-00005812-00000C2B-185266933] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll" [Source: 00000000-00005812-00000C2B-185386409] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\6f5bf6427122bfc30b5be76bcd651018\Microsoft.VisualBasic.ni.dll" [Source: 00000000-00005812-00000C2B-185480512] Observed system executable string:"%WINDIR%\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\uxtheme.dll" [Source: 00000000-00005812-00000C2B-186145488] Observed system executable string:"%WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00005812-00000C2B-186778204] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll" [Source: 00000000-00005812-00000C2B-187372638] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v2.0.50727\culture.dll" [Source: 00000000-00005812-00000C2B-188766467] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v2.0.50727\en-US\mscorrc.dll" [Source: 00000000-00005812-00000C2B-188848444] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v2.0.50727\en\mscorrc.dll" [Source: 00000000-00005812-00000C2B-188927421] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll" [Source: 00000000-00005812-00000C2B-189011238] Observed system executable string:"%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00005812-00000C2B-189245970] Observed system executable string:"%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00005812-00000C2B-189409368] Observed system executable string:"%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ws2_32.dll" [Source: 00000000-00005812-00000C2B-189641850] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Configuration\ad8dd536906e94c4bc9cb9b82285580b\System.Configuration.ni.dll" [Source: 00000000-00005812-00000C2B-189836923] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Xml\77c1dc46ea139bf5e1eaa9b87ef03c7a\System.Xml.ni.dll" [Source: 00000000-00005812-00000C2B-189948481]3b:T4b9,"pcimon.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\PCI Monitor\pcimon.exe]- [targetUID: 00000000-00005812] "dism.log" has type "Unicode text UTF-8 (with BOM) text with very long lines (312) with CRLF line terminators"- [targetUID: 00000000-00005812] "DISMHOST.EXE.6AA909CD.bin" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 4 sections"- [targetUID: 00000000-00005812] "tmpF739.tmp" has type "XML 1.0 document ASCII text with CRLF line terminators"- Location: [%TEMP%\tmpF739.tmp]- [targetUID: 00000000-00005812] "tmpF99B.tmp" has type "XML 1.0 document ASCII text with CRLF line terminators"- Location: [%TEMP%\tmpF99B.tmp]- [targetUID: 00000000-00005812] "KB_-1820449351.dat" has type "data"- Location: [%APPDATA%\733C94C5-CEBB-4F98-A75F-22A797D1D50B\Logs\%OSUSER%\KB_-1820449351.dat]- [targetUID: 00000000-00005812] "task.dat" has type "ASCII text with no line terminators"- Location: [%APPDATA%\733C94C5-CEBB-4F98-A75F-22A797D1D50B\task.dat]- [targetUID: 00000000-00005812] "run.dat" has type "data"- Location: [%APPDATA%\733C94C5-CEBB-4F98-A75F-22A797D1D50B\run.dat]- [targetUID: 00000000-00005812]3c:T706,"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: ""; Value: "") "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\ROMANCE STANDARD TIME\DYNAMIC DST"; Key: ""; Value: "") "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS NT\DNSCLIENT\DNSPOLICYCONFIG"; Key: ""; Value: "") "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS\DNSPOLICYCONFIG"; Key: ""; Value: "") "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "") "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: ""; Value: "")3d:T796,"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "BIAS"; Value: "") "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDNAME"; Value: "") "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDBIAS"; Value: "") "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDSTART"; Value: "") "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTNAME"; Value: "") "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTBIAS"; Value: "") "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTSTART"; Value: "") "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "TIMEZONEKEYNAME"; Value: "") "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DYNAMICDAYLIGHTTIMEDISABLED"; Value: "") "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "ACTIVETIMEBIAS"; Value: "")3e:Tacd,"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" trying to touch file "C:\Windows\SYSTEM32\MSCOREE.DLL" "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" trying to touch file "C:\Windows\SYSTEM32\MSCOREE.DLL.local" "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-synch-l1-2-0.DLL" "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" trying to touch file "C:\Windows\system32\IMM32.DLL" "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" trying to touch file "C:\FLTLIB.DLL" "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" trying to touch file "C:\Windows\system32\FLTLIB.DLL" "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" trying to touch file "C:\MSVCP140.dll" "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" trying to touch file "C:\Windows\system32\MSVCP140.dll" "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" trying to touch file "C:\VCRUNTIME140.dll" "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" trying to touch file "C:\Windows\system32\VCRUNTIME140.dll" "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" trying to touch file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" trying to touch file "C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll" "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" trying to touch file "C:\ucrtbase.DLL" "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" trying to touch file "C:\Windows\system32\ucrtbase.DLL" "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" trying to touch file "C:\api-ms-win-core-timezone-l1-1-0.dll" "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-timezone-l1-1-0.dll"3f:Tc66,"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" trying to access non-existent file "C:\FLTLIB.DLL" "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" trying to access non-existent file "C:\MSVCP140.dll" "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" trying to access non-existent file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" trying to access non-existent file "C:\ucrtbase.DLL" "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" trying to access non-existent file "C:\api-ms-win-core-timezone-l1-1-0.dll" "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" trying to access non-existent file "C:\api-ms-win-core-file-l2-1-0.dll" "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" trying to access non-existent file "C:\api-ms-win-core-localization-l1-2-0.dll" "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" trying to access non-existent file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" trying to access non-existent file "C:\api-ms-win-core-file-l1-2-0.dll" "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" trying to access non-existent file "C:\api-ms-win-crt-heap-l1-1-0.dll" "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" trying to access non-existent file "C:\api-ms-win-crt-string-l1-1-0.dll" "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" trying to access non-existent file "C:\api-ms-win-crt-stdio-l1-1-0.dll" "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" trying to access non-existent file "C:\api-ms-win-crt-convert-l1-1-0.dll" "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" trying to access non-existent file "C:\api-ms-win-crt-locale-l1-1-0.dll" "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" trying to access non-existent file "C:\api-ms-win-crt-filesystem-l1-1-0.dll" "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" trying to access non-existent file "C:\api-ms-win-crt-time-l1-1-0.dll" "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" trying to access non-existent file "C:\api-ms-win-crt-environment-l1-1-0.dll" "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" trying to access non-existent file "C:\api-ms-win-crt-math-l1-1-0.dll" "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" trying to access non-existent file "C:\api-ms-win-crt-utility-l1-1-0.dll"40:Tb73,"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" trying to access non-existent file "C:\Windows\SYSTEM32\MSCOREE.DLL.local" "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" trying to access non-existent file "C:\f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe.Local\" "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\fusion.localgac" "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" trying to access non-existent file "C:\f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe.config" "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" trying to access non-existent file "C:\Windows\Globalization\en-us.nlp" "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" trying to access non-existent file "C:\f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.PDB" "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" trying to access non-existent file "C:\f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe:Zone.Identifier" "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" trying to access non-existent file "C:\Windows\Globalization\en.nlp" "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" trying to access non-existent file "C:\F2B8AB95D31E2E8381965F6CA4F2F1CF6226E11604375733BED3BC59334DFAC0.EXE.CONFIG" "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" trying to access non-existent file "C:\F2B8AB95D31E2E8381965F6CA4F2F1CF6226E11604375733BED3BC59334DFAC0.EXE.LOCAL" "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\FUSION.LOCALGAC" "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\SECURITY.CONFIG" "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\SECURITY.CONFIG.CCH" "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\ENTERPRISESEC.CONFIG" "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\ENTERPRISESEC.CONFIG.CCH" "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME"41:T7c5,Found reference to API "Unable to change this property while socket is in use." (Indicator: " socket "; File: "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0") Found reference to API "WSAStartup" (Indicator: "wsastartup"; Source: "00000000-00005812-00000C2C-189802093") Found reference to API "inet_addr" (Indicator: "inet_addr"; Source: "00000000-00005812-00000C2C-190152143") Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00005812.00000000.75482.00A90000.00000002.mdmp, 00000000-00005812.00000001.77402.00A90000.00000002.mdmp, 00000000-00005812.00000002.79327.00A90000.00000002.mdmp") Found reference to API "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." (Indicator: " bind "; Source: "00000000-00005812.00000001.77402.004A0000.00000004.mdmp, 00000000-00005812.00000002.79327.004A0000.00000004.mdmp, 00000000-00005812.00000003.84853.004A0000.00000004.mdmp") Found reference to API "ote: There is some performance penalty associated with assembly bind failure logging." (Indicator: " bind "; Source: "00000000-00005812.00000001.77402.004A0000.00000004.mdmp, 00000000-00005812.00000002.79327.004A0000.00000004.mdmp, 00000000-00005812.00000003.84853.004A0000.00000004.mdmp") Found reference to API "at System.Net.Dns.InternalGetHostByName(String hostName, Boolean includeIPv6)" (Indicator: "gethostbyname"; Source: "00000000-00005812.00000001.77402.01EE0000.00000004.mdmp, 00000000-00005812.00000002.79327.01EE0000.00000004.mdmp") Found reference to API "GetHostByName" (Indicator: "gethostbyname"; Source: "00000000-00005812.00000001.77402.01EE0000.00000004.mdmp, 00000000-00005812.00000002.79327.01EE0000.00000004.mdmp") Found reference to API "InternalGetHostByName" (Indicator: "gethostbyname"; Source: "00000000-00005812.00000001.77402.01EE0000.00000004.mdmp, 00000000-00005812.00000002.79327.01EE0000.00000004.mdmp")42:T8bc,Found string "" (Indicator: "System.Data.SqlClient"; Source: "00000000-00005812.00000000.75482.004A0000.00000004.mdmp") Found string "type="System.Data.OleDb.OleDbFactory System.Data Version=2.0.0.0 Culture=neutral PublicKeyToken=b" (Indicator: "System.Data.OleDb"; Source: "00000000-00005812.00000000.75482.004A0000.00000004.mdmp"), Found string "" (Indicator: "System.Data.SqlClient"; Source: "00000000-00005812.00000001.77402.01EE0000.00000004.mdmp, 00000000-00005812.00000002.79327.01EE0000.00000004.mdmp") Found string "System.Data.SqlClient" (Indicator: "System.Data.SqlClient"; Source: "00000000-00005812.00000001.77402.01EE0000.00000004.mdmp, 00000000-00005812.00000002.79327.01EE0000.00000004.mdmp")43:T6e7,"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.INI (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "FindFirstFileW" with parameter C:\f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.INI (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.INI (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.INI (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.INI (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.INI (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.INI (UID: 00000000-00005812) "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.Xml.INI (UID: 00000000-00005812)44:T72c,Found string "estionAndAnswer="true" applicationName="/" requiresUniqueEmail="false" passwordFormat="Hashed" maxInva" (Indicator: "password"; Source: "00000000-00005812.00000000.75482.004A0000.00000004.mdmp, 00000000-00005812.00000001.77402.004A0000.00000004.mdmp, 00000000-00005812.00000002.79327.004A0000.00000004.mdmp, 00000000-00005812.00000003.84853.004A0000.00000004.mdmp") Found string "swordAttempts="5" minRequiredPasswordLength="7" minRequiredNonalphanumericCharacters="1" passwordAttemR" (Indicator: "password"; Source: "00000000-00005812.00000000.75482.004A0000.00000004.mdmp, 00000000-00005812.00000001.77402.004A0000.00000004.mdmp, 00000000-00005812.00000002.79327.004A0000.00000004.mdmp, 00000000-00005812.00000003.84853.004A0000.00000004.mdmp") Found string "ow="10" passwordStrengthRegularExpression=""/>" (Indicator: "password"; Source: "00000000-00005812.00000000.75482.004A0000.00000004.mdmp, 00000000-00005812.00000001.77402.004A0000.00000004.mdmp, 00000000-00005812.00000002.79327.004A0000.00000004.mdmp, 00000000-00005812.00000003.84853.004A0000.00000004.mdmp") file/memory contains long string with (Indicator: "password"; Source: "00000000-00005812.00000001.77402.01EE0000.00000004.mdmp, 00000000-00005812.00000002.79327.01EE0000.00000004.mdmp") Found string "passwordFormat" (Indicator: "password"; Source: "00000000-00005812.00000001.77402.01EE0000.00000004.mdmp, 00000000-00005812.00000002.79327.01EE0000.00000004.mdmp") Found string "passwordAttemptWindow" (Indicator: "password"; Source: "00000000-00005812.00000001.77402.01EE0000.00000004.mdmp, 00000000-00005812.00000002.79327.01EE0000.00000004.mdmp") Found string "passwordStrengthRegularExpression" (Indicator: "password"; Source: "00000000-00005812.00000001.77402.01EE0000.00000004.mdmp, 00000000-00005812.00000002.79327.01EE0000.00000004.mdmp")45:Td9c,Found string "\Device\HarddiskVolume2\Windows\Temp\95B3F17E-77C8-4961-9B6E-1CBF7B5AEAE2\DismHost.exe" (Indicator: "\Device\"; Source: "00000000-00001792.00000000.79547.000C0000.00000004.mdmp") Found string ":\Windows\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00001792.00000001.80253.00113000.00000004.mdmp") Found string "C:\Windows\System32\DriverStore\FileRepository\vm3d.inf_x86_neutral_abfe51358467898f\vm3d.inf" (Indicator: "system32\drivers"; Source: "00000000-00001792.00000001.80253.00113000.00000004.mdmp") Found string "C:\Windows\System32\DriverStore\FileRepository\pvscsi.inf_x86_neutral_2e237bca5c8036a7\pvscsi.inf" (Indicator: "system32\drivers"; Source: "00000000-00001792.00000001.80253.00113000.00000004.mdmp") Found string "Driver C:\Windows\System32\DriverStore\FileRepository\pvscsi.inf_x86_neutral_2e237bca5c8036a7\pvscsi.inf is boot-critical." (Indicator: "system32\drivers"; Source: "00000000-00001792.00000001.80253.00113000.00000004.mdmp") Found string "indows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00001792.00000001.80253.00113000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00001792.00000001.80253.00113000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00001792.00000001.80253.00113000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00001792.00000001.80253.00113000.00000004.mdmp") Found string "indows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00001792.00000001.80253.00113000.00000004.mdmp") Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00001792.00000001.80253.00113000.00000004.mdmp") Found string "indows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00001792.00000001.80253.00113000.00000004.mdmp") Found string ":\Windows\system32\drivers\pvscsi.sys" (Indicator: "\drivers\"; Source: "00000000-00001792.00000001.80253.00113000.00000004.mdmp") Found string ":\Windows\system32\drivers\pvscsi.sys" (Indicator: "system32\drivers"; Source: "00000000-00001792.00000001.80253.00113000.00000004.mdmp") Found string "PID=1792 Successfully opened driver package file 'C:\Windows\System32\DriverStore\FileRepository\pvscsi.inf_x86_neutral_2e237bca5c8036a7\pvscsi.inf'. - CDriverManager::OpenPackageByFile" (Indicator: "system32\drivers"; Source: "00000000-00001792.00000001.80253.00113000.00000004.mdmp") Found string "PID=1792 Building driver collection for package 'C:\Windows\System32\DriverStore\FileRepository\pvscsi.inf_x86_neutral_2e237bca5c8036a7\pvscsi.inf'. - CDriverPackage::CreateDriverCollection" (Indicator: "system32\drivers"; Source: "00000000-00001792.00000001.80253.00113000.00000004.mdmp") file/memory contains long string with (Indicator: "system32\drivers"; Source: "00000000-00001792.00000001.80253.00113000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll" (Indicator: "\Device\"; Source: "00000000-00005812.00000000.75482.004A0000.00000004.mdmp, 00000000-00005812.00000001.77402.004A0000.00000004.mdmp, 00000000-00005812.00000002.79327.004A0000.00000004.mdmp, 00000000-00005812.00000003.84853.004A0000.00000004.mdmp")46:Td41,Observed import api "AddAce" which can "add one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: DISMHOST.EXE.6AA909CD.bin] Observed import api "CopySid" which can "copy a security identifier (SID) to a buffer" [Source: DISMHOST.EXE.6AA909CD.bin] Observed import api "GetAclInformation" which can "retrieve information about an access control list (ACL)" [Source: DISMHOST.EXE.6AA909CD.bin] Observed import api "GetLengthSid" which can "return the length in bytes of a valid security identifier (SID)" [Source: DISMHOST.EXE.6AA909CD.bin] Observed import api "GetSecurityDescriptorControl" which can "retrieve a security descriptor control and revision information" [Source: DISMHOST.EXE.6AA909CD.bin] Observed import api "GetSecurityDescriptorDacl" which can "retrieve a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: DISMHOST.EXE.6AA909CD.bin] Observed import api "GetSecurityDescriptorGroup" which can "retrieve the primary group information from a security descriptor" [Source: DISMHOST.EXE.6AA909CD.bin] Observed import api "GetSecurityDescriptorOwner" which can "retrieve the owner information from a security descriptor" [Source: DISMHOST.EXE.6AA909CD.bin] Observed import api "GetSecurityDescriptorSacl" which can "retrieve a pointer to the system access control list (SACL) in a specified security descriptor" [Source: DISMHOST.EXE.6AA909CD.bin] Observed import api "GetSidLengthRequired" which can "return the length, in bytes, of the buffer required to store a SID with a specified number of subauthorities" [Source: DISMHOST.EXE.6AA909CD.bin] Observed import api "GetSidSubAuthority" which can "return a pointer to a specified subauthority in a security identifier (SID)" [Source: DISMHOST.EXE.6AA909CD.bin] Observed import api "InitializeAcl" which can "initialize a new ACL structure" [Source: DISMHOST.EXE.6AA909CD.bin] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: DISMHOST.EXE.6AA909CD.bin] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: DISMHOST.EXE.6AA909CD.bin] Observed import api "IsValidSecurityDescriptor" which can "determine whether the components of a security descriptor are valid" [Source: DISMHOST.EXE.6AA909CD.bin] Observed import api "IsValidSid" which can "validate a security identifier (SID) by verifying that the revision number is within a known range and that the number of subauthorities is less than the maximum" [Source: DISMHOST.EXE.6AA909CD.bin] Observed import api "MakeAbsoluteSD" which can "create a security descriptor in absolute format by using a security descriptor in self-relative format as a template" [Source: DISMHOST.EXE.6AA909CD.bin] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: DISMHOST.EXE.6AA909CD.bin] Observed import api "SetSecurityDescriptorGroup" which can "set the primary group information of an absolute-format security descriptor replacing any primary group information already present in the security descriptor" [Source: DISMHOST.EXE.6AA909CD.bin] Observed import api "SetSecurityDescriptorOwner" which can "set the owner information of an absolute-format security descriptor" [Source: DISMHOST.EXE.6AA909CD.bin]47:Tcca,"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "") "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000009"; Key: "PACKEDCATALOGITEM"; Value: "")48:T63c,Found string "Rectangle" (Source: f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0, API is part of module: GDI32.DLL) Found string "CreatePipe" (Source: f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0, API is part of module: KERNELBASE.DLL) Found string "SetThreadExecutionState" (Source: f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0, API is part of module: KERNEL32.DLL) Found string "OpenProcess" (Source: f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0, API is part of module: KERNELBASE.DLL) Found string "NtSetInformationProcess" (Source: f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0, API is part of module: NTDLL.DLL) Found string "GetKernelObjectSecurity" (Source: f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0, API is part of module: ADVAPI32.DLL) Found string "SetKernelObjectSecurity" (Source: f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0, API is part of module: ADVAPI32.DLL) Found string "SizeofResource" (Source: f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0, API is part of module: KERNELBASE.DLL) Found string "LockResource" (Source: f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0, API is part of module: KERNELBASE.DLL) Found string "AllocConsole" (Source: f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0, API is part of module: KERNEL32.DLL) Found string "QueueUserWorkItem" (Source: f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0, API is part of module: KERNEL32.DLL)49:T47a,"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" opened "C:\Program Files\PCI Monitor\pcimon.exe" with delete access "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" opened "C:\f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe:Zone.Identifier" with delete access "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" opened "C:\Program Files\PCI Monitor\PCIMON.EXE" with delete access "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\733C94C5-CEBB-4F98-A75F-22A797D1D50B\PCI MONITOR\PCIMON.EXE" with delete access "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\tmpF739.tmp" with delete access "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\tmpF99B.tmp" with delete access "f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe" opened "C:\f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe:ZONE.IDENTIFIER" with delete access4a:T406,YARA signature "Nanocore_RAT_Gen_2" classified process "00000000-00005812" as "rat,nanocore" (Reference: https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/) YARA signature "NanoCore" classified process "00000000-00005812" as "rat,nanocore" YARA signature "NanoCore" classified file "sample.bin" as "rat,nanocore" YARA signature "Nanocore_RAT_Gen_2" classified file "sample.bin" as "rat,nanocore" (Reference: https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/) YARA signature "NanoCore" classified file "pcimon.exe.819216119" as "rat,nanocore" YARA signature "Nanocore_RAT_Gen_2" classified file "pcimon.exe.819216119" as "rat,nanocore" (Reference: https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/) YARA signature "MALWARE_Win_NanoCore" matched file "sample.bin" as "Detects NanoCore" YARA signature "MALWARE_Win_NanoCore" matched file "pcimon.exe.819216119" as "Detects NanoCore" YARA signature "MALWARE_Win_NanoCore" matched process "00000000-00005812" as "Detects NanoCore"4b:T44e,Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00007388.00000000.68146.05990000.00000004.mdmp, 00000000-00007388.00000000.68146.06990000.00000004.mdmp, 00000000-00007388.00000001.70065.06990000.00000004.mdmp, 00000000-00007388.00000002.71985.06990000.00000004.mdmp, 00000000-00007388.00000002.71985.08590000.00000004.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00007388.00000000.68146.05990000.00000004.mdmp, 00000000-00007388.00000000.68146.06990000.00000004.mdmp, 00000000-00007388.00000001.70065.06990000.00000004.mdmp, 00000000-00007388.00000002.71985.06990000.00000004.mdmp, 00000000-00007388.00000002.71985.08590000.00000004.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00007388.00000000.68146.05990000.00000004.mdmp, 00000000-00007388.00000000.68146.06990000.00000004.mdmp, 00000000-00007388.00000001.70065.06990000.00000004.mdmp, 00000000-00007388.00000002.71985.06990000.00000004.mdmp, 00000000-00007388.00000002.71985.08590000.00000004.mdmp")4c:Ta4d,Assembly shows XOR instruction xor byte ptr [ecx] cl in Stream UID: 32227-148-00403318 Assembly shows XOR instruction xor byte ptr [ebx] al in Stream UID: 32227-1-0041E792 Assembly shows XOR instruction xor ebp dword ptr [ebx] in Stream UID: 32227-1-0041E792 Assembly shows XOR instruction xor byte ptr [ecx] al in Stream UID: 32227-1-0041E792 Assembly shows XOR instruction xor byte ptr [edx] cl in Stream UID: 32227-1-0041E792 Assembly shows XOR instruction xor byte ptr [edx] al in Stream UID: 32227-1-0041E792 Assembly shows XOR instruction xor byte ptr [00010500h] al in Stream UID: 32227-1-0041E792 Assembly shows XOR instruction xor dword ptr [esi+08h] edi in Stream UID: 32227-1-0041E792 Assembly shows XOR instruction xor al 00h in Stream UID: 32227-1-0041E792 Assembly shows XOR instruction xor byte ptr [eax+eax] al in Stream UID: 32227-1-0041E792 Assembly shows XOR instruction xor al byte ptr [eax] in Stream UID: 32227-1-0041E792 Assembly shows XOR instruction xor byte ptr [esi] 00h in Stream UID: 32227-1-0041E792 Assembly shows XOR instruction xor eax 157B0711h in Stream UID: 32227-1-0041E792 Assembly shows XOR instruction xor ebx dword ptr [edx] in Stream UID: 32227-1-0041E792 Assembly shows XOR instruction xor eax 0000437Eh in Stream UID: 32227-1-0041E792 Assembly shows XOR instruction xor byte ptr [ecx] cl in Stream UID: 32227-1-0041E792 Assembly shows XOR instruction xor byte ptr [eax] al in Stream UID: 32227-1-0041E792 Assembly shows XOR instruction xor dword ptr [eax] eax in Stream UID: 32227-1-0041E792 Assembly shows XOR instruction xor eax 1D000000h in Stream UID: 32227-1-0041E792 Assembly shows XOR instruction xor byte ptr [00007800h] al in Stream UID: 32227-1-0041E792 Assembly shows XOR instruction xor eax 00000000h in Stream UID: 32227-241-0040EA5A Assembly shows XOR instruction xor byte ptr [edi-37FFB1FFh] bh in Stream UID: 32227-241-0040EA5A Assembly shows XOR instruction xor byte ptr [30005301h] bh in Stream UID: 32227-241-0040EA5A Assembly shows XOR instruction xor bl cl in Stream UID: 32227-241-0040EA5A Assembly shows XOR instruction xor byte ptr [eax+eax+37FC0054h] bl in Stream UID: 32227-241-0040EA5A Assembly shows XOR instruction xor byte ptr [ebx+00h] al in Stream UID: 32227-241-0040EA5A Assembly shows XOR instruction xor eax 5700443Ah in Stream UID: 32227-241-0040EA5A Assembly shows XOR instruction xor eax 5A00443Bh in Stream UID: 32227-241-0040EA5A Assembly shows XOR instruction xor al 4Dh in Stream UID: 32227-241-0040EA5A Assembly shows XOR instruction xor dword ptr [edi] edi in Stream UID: 32227-241-0040EA5A4d:Td0a,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00007388-00000C25-49197790] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll" [Source: 00000000-00007388-00000C25-49535477] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_32\mscorlib\7aa13700a6fcdcb57e6cb353e54d0ab9\mscorlib.ni.dll" [Source: 00000000-00007388-00000C25-50207250] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ole32.dll" [Source: 00000000-00007388-00000C25-50288096] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_32\System\61e9a201160f8baed9f7e00a4969992e\System.ni.dll" [Source: 00000000-00007388-00000C25-50689115] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Drawing\d6163e1c32eba738e42523885580dc48\System.Drawing.ni.dll" [Source: 00000000-00007388-00000C25-50794877] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\860a4e79adbd2eb86ade9317e1cd9d2a\System.Windows.Forms.ni.dll" [Source: 00000000-00007388-00000C25-50875971] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll" [Source: 00000000-00007388-00000C25-51003805] Observed system executable string:"%WINDIR%\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll" [Source: 00000000-00007388-00000C25-51095277] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v2.0.50727\VERSION.dll" [Source: 00000000-00007388-00000C25-51166497] Observed system executable string:"%WINDIR%\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\uxtheme.dll" [Source: 00000000-00007388-00000C25-51513945] Observed system executable string:"%WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00007388-00000C25-51879774] Observed system executable string:"%WINDIR%\SysWOW64\mscoree.dll" [Source: 00000000-00007388-00000C25-52529458] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll" [Source: 00000000-00007388-00000C25-52643160] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v2.0.50727\en-US\mscorrc.dll" [Source: 00000000-00007388-00000C25-53688203] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v2.0.50727\en\mscorrc.dll" [Source: 00000000-00007388-00000C25-53734899] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll" [Source: 00000000-00007388-00000C25-53789883] Observed system executable string:"%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00007388-00000C25-54013124] Observed system executable string:"%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00007388-00000C25-54143676] Observed system executable string:"%WINDIR%\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.dll" [Source: 00000000-00007388-00000C25-54483995] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Xml\c7a2f551c65c81870e822e9e134513f9\System.Xml.ni.dll" [Source: 00000000-00007388-00000C25-54627882]4e:T90c,"bUmn.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00007388) "bUmn.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00007388) "bUmn.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00007388) "bUmn.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00007388) "bUmn.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00007388) "bUmn.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00007388) "bUmn.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00007388) "bUmn.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00007388) "bUmn.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00007388) "bUmn.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00007388) "bUmn.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00007388) "bUmn.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00007388) "bUmn.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00007388) "bUmn.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00007388) "bUmn.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00007388) "bUmn.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00007388) "bUmn.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00007388) "bUmn.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00007388) "bUmn.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00007388) "bUmn.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00007388) "bUmn.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00007388) "bUmn.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00007388) "bUmn.exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00007388) "bUmn.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00007388)4f:T8db,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007388.00000000.68146.03620000.00000004.mdmp, 00000000-00007388.00000001.70065.03620000.00000004.mdmp, 00000000-00007388.00000002.71985.03620000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007388.00000000.68146.03620000.00000004.mdmp, 00000000-00007388.00000001.70065.03620000.00000004.mdmp, 00000000-00007388.00000002.71985.03620000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00007388.00000000.68146.03620000.00000004.mdmp, 00000000-00007388.00000001.70065.03620000.00000004.mdmp, 00000000-00007388.00000002.71985.03620000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007388.00000000.68146.03620000.00000004.mdmp, 00000000-00007388.00000001.70065.03620000.00000004.mdmp, 00000000-00007388.00000002.71985.03620000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007388.00000000.68146.03620000.00000004.mdmp, 00000000-00007388.00000001.70065.03620000.00000004.mdmp, 00000000-00007388.00000002.71985.03620000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00007388.00000000.68146.03620000.00000004.mdmp, 00000000-00007388.00000001.70065.03620000.00000004.mdmp, 00000000-00007388.00000002.71985.03620000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00007388.00000000.68146.03620000.00000004.mdmp, 00000000-00007388.00000001.70065.03620000.00000004.mdmp, 00000000-00007388.00000002.71985.03620000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00007388.00000000.68146.03620000.00000004.mdmp, 00000000-00007388.00000001.70065.03620000.00000004.mdmp, 00000000-00007388.00000002.71985.03620000.00000004.mdmp")50:T45d,System.Net.Sockets.Socket::Close() at 0f41a135573fcbcc4f1b36684527438a-60001a3-Client~#_quOBOxPeAl_kjKKx_REI6dA_ System.Net.Sockets.Socket::set_LingerState(System.Net.Sockets.LingerOption) at 0f41a135573fcbcc4f1b36684527438a-600019a-Client~#_qlt_K8Ex4tZEPwTl4RuqGMw_ System.Net.Sockets.Socket::ReceiveAsync(System.Net.Sockets.SocketAsyncEventArgs) at 0f41a135573fcbcc4f1b36684527438a-600019e-Client~#_qafzQcMCK0eVSctI0IcD2PA_ System.Net.Sockets.SocketAsyncEventArgs::get_SocketError() at 0f41a135573fcbcc4f1b36684527438a-600019f-Client~#_quebj1wBCmruzAKmg6Y4Igg_ System.Net.Sockets.SocketAsyncEventArgs::Dispose() at 0f41a135573fcbcc4f1b36684527438a-600019d-Client~#_qyxpfolLUhMvFTDE2h_syvQ_ System.Net.Sockets.Socket::get_LocalEndPoint() at 0f41a135573fcbcc4f1b36684527438a-600016a-ctor System.Net.Sockets.SocketAsyncEventArgs::SetBuffer(System.Byte[],System.Int32,System.Int32) at 0f41a135573fcbcc4f1b36684527438a-6000196-Client~#_qRxyF5FV01AHvUkR3BeX8OA_ System.Net.Sockets.SocketAsyncEventArgs::get_Offset() at 0f41a135573fcbcc4f1b36684527438a-60001a2-Client~#_q7uQjJN4fKJgs403tXnERFbQ1VWp3FBsMW_1ZAWZtc1g_51:T7a0,"bUmn.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "bUmn.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "bUmn.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "bUmn.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "bUmn.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "bUmn.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config" "bUmn.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch" "bUmn.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config" "bUmn.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch" "bUmn.exe" touched file "C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.pdb" "bUmn.exe" touched file "C:\Windows\mscorlib.pdb" "pcimon.exe" touched file "C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.pdb" "pcimon.exe" touched file "C:\Windows\mscorlib.pdb" "pcimon.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "pcimon.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "pcimon.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "pcimon.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "pcimon.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "pcimon.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config" "pcimon.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch" "pcimon.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config" "pcimon.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch"52:T590,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD80lEQVR4Xu2W21cTVxTG/b/6Tq22VuSi4DWiLXYtXAoiIOiChNwDMQawSDCESwiEgNTWVmpfbSH2wSf7ZN/oCyHJZGYyueDXfWZIMkwyQmwXfaiz1rfO5JyZs3/7O/ucyZEjH6//+rI63RgYtB2qBi0OFAEsNgf+eLuJ12/+JL39V/V1t6diyyBKDtiH8et69B9pfeMVNqK/Y+OVonW6/436mLTPMu0BMJkdSAlpZDMSMlL6A6S8J1WQ9lkWQ8zktAB2ufMwVQaQy+flgbW1l3jxy+sDae3nl8jnsrKi0WhFFTL/5NqULHZfESC/C8AmrutbQv3dMBr6F9FoXMBpcwhnrCE0O4NoHprDOc8Mznun5Wf/2txEJi2UWa1VVQCXbKswOJ7A4FxBy/AyrngiuOpdwldji2gdX8A1Xwjf+OdVAHxZ5lU5wH7sqADavD+gbfR7XH/4FDcekXyraPc/QUdgBbdml9EZjKBrIVwEyBIAm1iSRKVNK63WgRrTqD4ALyoDbNKuyefo8f+EnsCP6J19hpsU/Lo/jNbJIC5P+GHwTaJlylcCEIWyzLUOsOAnHzr1ATheLAIYgy9wb+45WkZCOGGbwKeWEXzmeIDjQx58ft+NE94hnBxzqgB2HaDM5e3HWo0LLHjzXP/BANoff4fj5nHUDI7iqM2LY04KPnwfXzwYxpejLnmyU4/sKoBUWeZaB1jw1mdt+gApFUCNcUzJ2k7Bi1lT8DEXar914NSEDfWPLXtqQKLDKC3q7wYW/P0AQgngqHXXcpa1h4KPDMlZ147bUeezosFvxumAqbQLxP13wQEASkV4zEVZu1WWs6zJ8vpJKxqnBnFm2ogmsrQIIPBVHeP7AqgLrXbcgTqyvIEsbwxQ8JkBWs97OBfqq+ocqApAXWj1BcunTWia7cfZ4F2cX+jFxXD3HoDM7g7QBqukfQHUhSZbPmNUsp7vw4XFO7i41A3DcmcRIE01wApQu/WYWJ9IYxzHIZFIIJmI7w+gLrSm2QHKmlneiwvhHlyKdOHySidaVjuKANJ7tqGUpnkJMJlMIB6PIxHf1gFQnYTqQjs7zyy/I1tuiNym4LdwZbUdV5/eUAFwFbMvOCBQkbLMY7EYtrdjlQEEUfmjMD2zLE98EE0FIsoSCPpFKPA8UlySAm8rADEdgGRKcYB929mk1UhIlRxgLasHnk+BSynrzrLe2tqSpQsQ59LyJxk7GWQlHkAWyFNfRkCOhB2J+t6Rdkh5ZRwZvMspRVY4/9OiCJ4cSVFwjjJP0Nqz9S+IuaELwAYOS3sA2H/0vgGz3PkhMtH7FrsLdpcbVocbZqsTxgrPqXWz43YJ4OP1v7/+BnvlpAT3X7SfAAAAAElFTkSuQmCC53:T590,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD80lEQVR4Xu2W21cTVxTG/b/6Tq22VuSi4DWiLXYtXAoiIOiChNwDMQawSDCESwiEgNTWVmpfbSH2wSf7ZN/oCyHJZGYyueDXfWZIMkwyQmwXfaiz1rfO5JyZs3/7O/ucyZEjH6//+rI63RgYtB2qBi0OFAEsNgf+eLuJ12/+JL39V/V1t6diyyBKDtiH8et69B9pfeMVNqK/Y+OVonW6/436mLTPMu0BMJkdSAlpZDMSMlL6A6S8J1WQ9lkWQ8zktAB2ufMwVQaQy+flgbW1l3jxy+sDae3nl8jnsrKi0WhFFTL/5NqULHZfESC/C8AmrutbQv3dMBr6F9FoXMBpcwhnrCE0O4NoHprDOc8Mznun5Wf/2txEJi2UWa1VVQCXbKswOJ7A4FxBy/AyrngiuOpdwldji2gdX8A1Xwjf+OdVAHxZ5lU5wH7sqADavD+gbfR7XH/4FDcekXyraPc/QUdgBbdml9EZjKBrIVwEyBIAm1iSRKVNK63WgRrTqD4ALyoDbNKuyefo8f+EnsCP6J19hpsU/Lo/jNbJIC5P+GHwTaJlylcCEIWyzLUOsOAnHzr1ATheLAIYgy9wb+45WkZCOGGbwKeWEXzmeIDjQx58ft+NE94hnBxzqgB2HaDM5e3HWo0LLHjzXP/BANoff4fj5nHUDI7iqM2LY04KPnwfXzwYxpejLnmyU4/sKoBUWeZaB1jw1mdt+gApFUCNcUzJ2k7Bi1lT8DEXar914NSEDfWPLXtqQKLDKC3q7wYW/P0AQgngqHXXcpa1h4KPDMlZ147bUeezosFvxumAqbQLxP13wQEASkV4zEVZu1WWs6zJ8vpJKxqnBnFm2ogmsrQIIPBVHeP7AqgLrXbcgTqyvIEsbwxQ8JkBWs97OBfqq+ocqApAXWj1BcunTWia7cfZ4F2cX+jFxXD3HoDM7g7QBqukfQHUhSZbPmNUsp7vw4XFO7i41A3DcmcRIE01wApQu/WYWJ9IYxzHIZFIIJmI7w+gLrSm2QHKmlneiwvhHlyKdOHySidaVjuKANJ7tqGUpnkJMJlMIB6PIxHf1gFQnYTqQjs7zyy/I1tuiNym4LdwZbUdV5/eUAFwFbMvOCBQkbLMY7EYtrdjlQEEUfmjMD2zLE98EE0FIsoSCPpFKPA8UlySAm8rADEdgGRKcYB929mk1UhIlRxgLasHnk+BSynrzrLe2tqSpQsQ59LyJxk7GWQlHkAWyFNfRkCOhB2J+t6Rdkh5ZRwZvMspRVY4/9OiCJ4cSVFwjjJP0Nqz9S+IuaELwAYOS3sA2H/0vgGz3PkhMtH7FrsLdpcbVocbZqsTxgrPqXWz43YJ4OP1v7/+BnvlpAT3X7SfAAAAAElFTkSuQmCC1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790933654762,"unified_at":"2026-10-02T09:34:14.762Z","metadata":{"hashes":{"sha256":"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0","sha1":"61eb59772d35b4a6e8faa585cdf2b2064732e2c6","md5":"0f41a135573fcbcc4f1b36684527438a","sha512":"77622bbe94c97ac2512f2998b145cf5e90b4c639fa427861ae5213a9103dc4ba7970179aa85ad3598cbfb8b33060bc15d6a9760fcc658f2a9283f4b458bc10b0","ssdeep":"3072:szEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HI3vTkWwfXxaegyJVRmLS9ttZ0d:sLV6Bta6dtJmakIM5gKPPROyyibV6","ssdeep_chunks":["3072:szEqV6B","3072:zEqV6B1","3072:EqV6B1j","3072:qV6B1jH","3072:V6B1jHa","3072:6B1jHa6","3072:B1jHa6d","3072:1jHa6dt","3072:jHa6dtJ","3072:Ha6dtJ1","3072:a6dtJ10","3072:6dtJ10j","3072:dtJ10jg","3072:tJ10jgv","3072:J10jgvz","3072:10jgvzc","3072:0jgvzcg","3072:jgvzcgi","3072:gvzcgi+","3072:vzcgi+o","3072:zcgi+oG","3072:cgi+oG/","3072:gi+oG/j","3072:i+oG/j9","3072:+oG/j9i","3072:oG/j9ia","3072:G/j9iaM","3072:/j9iaMP","3072:j9iaMP2","3072:9iaMP2s","3072:iaMP2s/","3072:aMP2s/H","3072:MP2s/HI","3072:P2s/HI3","3072:2s/HI3v","3072:s/HI3vT","3072:/HI3vTk","3072:HI3vTkW","3072:I3vTkWw","3072:3vTkWwf","3072:vTkWwfX","3072:TkWwfXx","3072:kWwfXxa","3072:WwfXxae","3072:wfXxaeg","3072:fXxaegy","3072:XxaegyJ","3072:xaegyJV","3072:aegyJVR","3072:egyJVRm","3072:gyJVRmL","3072:yJVRmLS","3072:JVRmLS9","3072:VRmLS9t","3072:RmLS9tt","3072:mLS9ttZ","3072:LS9ttZ0","3072:S9ttZ0d","6144:szEqV6B","6144:zEqV6B1","6144:EqV6B1j","6144:qV6B1jH","6144:V6B1jHa","6144:6B1jHa6","6144:B1jHa6d","6144:1jHa6dt","6144:jHa6dtJ","6144:Ha6dtJ1","6144:a6dtJ10","6144:6dtJ10j","6144:dtJ10jg","6144:tJ10jgv","6144:J10jgvz","6144:10jgvzc","6144:0jgvzcg","6144:jgvzcgi","6144:gvzcgi+","6144:vzcgi+o","6144:zcgi+oG","6144:cgi+oG/","6144:gi+oG/j","6144:i+oG/j9","6144:+oG/j9i","6144:oG/j9ia","6144:G/j9iaM","6144:/j9iaMP","6144:j9iaMP2","6144:9iaMP2s","6144:iaMP2s/","6144:aMP2s/H","6144:MP2s/HI","6144:P2s/HI3","6144:2s/HI3v","6144:s/HI3vT","6144:/HI3vTk","6144:HI3vTkW","6144:I3vTkWw","6144:3vTkWwf","6144:vTkWwfX","6144:TkWwfXx","6144:kWwfXxa","6144:WwfXxae","6144:wfXxaeg","6144:fXxaegy","6144:XxaegyJ","6144:xaegyJV","6144:aegyJVR","6144:egyJVRm","6144:gyJVRmL","6144:yJVRmLS","6144:JVRmLS9","6144:VRmLS9t","6144:RmLS9tt","6144:mLS9ttZ","6144:LS9ttZ0","6144:S9ttZ0d","3072:sLV6Bta","3072:LV6Bta6","3072:V6Bta6d","3072:6Bta6dt","3072:Bta6dtJ","3072:ta6dtJm","3072:a6dtJma","3072:6dtJmak","3072:dtJmakI","3072:tJmakIM","3072:JmakIM5","3072:makIM5g","3072:akIM5gK","3072:kIM5gKP","3072:IM5gKPP","3072:M5gKPPR","3072:5gKPPRO","3072:gKPPROy","3072:KPPROyy","3072:PPROyyi","3072:PROyyib","3072:ROyyibV","3072:OyyibV6"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"bUmn.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":207872,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1710893287000,"last_seen":1789449574000,"last_multi_scan":1789449574000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["rat","nanocore","noancooe","windows-server-utility"]},"stats":{"av":{"malicious_count":23,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":2,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":86},"sandbox_signatures":{"informative_count":193,"suspicious_count":24,"malicious_count":15,"total":232},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Win-Trojan/Nanocore.Exp","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/MSIL.NanoCore","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Dropper.MSIL.Gen7","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.NanoCore.5","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Trojan.NanoCore-9852758-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.NanoCore (A)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"MSIL/NanoCore.E trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"malicious","threat_name":"Backdoor.Generic.mwby","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Backdoor.Win32.Noancooe.cc!ni","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Backdoor/MSIL.NanoCore.b","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005b2a921 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Generic.mhUN","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_95","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"high_entropy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/NanoCor-BT","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Backdoor/W32.DN-Nanocore.207872","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"malicious","threat_name":"Trojan-FICC!0F41A135573F","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/NanoCore.C.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.DownLoader12.BSON","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"Backdoor.MSIL.Noancooe.JDE","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Agent.Win32.3898450","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.NanoCore","sources":[{"report_type":"quickscan","report_id":""}]},{"value":"NanoCore","sources":[{"report_type":"qsp","report_id":""}]}]},"mitre_attacks":[{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Able to retrieve running process details (.NET)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"YARA signature match - AES Encryption"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"suspicious","value":"Able to perform cryptographic operations"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Can load assembly that contains the code that is currently executing (Dotnet)"},{"type":"informative","value":"Can loads assembly that contains the code that is currently executing [Dotnet]"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"suspicious","value":"Spawned process connects to a network"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Able to execute applications using .NET process API"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains native function calls (syscalls strings)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"suspicious","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to load modules (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"Touches files in program files directory"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Tries to access non-existent files (executable)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Contains ability to retrieve user privileges (API string)"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Contains ability to retrieve user privileges"},{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"tactic":"Defense Evasion","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Imports system security related APIs"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Contains ability to query registry keys (API string)"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry location strings in memory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"malicious","value":"Tries to hide tracks of having downloaded a file from the internet"},{"type":"suspicious","value":"Opens file with deletion access rights"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Contains ability to retrieve information about MS-DOS device names (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"suspicious","value":"Calls an API typically used to find and list the Windows drive types"},{"type":"suspicious","value":"Found system commands related strings"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"suspicious","value":"Contains ability to measure performance"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"suspicious","value":"Attempts to retrieve geographical location information"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"},{"type":"suspicious","value":"Uses a .NET obfuscator to hide its code"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Writes log files"},{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"},{"type":"informative","value":"Connects to LPC ports"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Writes registry keys"},{"type":"suspicious","value":"Writes registry keys"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"tactic":"Execution","technique":"Scheduled Task","attack_id":"T1053.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1053/005","identifiers":[{"type":"malicious","value":"Schedules a task to be executed from task XML file"},{"type":"malicious","value":"Schedules a task to be executed at a specific time and date"}],"sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains reference to multiple windows system processes"}],"sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"}],"sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"malicious","value":"Loads the task scheduler COM API"}],"sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"The analysis extracted a file that was identified as malicious"},{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"},{"type":"malicious","value":"Writes data to a remote process"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"},{"type":"malicious","value":"Allocates virtual memory in a remote process"},{"type":"suspicious","value":"Spawned processes likely due to injection"}],"sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Contains ability to modify process memory (API string)"},{"type":"informative","value":"Creates a thread in a self process"},{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Able to modify process memory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"informative","value":"Contains ability to unmap view of a section from a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"suspicious","value":"Adjusts debug privileges"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"tactic":"Defense Evasion","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"suspicious","value":"Tries to sleep for a long time (more than two minutes)"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"suspicious","value":"Possibly tries to evade analysis by sleeping many times"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Contains strings related to AMSI (Anti Malware Scan Interface)"}],"sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Able to identify sandbox environment running process"}],"sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"tactic":"Defense Evasion","technique":"Masquerade Task or Service","attack_id":"T1036.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/004","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"tactic":"Defense Evasion","technique":"Masquerade File Type","attack_id":"T1036.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/008","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy resources"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"},{"type":"informative","value":"YARA signature match – Embedded PE executable"}],"sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"},{"type":"informative","value":"Contains ability to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"tactic":"Credential Access","technique":"Input Capture","attack_id":"T1056","attack_id_wiki":"https://attack.mitre.org/techniques/T1056","identifiers":[{"type":"informative","value":"Contains ability to register/read input devices (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Contains ability to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve network parameters of a computer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"}],"sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Calls an API typically used to register an interface (RPC)"}],"sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Able to perform SQL operations"}],"sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"},{"type":"informative","value":"Calls an API typically used to copy file from one location to another"}],"sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Calls an API possibly used to take screenshots"},{"type":"suspicious","value":"Calls an API that may be used to take screenshots"},{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"tactic":"Command and Control","technique":"Dead Drop Resolver","attack_id":"T1102.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1102/001","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Drops temp files"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops XML files"}],"sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"suspicious","value":"Contains ability to open a port and listen for incoming connection"},{"type":"malicious","value":"Uses network protocols on unusual ports"}],"sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"tactic":"Command and Control","technique":"Remote Access Tools","attack_id":"T1219","attack_id_wiki":"https://attack.mitre.org/techniques/T1219","identifiers":[{"type":"malicious","value":"Known malware detected"}],"sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Web Service","attack_id":"T1567","attack_id_wiki":"https://attack.mitre.org/techniques/T1567","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"},{"type":"informative","value":"Contains ability to perform encryption (API string)"},{"type":"informative","value":"Able to access crypto-related API (String)"}],"sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","sources":[{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains ability to perform encryption/decryption using RSA algorithm"}],"sources":[{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]}],"sandbox_signatures":[{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (On Sensor) detected file with high confidence","description":"\"Portable Executable (On Sensor) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-12","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains native function calls (syscalls strings)","description":"$27","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-5000","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Can load assembly that contains the code that is currently executing (Dotnet)","description":"Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1620","id":"string-615","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$28","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"set_UseShellExecute\" (Indicator: \"ShellExecute\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-240","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1074.001","id":"string-423","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-345","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; Source: \"sample.bin\"), Found reference to API \"FindResourceEx\" (Indicator: \"FindResource\"; Source: \"sample.bin\"), Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"sample.bin\"), Found reference to API \"LockResource\" (Indicator: \"LockResource\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-550","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-272","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"CreateEncryptor\" (Indicator: \"createencryptor\"; Source: \"sample.bin\"), Found string \"System.Security.Cryptography\" (Indicator: \"System.Security.Cryptography\"; Source: \"sample.bin\"), Found string \"MD5CryptoServiceProvider\" (Indicator: \"md5cryptoserviceprovider\"; Source: \"sample.bin\"), Found string \"RijndaelManaged\" (Indicator: \"rijndael\"; Source: \"sample.bin\"), Found string \"RijndaelManaged\" (Indicator: \"Rijndaelmanaged\"; Source: \"sample.bin\"), Found string \"CreateDecryptor\" (Indicator: \"createdecryptor\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-57","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegOpenKeyEx\" in \"sample.bin\", Found registry query API: \"RegQueryValueEx\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-229","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-85","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve user privileges (API string)","description":"Found reference to API \"IsInRole\" (Indicator: \"IsInRole\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1033","id":"string-217","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetTempFileName\" (Indicator: \"GetTempFileName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-207","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about MS-DOS device names (API string)","description":"Found reference to API \"QueryDosDevice\" (Indicator: \"QueryDosDevice\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-227","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\">mx.o\" [Source: sample.bin]","origin":"sample.bin","mitre_attack_id":"T1071.003","id":"string-169","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"8.0.0.0\", \"1.2.2.0\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"8i.ad\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1559","id":"string-210","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFile\" (Indicator: \"DeleteFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.004","id":"string-308","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"GetKernelObjectSecurity\" (Indicator: \"GetKernelObjectSecurity\"; Source: \"sample.bin\"), Found reference to API \"SetKernelObjectSecurity\" (Indicator: \"SetKernelObjectSecurity\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134.001","id":"string-114","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"Shutdown\" (Indicator: \"shutdown\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1529","id":"string-406","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"Rfc2898DeriveBytes\" (Indicator: \"DeriveBytes\"; Source: \"sample.bin\"), Found reference to \"Rfc2898DeriveBytes\" (Indicator: \"Rfc2898DeriveBytes\"; Source: \"sample.bin\"), Found reference to \"MD5CryptoServiceProvider\" (Indicator: \"MD5CryptoServiceProvider\"; Source: \"sample.bin\"), Found reference to \"DESCryptoServiceProvider\" (Indicator: \"DESCryptoServiceProvider\"; Source: \"sample.bin\"), Found reference to \"SymmetricAlgorithm\" (Indicator: \"SymmetricAlgorithm\"; Source: \"sample.bin\"), Found reference to \"RijndaelManaged\" (Indicator: \"Rijndael\"; Source: \"sample.bin\"), Found reference to \"RijndaelManaged\" (Indicator: \"RijndaelManaged\"; Source: \"sample.bin\"), Found reference to \"HashAlgorithm\" (Indicator: \"HashAlgorithm\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-138","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Able to perform cryptographic operations","description":"Found strings that indicate potentially cryptographic operations: computehash, md5cryptoserviceprovider, rijndaelmanaged, cryptography, createdecryptor, createencryptor","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-962","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"Found reference to API \"CreateDecryptor\" (Indicator: \"CreateDecryptor\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1140","id":"string-356","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify process memory (API string)","description":"Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00005812.00000000.75482.01EE0000.00000004.mdmp, 00000000-00005812.00000000.75482.02EE0000.00000004.mdmp, 00000000-00005812.00000001.77402.02EE0000.00000004.mdmp, 00000000-00005812.00000002.79327.02EE0000.00000004.mdmp, 00000000-00005812.00000003.84853.00870000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","id":"string-439","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe\" called \"LoadResource with parameter {'hModule': '1975451648', 'hResInfo': '7472624'}\" (UID: 00000000-00005812)\n \"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '3219528'}\" (UID: 00000000-00005812)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00001792.00000001.80253.00591000.00000020.mdmp\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00001792.00000001.80253.00591000.00000020.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00001792.00000001.80253.00591000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to unmap view of a section from a process (API string)","description":"Found reference to API \"NtUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00005812.00000000.75482.01EE0000.00000004.mdmp, 00000000-00005812.00000000.75482.02EE0000.00000004.mdmp, 00000000-00005812.00000001.77402.02EE0000.00000004.mdmp, 00000000-00005812.00000002.79327.02EE0000.00000004.mdmp, 00000000-00005812.00000003.84853.00870000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.012","relevance":1,"id":"string-90","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"Observed string: \"AmsiScanBuffer\" (Indicator: \"amsiscanbuffer\") in Source: 00000000-00005812.00000002.79327.001E6000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-231","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00005812.00000000.75482.01EE0000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005812.00000000.75482.02EE0000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005812.00000001.77402.01EE0000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005812.00000001.77402.02EE0000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005812.00000002.79327.00890000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005812.00000002.79327.01EE0000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005812.00000002.79327.02EE0000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005812.00000003.84853.00860000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005812.00000003.84853.00870000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe\" queried SystemProcessInformation at 00000000-00005812-00000105-6798934 [PID: 5812]\n \"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe\" queried SystemProcessInformation at 00000000-00005812-00000105-6799267 [PID: 5812]\n \"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe\" queried SystemProcessInformation at 00000000-00005812-00000105-6979058 [PID: 5812]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"OutputDebugStringA\" (Indicator: \"OutputDebugString\"; File: \"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0\")\n Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; File: \"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0\")\n Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"file/memory contains long string with (Indicator: \"CryptProtectData\"; Source: \"00000000-00005812.00000001.77402.01EE0000.00000004.mdmp, 00000000-00005812.00000002.79327.01EE0000.00000004.mdmp\")\n Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00005812.00000001.77402.01EE0000.00000004.mdmp, 00000000-00005812.00000002.79327.01EE0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"file/memory contains long string with (Indicator: \"CryptProtectData\"; Source: \"00000000-00005812.00000001.77402.01EE0000.00000004.mdmp, 00000000-00005812.00000002.79327.01EE0000.00000004.mdmp\")\n Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00005812.00000001.77402.01EE0000.00000004.mdmp, 00000000-00005812.00000002.79327.01EE0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00001792.00000000.79547.000C0000.00000004.mdmp, 00000000-00001792.00000001.80253.00113000.00000004.mdmp\")\n Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00005812.00000000.75482.004A0000.00000004.mdmp, 00000000-00005812.00000001.77402.004A0000.00000004.mdmp, 00000000-00005812.00000002.79327.004A0000.00000004.mdmp, 00000000-00005812.00000003.84853.004A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.45035","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Able to decrypt/decode data\n Matched sigs: Able to perform cryptographic operations\n Matched sigs: Contains reference to crypto DLLs\n Matched sigs: Contains ability to perform encryption (API string)\n Matched sigs: Able to access crypto-related API (String)\n Matched sigs: Calls an API typically used to import cryptographic keys into a CSP\n Matched sigs: Calls an API typically used to decrypt data\n Matched sigs: Calls an API typically used to encrypt data\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2c","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"Found string \"[explorer] www.instagram.com/justinbieber#www.youtube.com/watch?v=9bZkp7q19f0[explorer] Task Switchingwww.reddit.com/r/gifs\" (Indicator: \"youtube.com\"; File: \"KB_-1820449351.dat\")\n Found string \"youtube.com/watch?v=9bZkp7q19f0\" (Indicator: \"youtube.com\"; Source: \"00000000-00005812.00000003.84853.004A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005812-00000C2C-188359429\")\n Found reference to API \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005812-00000C2C-189587229\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"get_OSVersion\" (Source: \"00000000-00005812.00000000.75482.004A0000.00000004.mdmp, 00000000-00005812.00000002.79327.002F2000.00000020.mdmp\")\n Found string \"get_MachineName\" (Source: \"00000000-00005812.00000000.75482.004A0000.00000004.mdmp, 00000000-00005812.00000002.79327.002F2000.00000020.mdmp\")\n Found string \"get_UserName\" (Source: \"00000000-00005812.00000000.75482.004A0000.00000004.mdmp, 00000000-00005812.00000000.75482.01EE0000.00000004.mdmp, 00000000-00005812.00000000.75482.02EE0000.00000004.mdmp, 00000000-00005812.00000001.77402.02EE0000.00000004.mdmp, 00000000-00005812.00000002.79327.002F2000.00000020.mdmp, 00000000-00005812.00000002.79327.02EE0000.00000004.mdmp, 00000000-00005812.00000003.84853.00870000.00000004.mdmp\")\n Found string \"UserName\" (Source: \"00000000-00005812.00000001.77402.01EE0000.00000004.mdmp, 00000000-00005812.00000002.79327.01EE0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify sandbox environment running process","description":"Found string \"VGAuthService.exe\" (Indicator: \"VGAuthService.exe\"; Source: \"00000000-00005812.00000003.84853.04670000.00000004.mdmp\")\n Found string \"vmtoolsd.exe\" (Indicator: \"vmtoolsd.exe\"; Source: \"00000000-00005812.00000003.84853.04670000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-666","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005812-00000C2C-188359429\")\n Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005812-00000C2C-189587229\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"DISMHOST.EXE.6AA909CD.bin\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00001792.00000001.80253.00591000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00005812-00000C2C-183739629\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00005812-00000C2C-183740387\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; File: \"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00001792.00000001.80253.00591000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00005812-00000C2C-202536973\")\n Found reference to API \"at System.Net.Dns.GetAddrInfo(String name)\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00005812.00000001.77402.01EE0000.00000004.mdmp, 00000000-00005812.00000002.79327.01EE0000.00000004.mdmp\")\n Found reference to API \"GetAddrInfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00005812.00000001.77402.01EE0000.00000004.mdmp, 00000000-00005812.00000002.79327.01EE0000.00000004.mdmp\")\n Found reference to API \"No such host is known at System.Net.Dns.GetAddrInfo(String name)\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00005812.00000001.77402.01EE0000.00000004.mdmp, 00000000-00005812.00000002.79327.01EE0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; File: \"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0\")\n Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; Source: \"00000000-00001792.00000001.80253.00591000.00000020.mdmp\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00001792.00000001.80253.00591000.00000020.mdmp\")\n Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; Source: \"00000000-00005812.00000000.75482.01EE0000.00000004.mdmp, 00000000-00005812.00000000.75482.02EE0000.00000004.mdmp, 00000000-00005812.00000001.77402.02EE0000.00000004.mdmp, 00000000-00005812.00000002.79327.02EE0000.00000004.mdmp, 00000000-00005812.00000003.84853.00870000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"SendMessage\" (Indicator: \"sendmessage\"; Source: \"00000000-00005812-00000C2C-186399057\")\n Found reference to API \"SendMessageW\" (Indicator: \"sendmessage\"; Source: \"00000000-00005812-00000C2C-186399135\")\n Found reference to API \"PostMessage\" (Indicator: \"postmessage\"; Source: \"00000000-00005812-00000C2C-186404065\")\n Found reference to API \"PostMessageW\" (Indicator: \"postmessage\"; Source: \"00000000-00005812-00000C2C-186404143\")\n Found reference to API \"SendMessageA\" (Indicator: \"sendmessage\"; Source: \"00000000-00005812-00000C2C-189627417\")\n Found reference to API \"SendMessage\" (Indicator: \"sendmessage\"; Source: \"00000000-00005812.00000000.75482.01EE0000.00000004.mdmp, 00000000-00005812.00000000.75482.02EE0000.00000004.mdmp, 00000000-00005812.00000001.77402.02EE0000.00000004.mdmp, 00000000-00005812.00000002.79327.02EE0000.00000004.mdmp, 00000000-00005812.00000003.84853.00870000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00005812)\n \"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00005812)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00005812)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe\" called \"GetForegroundWindow\" (UID: 00000000-00005812)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe\" called \"IsWow64Process\" with parameter \"5812\" - (UID: 00000000-00005812)\n \"schtasks.exe\" called \"IsWow64Process\" with parameter \"5736\" - (UID: 00000000-00005736)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe\" called \"GetWindowTextW\" (UID: 00000000-00005812)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005812)\n \"schtasks.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005736)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2d","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe\" called \"OpenMutexW\" with parameter \"Global\\CLR_CASOFF_MUTEX\" - (UID: 00000000-00005812)\n \"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe\" called \"OpenMutexW\" with parameter \"Global\\.net clr networking\" - (UID: 00000000-00005812)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$2e","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00005812)\n \"schtasks.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00005736)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe\" called \"GetLocaleInfoW\" with parameter \"1024\" - (UID: 00000000-00005812)\n \"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00005812)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00001792.00000001.80253.00591000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve network parameters of a computer (API string)","description":"Found reference to API \"DnsGetCacheDataTable\" (Indicator: \"DnsGetCacheDataTable\"; Source: \"00000000-00005812.00000000.75482.01EE0000.00000004.mdmp, 00000000-00005812.00000000.75482.02EE0000.00000004.mdmp, 00000000-00005812.00000001.77402.02EE0000.00000004.mdmp, 00000000-00005812.00000002.79327.02EE0000.00000004.mdmp, 00000000-00005812.00000003.84853.00870000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-222","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionExA\" (Indicator: \"GetVersionExA\"; File: \"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0\")\n Found reference to API \"GetVersionExA\" (Indicator: \"GetVersion\"; File: \"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0\")\n Found reference to API \"GetVersionExA\" (Indicator: \"GetVersionExA\"; Source: \"00000000-00001792.00000001.80253.00591000.00000020.mdmp\")\n Found reference to API \"GetVersionExA\" (Indicator: \"GetVersion\"; Source: \"00000000-00001792.00000001.80253.00591000.00000020.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"00000000-00001792.00000001.80253.00591000.00000020.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"00000000-00001792.00000001.80253.00591000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; File: \"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"General","name":"Able to execute applications using .NET process API","description":"Found string \"set_UseShellExecute\" (Source: \"00000000-00005812.00000000.75482.004A0000.00000004.mdmp, 00000000-00005812.00000002.79327.002F2000.00000020.mdmp\")\n Found string \"ProcessStartInfo\" (Source: \"00000000-00005812.00000002.79327.002F2000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-934","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"file/memory contains long string(File: \"DISMHOST.EXE.6AA909CD.bin\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00001792.00000001.80253.00591000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"level":"informative","category":"General","name":"Calls an API typically used to copy file from one location to another","description":"\"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe\" called \"CopyFileW\" to copy C:\\f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe to new location %PROGRAMFILES%\\PCI Monitor\\pcimon.exe (UID: 00000000-00005812)","origin":"API Call","mitre_attack_id":"T1005","relevance":3,"id":"api-123","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$30","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe\" called \"CreateProcessW\" with parameter \"\"schtasks.exe\" /create /f /tn \"PCI Monitor\" /xml \"%TEMP%\\tmpF739.tmp\"\" - (UID: 00000000-00005812)\n \"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe\" called \"CreateProcessW\" with parameter \"\"schtasks.exe\" /create /f /tn \"PCI Monitor Task\" /xml \"%TEMP%\\tmpF99B.tmp\"\" - (UID: 00000000-00005812)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$31","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$32","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcess\" (Indicator: \"CreateProcess\"; Source: \"00000000-00005812.00000000.75482.01EE0000.00000004.mdmp, 00000000-00005812.00000000.75482.02EE0000.00000004.mdmp, 00000000-00005812.00000001.77402.02EE0000.00000004.mdmp, 00000000-00005812.00000002.79327.02EE0000.00000004.mdmp, 00000000-00005812.00000003.84853.00870000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00001792.00000001.80253.00591000.00000020.mdmp\")\n Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; Source: \"00000000-00001792.00000001.80253.00591000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0\")\n Found reference to API \"CommandLineToArgvW\" (Indicator: \"CommandLineToArgv\"; File: \"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00001792.00000001.80253.00591000.00000020.mdmp\")\n Found reference to API \"CommandLineToArgvW\" (Indicator: \"CommandLineToArgv\"; Source: \"00000000-00001792.00000001.80253.00591000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00001792.00000001.80253.00591000.00000020.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00001792.00000001.80253.00591000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00005812.00000000.75482.01EE0000.00000004.mdmp, 00000000-00005812.00000000.75482.02EE0000.00000004.mdmp, 00000000-00005812.00000001.77402.02EE0000.00000004.mdmp, 00000000-00005812.00000002.79327.02EE0000.00000004.mdmp, 00000000-00005812.00000003.84853.00870000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$34","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex\"\n Process f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Global\\{12fb6143-1465-418f-99d8-637795f79fcf}\"\n Process f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Global\\.net clr networking\"","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"DISMHOST.EXE.6AA909CD.bin\" as clean (type is \"PE32 executable for MS Windows 5.01 (GUI) Intel i386 4 sections\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$35","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"DISMHOST.EXE.6AA909CD.bin\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"level":"informative","category":"General","name":"Found a reference to a known community page","description":"Found string \"[explorer] www.instagram.com/justinbieber#www.youtube.com/watch?v=9bZkp7q19f0[explorer] Task Switchingwww.reddit.com/r/gifs\" (Indicator: \"youtube\"; File: \"KB_-1820449351.dat\")","origin":"File/Memory","relevance":2,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$36","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$37","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\9f895c66454577eff9c77442d0c84f71\\mscorlib.ni.dll\" at 641A0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 750F0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 77840000\n \"schtasks.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 77840000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"1300140054f41b77@RPCRT4.dll\"\n \"1800190068e8b86a@api-ms-win-core-synch-l1-2-0.DLL\"\n \"1800190088e8b86a@api-ms-win-core-synch-l1-2-0.DLL\"\n \"0d000e00cc5fb86a@ntdll.dll\"\n \"1500160020732a72@ADVAPI32.dll\"\n \"0e000f00e4732a72@ADVAPI32.dll\"\n \"0e000f0050742a72@ADVAPI32.dll\"\n \"11001200d47d2a72@ADVAPI32.dll\"\n \"110012007c7e2a72@ADVAPI32.dll\"\n \"12001300cc7e2a72@ADVAPI32.dll\"\n \"12001300387f2a72@ADVAPI32.dll\"\n \"14001500e4b72a72@ADVAPI32.dll\"\n \"1400150000b82a72@ADVAPI32.dll\"\n \"140015001cb82a72@ADVAPI32.dll\"\n \"1700180038b82a72@ADVAPI32.dll\"\n \"0d000e0054b82a72@ADVAPI32.dll\"\n \"1100120064b82a72@ADVAPI32.dll\"\n \"110012007cb82a72@ADVAPI32.dll\"\n \"0f001000ecb92a72@ADVAPI32.dll\"\n \"1400150038ba2a72@ADVAPI32.dll\"\n \"1400150054ba2a72@ADVAPI32.dll\"\n \"0c000d00a8ba2a72@ADVAPI32.dll\"\n \"0c000d00b8ba2a72@ADVAPI32.dll\"\n \"0e000f00c8ba2a72@ADVAPI32.dll\"\n \"0e000f00dcba2a72@ADVAPI32.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"$38","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe\" touched \"NDP SymBinder\" (Path: \"HKCU\\CLSID\\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\\INPROCSERVER32\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"\n \"pcimon.exe\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","id":"static-144","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"DISMHOST.EXE.6AA909CD.bin\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0\" has an executable section named \".text\"\n \"pcimon.exe\" has an executable section named \".text\"\n \"DISMHOST.EXE.6AA909CD.bin\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"DISMHOST.EXE.6AA909CD.bin\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$39","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"schtasks.exe\" (UID: 00000000-00005736) was launched with new environment variables: \"USERDNSDOMAIN=\"%OSUSER%-PC\"\"\n Process \"schtasks.exe\" (UID: 00000000-00005736) was launched with modified environment variables: \"NUMBER_OF_PROCESSORS\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"ubanano20.ddns.net\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\"; Key: \"SYEARMONTH\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"schtasks.exe\" with commandline \"/create /f /tn \"PCI Monitor\" /xml \"%TEMP%\\\\tmpF739.tmp\"\" (UID: 00000000-00005736)\n Spawned process \"schtasks.exe\" with commandline \"/create /f /tn \"PCI Monitor Task\" /xml \"%TEMP%\\\\tmpF99B.tmp\"\" (UID: 00000000-00005932)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"schtasks.exe\" with commandline \"/create /f /tn \"PCI Monitor\" /xml \"%TEMP%\\\\tmpF739.tmp\"\" (UID: 00000000-00005736)\n Spawned process \"schtasks.exe\" with commandline \"/create /f /tn \"PCI Monitor Task\" /xml \"%TEMP%\\\\tmpF99B.tmp\"\" (UID: 00000000-00005932)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"pcimon.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"DISMHOST.EXE.6AA909CD.bin\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\tmpF739.tmp\"\n \"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\tmpF99B.tmp\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe\" connecting to \"\\ThemeApiPort\"\n \"schtasks.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","mitre_attack_id":"T1559","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00001792.00000001.80253.00591000.00000020.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00001792.00000001.80253.00591000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$3b","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops XML files","description":"\"tmpF739.tmp\" has type \"XML 1.0 document ASCII text with CRLF line terminators\" - Location: [%TEMP%\\tmpF739.tmp]\n \"tmpF99B.tmp\" has type \"XML 1.0 document ASCII text with CRLF line terminators\" - Location: [%TEMP%\\tmpF99B.tmp]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-39","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"\"tmpF739.tmp\" has type \"XML 1.0 document ASCII text with CRLF line terminators\" - Location: [%TEMP%\\tmpF739.tmp]\n \"tmpF99B.tmp\" has type \"XML 1.0 document ASCII text with CRLF line terminators\" - Location: [%TEMP%\\tmpF99B.tmp]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$3c","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe\" queries basic process information of the \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\Protocol_Catalog9\" (UID: 5812)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$3d","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe\" reads file \"c:\\windows\\microsoft.net\\framework\\v2.0.50727\\config\\machine.config\"\n \"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe\" reads file \"c:\\f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe\"\n \"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe\" reads file \"c:\\windows\\assembly\\gac_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\mscorlib.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify sandbox environment running process","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$3e","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in program files directory","description":"\"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe\" touched file \"C:\\Program Files\\PCI Monitor\\pcimon.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-113","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$3f","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$40","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe\" writes file \"c:\\users\\%osuser%\\appdata\\roaming\\733c94c5-cebb-4f98-a75f-22a797d1d50b\\run.dat\"\n \"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe\" writes file \"c:\\program files\\pci monitor\\pcimon.exe\"\n \"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\tmpf739.tmp\"\n \"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe\" writes file \"c:\\users\\%osuser%\\appdata\\roaming\\733c94c5-cebb-4f98-a75f-22a797d1d50b\\task.dat\"\n \"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\tmpf99b.tmp\"\n \"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe\" writes file \"c:\\users\\%osuser%\\appdata\\roaming\\733c94c5-cebb-4f98-a75f-22a797d1d50b\\logs\\%osuser%\\kb_-1820449351.dat\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\733C94C5-CEBB-4F98-A75F-22A797D1D50B\\run.dat\"\n \"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\733C94C5-CEBB-4F98-A75F-22A797D1D50B\\task.dat\"\n \"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\733C94C5-CEBB-4F98-A75F-22A797D1D50B\\Logs\\%OSUSER%\\KB_-1820449351.dat\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00005812-00000C2C-189820127\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to register an interface (RPC)","description":"\"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00005812)","origin":"API Call","mitre_attack_id":"T1021","relevance":3,"id":"api-219","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00005812-00000C2C-189802093\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$41","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on process \"00000000-00005812\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Embedded PE executable","description":"YARA signature matched on embedded PE in process \"00000000-00005812\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":2,"id":"yara-140","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLEB45FFDDC445F43F895BACC20CCD6]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00001792.00000000.79547.000C0000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLEEA27309DE36B4225BDFD1FD31C54]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00001792.00000000.79547.000C0000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLEDB82006847744461A11A7870D966]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00005812.00000001.77402.004A0000.00000004.mdmp, 00000000-00005812.00000002.79327.004A0000.00000004.mdmp, 00000000-00005812.00000003.84853.004A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00001792.00000000.79547.000C0000.00000004.mdmp\")\n Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00005812.00000000.75482.004A0000.00000004.mdmp, 00000000-00005812.00000001.77402.004A0000.00000004.mdmp, 00000000-00005812.00000002.79327.004A0000.00000004.mdmp, 00000000-00005812.00000003.84853.004A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to perform SQL operations","description":"$42","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"MapVirtualKeyEx\" (Indicator: \"MapVirtualKey\"; Source: \"00000000-00005812.00000000.75482.01EE0000.00000004.mdmp, 00000000-00005812.00000000.75482.02EE0000.00000004.mdmp, 00000000-00005812.00000001.77402.02EE0000.00000004.mdmp, 00000000-00005812.00000002.79327.02EE0000.00000004.mdmp, 00000000-00005812.00000003.84853.00870000.00000004.mdmp\")\n Found reference to API \"GetKeyboardState\" (Indicator: \"GetKeyboardState\"; Source: \"00000000-00005812.00000000.75482.01EE0000.00000004.mdmp, 00000000-00005812.00000000.75482.02EE0000.00000004.mdmp, 00000000-00005812.00000001.77402.02EE0000.00000004.mdmp, 00000000-00005812.00000002.79327.02EE0000.00000004.mdmp, 00000000-00005812.00000003.84853.00870000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve running process details (.NET)","description":"Found string \"GetProcessById\" (Source: \"00000000-00005812.00000000.75482.01EE0000.00000004.mdmp, 00000000-00005812.00000000.75482.02EE0000.00000004.mdmp, 00000000-00005812.00000001.77402.02EE0000.00000004.mdmp, 00000000-00005812.00000002.79327.02EE0000.00000004.mdmp, 00000000-00005812.00000003.84853.00870000.00000004.mdmp\")\n Found string \"get_ProcessName\" (Source: \"00000000-00005812.00000000.75482.01EE0000.00000004.mdmp, 00000000-00005812.00000000.75482.02EE0000.00000004.mdmp, 00000000-00005812.00000001.77402.02EE0000.00000004.mdmp, 00000000-00005812.00000002.79327.02EE0000.00000004.mdmp, 00000000-00005812.00000003.84853.00870000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-931","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$43","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"schtasks.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to register/read input devices (API string)","description":"Found reference to API \"RegisterRawInputDevices\" (Indicator: \"RegisterRawInputDevices\"; Source: \"00000000-00005812.00000000.75482.01EE0000.00000004.mdmp, 00000000-00005812.00000000.75482.02EE0000.00000004.mdmp, 00000000-00005812.00000001.77402.02EE0000.00000004.mdmp, 00000000-00005812.00000002.79327.02EE0000.00000004.mdmp, 00000000-00005812.00000003.84853.00870000.00000004.mdmp\")\n Found reference to API \"GetRawInputData\" (Indicator: \"GetRawInputData\"; Source: \"00000000-00005812.00000000.75482.01EE0000.00000004.mdmp, 00000000-00005812.00000000.75482.02EE0000.00000004.mdmp, 00000000-00005812.00000001.77402.02EE0000.00000004.mdmp, 00000000-00005812.00000002.79327.02EE0000.00000004.mdmp, 00000000-00005812.00000003.84853.00870000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056","relevance":1,"id":"string-403","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00001792.00000001.80253.00591000.00000020.mdmp\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00001792.00000001.80253.00591000.00000020.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00001792.00000001.80253.00591000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00001792.00000001.80253.00591000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; File: \"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0\")\n Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00001792.00000001.80253.00591000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00001792.00000001.80253.00591000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00001792.00000001.80253.00591000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve user privileges","description":"System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole) at 0f41a135573fcbcc4f1b36684527438a-600007e-#_qjIje6jGWLd2EOkfZXKqBbg_~#_qBcRYABJptno3_fpXoMXAvg_","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1033","relevance":5,"id":"stream-136","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"p_DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00001792.00000001.80253.00591000.00000020.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$44","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"Resolved hostname '{0}' to '{1}'\" (Indicator: \"hostname\"; File: \"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0\")\n Found string \"String hostName\" (Indicator: \"hostname\"; Source: \"00000000-00005812.00000001.77402.01EE0000.00000004.mdmp, 00000000-00005812.00000002.79327.01EE0000.00000004.mdmp\")\n Found string \"hostName\" (Indicator: \"hostname\"; Source: \"00000000-00005812.00000001.77402.01EE0000.00000004.mdmp, 00000000-00005812.00000002.79327.01EE0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe\" called an API \"AdjustTokenPrivileges\"on file: C:\\Windows\\System32\\mswsock.dll\" (UID: 00000000-00005812)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$45","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00005812.00000001.77402.01EE0000.00000004.mdmp, 00000000-00005812.00000002.79327.01EE0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00001792.00000001.80253.00591000.00000020.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00001792.00000001.80253.00591000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"$46","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe\" opened \"\\Device\\KsecDD\"\n \"schtasks.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$47","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"\"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"PCI MONITOR\"; Value: \"%PROGRAMFILES%\\PCI Monitor\\pcimon.exe\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to multiple windows system processes","description":"Found strings \"smss.exe,csrss.exe,wininit.exe,winlogon.exe,services.exe\" (Source: \"00000000-00005812.00000003.84853.04670000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":3,"id":"string-455","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"KB_-1820449351.dat\" - Location: [%APPDATA%\\733C94C5-CEBB-4F98-A75F-22A797D1D50B\\Logs\\%OSUSER%\\KB_-1820449351.dat]- [targetUID: 00000000-00005812]\n Dropped file: \"task.dat\" - Location: [%APPDATA%\\733C94C5-CEBB-4F98-A75F-22A797D1D50B\\task.dat]- [targetUID: 00000000-00005812]\n Dropped file: \"run.dat\" - Location: [%APPDATA%\\733C94C5-CEBB-4F98-A75F-22A797D1D50B\\run.dat]- [targetUID: 00000000-00005812]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$48","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0\" was detected as \"Microsoft Visual C# v7.0 / Basic .NET\"\n \"pcimon.exe\" was detected as \"Microsoft Visual C# v7.0 / Basic .NET\"\n \"DISMHOST.EXE.6AA909CD.bin\" was detected as \"Visual C++ 2005 Release -> Microsoft\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0\" has section name .rsrc with entropy \"7.997626966077666\"\n \"pcimon.exe\" has section name .rsrc with entropy \"7.997626966077666\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"level":"suspicious","category":"Environment Awareness","name":"Attempts to retrieve geographical location information","description":"\"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe\" called \"getaddrinfo\" with parameters {\"pNodeName\": \"ubanano20.ddns.net\"\n \"pHints\": \"4b3f324\"\n \"ppResult\": \"00000000\"}\n \"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe\" called \"getaddrinfo\" with parameters {\"pNodeName\": \"ubanano20.ddns.net\"\n \"pHints\": \"4f3f274\"\n \"ppResult\": \"00000000\"}\n \"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe\" called \"getaddrinfo\" with parameters {\"pNodeName\": \"ubanano20.ddns.net\"\n \"pHints\": \"4b6f474\"\n \"ppResult\": \"00000000\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-308","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"22/24 Antivirus vendors marked sample as malicious (91% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"level":"suspicious","category":"General","name":"PE file has unusual entropy resources","description":"\"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0\" has resource with unusual entropy \"RT_RCDATA:7.997835774955821\"\n \"pcimon.exe\" has resource with unusual entropy \"RT_RCDATA:7.997835774955821\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":5,"id":"static-92","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"pcimon.exe\" has type \"PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 3 sections\"- Location: [%PROGRAMFILES%\\PCI Monitor\\pcimon.exe]- [targetUID: 00000000-00005812]\n \"DISMHOST.EXE.6AA909CD.bin\" has type \"PE32 executable for MS Windows 5.01 (GUI) Intel i386 4 sections\"- [targetUID: 00000000-00005812]","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"PCI MONITOR\"; Value: \"%PROGRAMFILES%\\PCI Monitor\\pcimon.exe\")","origin":"Registry Access","mitre_attack_id":"T1547.001","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"WmiPrvSE.exe\" (Indicator: \"wmiprvse.exe\"; in Source: \"00000000-00005812.00000003.84853.04670000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API that may be used to take screenshots","description":"\"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"6c010b9c\"\n \"cx\": \"160\"\n \"cy\": \"27\"}\n \"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"60010ce9\"\n \"cx\": \"16\"\n \"cy\": \"16\"}\n \"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"c80101b7\"\n \"cx\": \"6\"\n \"cy\": \"21\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":1,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\tmpF739.tmp\" for deletion\n \"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\tmpF99B.tmp\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$49","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"suspicious","category":"System Security","name":"Adjusts debug privileges","description":"\"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe\" adjusted SE_DEBUG_PRIVILEGE on file \"C:\\Windows\\System32\\mswsock.dll\"","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-28","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegOpenKeyExW\n SetSecurityDescriptorDacl\n RegCloseKey\n GetModuleHandleW\n GetStartupInfoA\n GetModuleHandleA\n TerminateProcess\n GetVersionExW\n OutputDebugStringA\n CreateFileMappingW\n GetModuleHandleExW\n OutputDebugStringW\n GetModuleFileNameW\n GetProcAddress\n GetVersionExA\n Sleep\n CreateThread\n GetTickCount\n LoadLibraryExW\n GetCommandLineW\n UnhandledExceptionFilter\n MapViewOfFile\n CreateFileW\n GetSystemDirectoryW\n GetFileAttributesW\n LoadLibraryW\n FindResourceExW","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Tries to hide tracks of having downloaded a file from the internet","description":"\"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe\" opened \"C:\\f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe:Zone.Identifier\" with delete access\n \"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe\" opened \"C:\\f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0.exe:ZONE.IDENTIFIER\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-42","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"22/24 Antivirus vendors marked sample as malicious (91% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"22/24 Antivirus vendors marked dropped file \"pcimon.exe\" as malicious (classified as \"Trojan.NanoCore\" with 91% detection rate)","origin":"Binary File","mitre_attack_id":"T1204.002","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"level":"malicious","category":"Installation/Persistence","name":"Schedules a task to be executed at a specific time and date","description":"Process \"schtasks.exe\" with commandline \"/create /f /tn \"PCI Monitor\" /xml \"%TEMP%\\\\tmpF739.tmp\"\" (UID: 00000000-00005736)\n Process \"schtasks.exe\" with commandline \"/create /f /tn \"PCI Monitor Task\" /xml \"%TEMP%\\\\tmpF99B.tmp\"\" (UID: 00000000-00005932)","origin":"Monitored Target","mitre_attack_id":"T1053.005","relevance":8,"id":"target-13","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"}]},{"level":"malicious","category":"Installation/Persistence","name":"Schedules a task to be executed from task XML file","description":"Process \"schtasks.exe\" with commandline \"/create /f /tn \"PCI Monitor\" /xml \"%TEMP%\\\\tmpF739.tmp\"\" (UID: 00000000-00005736)\n Process \"schtasks.exe\" with commandline \"/create /f /tn \"PCI Monitor Task\" /xml \"%TEMP%\\\\tmpF99B.tmp\"\" (UID: 00000000-00005932)","origin":"Monitored Target","mitre_attack_id":"T1053.005","relevance":5,"id":"target-414","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"$4a","origin":"YARA Signature","relevance":9,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Known malware detected","description":"The sample is known malware – NanoCore","origin":"Indicator Combinations","mitre_attack_id":"T1219","relevance":10,"id":"summary-5009","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify process memory (API string)","description":"Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00007388.00000000.68146.05990000.00000004.mdmp, 00000000-00007388.00000000.68146.06990000.00000004.mdmp, 00000000-00007388.00000001.70065.06990000.00000004.mdmp, 00000000-00007388.00000002.71985.06990000.00000004.mdmp, 00000000-00007388.00000002.71985.08590000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":1,"id":"string-439","sources":[{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00007388.00000000.68146.03620000.00000004.mdmp, 00000000-00007388.00000001.70065.03620000.00000004.mdmp, 00000000-00007388.00000002.71985.03620000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00007388.00000000.68146.05990000.00000004.mdmp, 00000000-00007388.00000001.70065.05990000.00000004.mdmp, 00000000-00007388.00000002.71985.05990000.00000004.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00007388.00000000.68146.05990000.00000004.mdmp, 00000000-00007388.00000001.70065.05990000.00000004.mdmp, 00000000-00007388.00000002.71985.05990000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$4c","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"file/memory contains long string with (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00007388.00000001.70065.05990000.00000004.mdmp, 00000000-00007388.00000002.71985.05990000.00000004.mdmp\")\n Found string \"Uses RsaCryptoServiceProvider to encrypt and decrypt\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00007388.00000001.70065.05990000.00000004.mdmp, 00000000-00007388.00000002.71985.05990000.00000004.mdmp\")\n Found string \"Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\" description=\"Uses RsaCryptoServiceProvider to encrypt and decrypt\" keyContainerName=\"NetFrameworkConfigurationKey\" cspProviderName=\"\" useMachineContainer=\"true\" useOAEP=\"false\"/>\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00007388.00000001.70065.05990000.00000004.mdmp\n 00000000-00007388.00000002.71985.05990000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-352","sources":[{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language (API string)","description":"Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; Source: \"00000000-00007388.00000000.68146.05990000.00000004.mdmp, 00000000-00007388.00000000.68146.06990000.00000004.mdmp, 00000000-00007388.00000001.70065.06990000.00000004.mdmp, 00000000-00007388.00000002.71985.06990000.00000004.mdmp, 00000000-00007388.00000002.71985.08590000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"bUmn.exe\" queries volume information of \"C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualBasic\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualBasic.dll\" at 00000000-00007388-00000C15-51089478\n \"bUmn.exe\" queries volume information of \"C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualBasic\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualBasic.dll\" at 00000000-00007388-00000C15-51090025\n \"bUmn.exe\" queries volume information of \"C:\\Windows\\assembly\\GAC_MSIL\\System.Configuration\\2.0.0.0__b03f5f7f11d50a3a\\System.configuration.dll\" at 00000000-00007388-00000C15-54478896\n \"bUmn.exe\" queries volume information of \"C:\\Windows\\assembly\\GAC_MSIL\\System.Configuration\\2.0.0.0__b03f5f7f11d50a3a\\System.configuration.dll\" at 00000000-00007388-00000C15-54479366","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"}]},{"level":"informative","category":"General","name":"Can loads assembly that contains the code that is currently executing [Dotnet]","description":"Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; File: \"bUmn.exe\")\n Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; Source: \"00000000-00007388.00000000.68146.00F42000.00000002.mdmp, 00000000-00007388.00000000.68146.05990000.00000004.mdmp, 00000000-00007388.00000000.68146.06990000.00000004.mdmp, 00000000-00007388.00000001.70065.06990000.00000004.mdmp, 00000000-00007388.00000002.71985.06990000.00000004.mdmp, 00000000-00007388.00000002.71985.08590000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1620","relevance":1,"id":"string-615","sources":[{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"194.147.140.151:9090\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"bUmn.exe\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00007388.00000000.68146.00F42000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"bUmn.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"bUmn.exe\" called \"NtQueueApcThread\" (UID: 00000000-00007388)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 1fc1c530fdab845a0a2b05d0b5335bcb","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES Encryption","description":"YARA signature for AES encryption matched on process \"00000000-00007388\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"bUmn.exe\" called \"GetComputerNameW\" (UID: 00000000-00007388)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"bUmn.exe\" called \"GetUserNameW\" (UID: 00000000-00007388)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$4e","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"Found reference to API \"RegOpenKeyEx\" (Indicator: \"RegOpenKey\"; File: \"bUmn.exe\")\n Found reference to API \"RegQueryValueEx\" (Indicator: \"RegQueryValue\"; File: \"bUmn.exe\")\n Found reference to API \"RegOpenKeyEx\" (Indicator: \"RegOpenKey\"; Source: \"00000000-00007388.00000000.68146.00F42000.00000002.mdmp\")\n Found reference to API \"RegQueryValueEx\" (Indicator: \"RegQueryValue\"; Source: \"00000000-00007388.00000000.68146.00F42000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"MapVirtualKeyEx\" (Indicator: \"MapVirtualKey\"; Source: \"00000000-00007388.00000000.68146.05990000.00000004.mdmp, 00000000-00007388.00000000.68146.06990000.00000004.mdmp, 00000000-00007388.00000001.70065.06990000.00000004.mdmp, 00000000-00007388.00000002.71985.06990000.00000004.mdmp, 00000000-00007388.00000002.71985.08590000.00000004.mdmp\")\n Found reference to API \"GetKeyboardState\" (Indicator: \"GetKeyboardState\"; Source: \"00000000-00007388.00000000.68146.05990000.00000004.mdmp, 00000000-00007388.00000000.68146.06990000.00000004.mdmp, 00000000-00007388.00000001.70065.06990000.00000004.mdmp, 00000000-00007388.00000002.71985.06990000.00000004.mdmp, 00000000-00007388.00000002.71985.08590000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \",3165,,GetUserNameW,advapi32\" (Indicator: \"GetUserName\"; Source: \"00000000-00007388.00000001.70065.03620000.00000004.mdmp, 00000000-00007388.00000002.71985.03620000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"\"RuntimeBroker.exe\" (Indicator: \"runtimebroker.exe\")\n \"backgroundTaskHost.exe\" (Indicator: \"backgroundtaskhost.exe\")","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"bUmn.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"bUmn.exe\" is allocating memory with PAGE_GUARD access rights (Handle: 4294967295); (PID: 7388)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Uses a .NET obfuscator to hide its code","description":"\"CompressionMode\" is a hint for the obfuscator \"MPRESS\"\n \"System.IO.Compression\" is a hint for the obfuscator \"MPRESS\"\n \"Decompress\" is a hint for the obfuscator \"MPRESS\"\n \"compress\" is a hint for the obfuscator \"MPRESS\"\n \"Compression.RangeCoder\" is a hint for the obfuscator \"MPRESS\"\n \"Compression.LZMA\" is a hint for the obfuscator \"MPRESS\"\n \"Compression.LZ\" is a hint for the obfuscator \"MPRESS\"\n \"Memory Compression\" is a hint for the obfuscator \"MPRESS\"","origin":"File/Memory","mitre_attack_id":"T1140","relevance":2,"id":"string-6","sources":[{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to measure performance","description":"rdtsc at 32227-1-0041E792","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":10,"id":"stream-6","sources":[{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to evade analysis by sleeping many times","description":"\"bUmn.exe\" (Thread ID: 6396) slept \"525\" times (threshold: 500)","origin":"API Call","mitre_attack_id":"T1497.003","relevance":10,"id":"api-47","sources":[{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"suspicious","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET POLICY DNS Query to DynDNS Domain *.ddns .net\" (SID: 2028675, Rev: 2, Severity: 2) categorized as \"Potentially Bad Traffic\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-1","sources":[{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection","description":"$50","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1571","relevance":5,"id":"stream-85","sources":[{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"suspicious","category":"Network Related","name":"Spawned process connects to a network","description":"Process \"C:\\bUmn.exe\" connects to 194.147.140.151 on port 9090 (TCP); Domain: \"ubanano20.ddns.net\"","origin":"Monitored Target","mitre_attack_id":"T1071","relevance":5,"id":"target-412","sources":[{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to find and list the Windows drive types","description":"\"bUmn.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00007388)","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-110","sources":[{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found system commands related strings","description":"Found string \"Resolved hostname '{0}' to '{1}'\" (Indicator: \"hostname\"; File: \"bUmn.exe\")\n Found string \"Resolved hostname 'ubanano20.ddns.net' to '\" (Indicator: \"hostname\"; Source: \"00000000-00007388.00000001.70065.05990000.00000004.mdmp, 00000000-00007388.00000002.71985.05990000.00000004.mdmp\")\n Found string \"Resolved hostname '{0}' to '{1}'\" (Indicator: \"hostname\"; Source: \"00000000-00007388.00000001.70065.05990000.00000004.mdmp, 00000000-00007388.00000002.71985.05990000.00000004.mdmp\")\n Found string \"Resolved hostname 'ubanano20.ddns.net' to '194.147.140.151'\" (Indicator: \"hostname\"; Source: \"00000000-00007388.00000001.70065.05990000.00000004.mdmp, 00000000-00007388.00000002.71985.05990000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"malicious","category":"Installation/Persistence","name":"Loads the task scheduler COM API","description":"\"schtasks.exe\" loaded module \"%WINDIR%\\SysWOW64\\taskschd.dll\" at 73230000","origin":"Loaded Module","mitre_attack_id":"T1559.001","relevance":5,"id":"module-4","sources":[{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"bUmn.exe\" wrote 00000004 bytes to a remote process \"C:\\Windows\\SysWOW64\\schtasks.exe\" (Handle: 1080)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 194.147.140.151 on port 9090","origin":"Network Traffic","mitre_attack_id":"T1571","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$51","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\"bUmn.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"1258358725\"\n \"cx\": \"160\"\n \"cy\": \"27\"}\n \"bUmn.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"151062874\"\n \"cx\": \"16\"\n \"cy\": \"16\"}\n \"bUmn.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"1258358725\"\n \"cx\": \"6\"\n \"cy\": \"21\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"suspicious","category":"Environment Awareness","name":"Tries to sleep for a long time (more than two minutes)","description":"\"pcimon.exe\" sleeping for \"1566804069\" milliseconds","origin":"API Call","mitre_attack_id":"T1497.003","relevance":10,"id":"api-24","sources":[{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"suspicious","category":"Network Related","name":"Spawned processes likely due to injection","description":"Process \"%PROGRAMFILES%\\PCI Monitor\\pcimon.exe\" spawned likely due to injection","origin":"Monitored Target","mitre_attack_id":"T1055","relevance":3,"id":"target-413","sources":[{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"malicious","category":"Installation/Persistence","name":"Allocates virtual memory in a remote process","description":"\"bUmn.exe\" allocated memory in \"C:\\bUmn.exe\"","origin":"API Call","mitre_attack_id":"T1055","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"bUmn.exe\" (UID: 00000000-00002900)\n Spawned process \"schtasks.exe\" with commandline \"/create /f /tn \"PCI Monitor\" /xml \"%TEMP%\\\\tmpA5FB.tmp\"\" (UID: 00000000-00002784)\n Spawned process \"schtasks.exe\" with commandline \"/create /f /tn \"PCI Monitor Task\" /xml \"%TEMP%\\\\tmpA9C5.tmp\"\" (UID: 00000000-00002908)\n Spawned process \"pcimon.exe\" (UID: 00000000-00002972)\n Spawned process \"schtasks.exe\" with commandline \"/create /f /tn \"PCI Monitor Task\" /xml \"%TEMP%\\\\tmp519.tmp\"\" (UID: 00000000-00002980)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Schedules a task to be executed at a specific time and date"}],"sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries kernel debugger information"}],"sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Marks file for deletion"},{"detail":"Tries to hide tracks of having downloaded a file from the internet"}],"sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]}],"intel_graph":{"map":{"Domain:ubanano20.ddns.net":{"type":"Domain","value":"ubanano20.ddns.net"},"File:05b2fd5fcfecf5f8e4ff92e8bb869686aef01cf19f3052e44f89ce0c382ae20e":{"type":"File","value":"05b2fd5fcfecf5f8e4ff92e8bb869686aef01cf19f3052e44f89ce0c382ae20e"},"File:1409cc4125f7e08d09a731da789dc35c09afa8e716c00ad22d9f3f1b17a2cb33":{"type":"File","value":"1409cc4125f7e08d09a731da789dc35c09afa8e716c00ad22d9f3f1b17a2cb33"},"File:2a09a343518e0f28beab225b2ea2bd9f2f2505df136a6ec950ea7e5c298e4a7b":{"type":"File","value":"2a09a343518e0f28beab225b2ea2bd9f2f2505df136a6ec950ea7e5c298e4a7b"},"File:30a72182b99b543c261f7503a9e3ae865e442b812ae440fa17dab71cadb464db":{"type":"File","value":"30a72182b99b543c261f7503a9e3ae865e442b812ae440fa17dab71cadb464db"},"File:4cd2cf740a16c11cd524cc743caeaf03beca08d37322e82be5f69b23d682bada":{"type":"File","value":"4cd2cf740a16c11cd524cc743caeaf03beca08d37322e82be5f69b23d682bada"},"File:4e3778723061d368ebc22641c2ff7d0d1afb6285f5669323cb5c5d7d834c7a40":{"type":"File","value":"4e3778723061d368ebc22641c2ff7d0d1afb6285f5669323cb5c5d7d834c7a40"},"File:66123c40a7f01c5443003eb28b668d2f0a1c42664863de1d1ec9133e8fc6b654":{"type":"File","value":"66123c40a7f01c5443003eb28b668d2f0a1c42664863de1d1ec9133e8fc6b654"},"File:67ef123e0ca425b7cf24eb11cd67272221c99800ee6af7ed8b7b21f9c51b40cb":{"type":"File","value":"67ef123e0ca425b7cf24eb11cd67272221c99800ee6af7ed8b7b21f9c51b40cb"},"File:b65b32e739f887c18604dcdb2c1d7d4075a35e73e78f0ae2ee7ec500d83ee7ea":{"type":"File","value":"b65b32e739f887c18604dcdb2c1d7d4075a35e73e78f0ae2ee7ec500d83ee7ea"},"File:c470f45efd2e7c4c5b88534a18965a78dce0f8e154d3e45a9d5569ad0e334bdb":{"type":"File","value":"c470f45efd2e7c4c5b88534a18965a78dce0f8e154d3e45a9d5569ad0e334bdb"},"File:da3879a31eb6ea16e60bb81fce9ec7b9d0ea323b7cde0ecc932c3c69cd167673":{"type":"File","value":"da3879a31eb6ea16e60bb81fce9ec7b9d0ea323b7cde0ecc932c3c69cd167673"},"File:ecb636b278261eade712e68ec7d805d20e802628248da872d3d0ada1432ffc11":{"type":"File","value":"ecb636b278261eade712e68ec7d805d20e802628248da872d3d0ada1432ffc11"},"File:f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0":{"type":"File","value":"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["File reported as trojan by ClamAV antivirus","confirmed malicious file","confirmed relationship with a Threat NanoCore"]}},"Ip:194.147.140.151":{"type":"Ip","value":"194.147.140.151"},"Threat:dcf7cfc508662e9e5dac9d80c1760b8efe6afdaf4fb62b293fdc2aa709d564d8":{"type":"Threat","value":"NanoCore","verdict":{"verdict":"malicious","verdict_source":"indicator database"}}},"chains":[{"id":"1549288561842333446","root":"File:f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0","edges":[],"verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["File reported as trojan by ClamAV antivirus","confirmed malicious file","confirmed relationship with a Threat NanoCore"]}},{"id":"1549288554478296743","root":"File:f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0","edges":[{"edge_kind":"is_threat","from_key":"File:f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0","to_key":"Threat:dcf7cfc508662e9e5dac9d80c1760b8efe6afdaf4fb62b293fdc2aa709d564d8"}],"verdict":{"verdict":"malicious","verdict_source":"indicator database"}},{"id":"sandbox_network","root":"File:f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0","edges":[{"edge_kind":"contacted_ip","from_key":"File:f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0","to_key":"Ip:194.147.140.151"},{"edge_kind":"contacted_domain","from_key":"File:f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0","to_key":"Domain:ubanano20.ddns.net"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0","edges":[{"edge_kind":"extracted","from_key":"File:f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0","to_key":"File:f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0"},{"edge_kind":"extracted","from_key":"File:f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0","to_key":"File:ecb636b278261eade712e68ec7d805d20e802628248da872d3d0ada1432ffc11"},{"edge_kind":"extracted","from_key":"File:f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0","to_key":"File:30a72182b99b543c261f7503a9e3ae865e442b812ae440fa17dab71cadb464db"},{"edge_kind":"extracted","from_key":"File:f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0","to_key":"File:4cd2cf740a16c11cd524cc743caeaf03beca08d37322e82be5f69b23d682bada"},{"edge_kind":"extracted","from_key":"File:f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0","to_key":"File:67ef123e0ca425b7cf24eb11cd67272221c99800ee6af7ed8b7b21f9c51b40cb"},{"edge_kind":"extracted","from_key":"File:f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0","to_key":"File:da3879a31eb6ea16e60bb81fce9ec7b9d0ea323b7cde0ecc932c3c69cd167673"},{"edge_kind":"extracted","from_key":"File:f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0","to_key":"File:4e3778723061d368ebc22641c2ff7d0d1afb6285f5669323cb5c5d7d834c7a40"},{"edge_kind":"extracted","from_key":"File:f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0","to_key":"File:b65b32e739f887c18604dcdb2c1d7d4075a35e73e78f0ae2ee7ec500d83ee7ea"},{"edge_kind":"extracted","from_key":"File:f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0","to_key":"File:2a09a343518e0f28beab225b2ea2bd9f2f2505df136a6ec950ea7e5c298e4a7b"},{"edge_kind":"extracted","from_key":"File:f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0","to_key":"File:c470f45efd2e7c4c5b88534a18965a78dce0f8e154d3e45a9d5569ad0e334bdb"},{"edge_kind":"extracted","from_key":"File:f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0","to_key":"File:f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0"},{"edge_kind":"extracted","from_key":"File:f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0","to_key":"File:1409cc4125f7e08d09a731da789dc35c09afa8e716c00ad22d9f3f1b17a2cb33"},{"edge_kind":"extracted","from_key":"File:f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0","to_key":"File:2a09a343518e0f28beab225b2ea2bd9f2f2505df136a6ec950ea7e5c298e4a7b"},{"edge_kind":"extracted","from_key":"File:f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0","to_key":"File:4cd2cf740a16c11cd524cc743caeaf03beca08d37322e82be5f69b23d682bada"},{"edge_kind":"extracted","from_key":"File:f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0","to_key":"File:4cd2cf740a16c11cd524cc743caeaf03beca08d37322e82be5f69b23d682bada"},{"edge_kind":"extracted","from_key":"File:f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0","to_key":"File:f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0"},{"edge_kind":"extracted","from_key":"File:f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0","to_key":"File:05b2fd5fcfecf5f8e4ff92e8bb869686aef01cf19f3052e44f89ce0c382ae20e"},{"edge_kind":"extracted","from_key":"File:f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0","to_key":"File:66123c40a7f01c5443003eb28b668d2f0a1c42664863de1d1ec9133e8fc6b654"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":5,"spawned_processes_count":5,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":8,"imported_dlls_count":100,"dropped_files_count":0,"extracted_files_count":18,"files_written_count":19,"files_deleted_count":0,"registry_keys_created_count":3,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":3,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["rat","nanocore","noancooe","windows-server-utility"],"sample_flags":["Network Traffic","Extracted Files","Launch Failed","Multi-Process"],"sandbox_reports":[{"id":"6aa8d5652c6e3302e30c2862","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.NanoCore","submit_name":"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0","analysis_start_time":"2026-09-15T05:19:34+00:00","indicators_count":{"informative":164,"suspicious":34,"malicious":9},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"65fa2919dd05a192d408bcd4","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["CHE"],"submit_name":"bUmn.exe","analysis_start_time":"2024-03-20T00:08:57+00:00","indicators_count":{"informative":115,"suspicious":35,"malicious":8},"tags":["Network Traffic","Extracted Files","Launch Failed"],"is_in_unified_schema":true},{"id":"65fa28e6e606a9260d024362","environment_id":110,"environment_description":"Windows 7 32 bit (HWP Support)","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["CHE"],"submit_name":"bUmn.exe","analysis_start_time":"2024-03-20T00:08:07+00:00","indicators_count":{"informative":111,"suspicious":36,"malicious":9},"tags":["Multi-Process","Network Traffic","Extracted Files","Launch Failed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"194.147.140.151","port":9090,"protocol":"TCP","country":"Switzerland","sources":[{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]}],"dns_resolutions":[{"domain":"ubanano20.ddns.net","ttl":1800,"country":"-","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}],"processes":[{"pid":2900,"ppid":0,"name":"bUmn.exe","command_line":"","sha256":"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0","normalized_path":"C:\\bUmn.exe","uid":"00000000-00002900","icon":"$52"},{"pid":2784,"ppid":2900,"name":"schtasks.exe","command_line":"/create /f /tn \"PCI Monitor\" /xml \"%TEMP%\\tmpA5FB.tmp\"","sha256":"15018d0093befabba8b927743191030d1f8c17bb97fdb48c2fc3eab20e2d4b3d","normalized_path":"%WINDIR%\\system32\\schtasks.exe","parent_uid":"00000000-00002900","uid":"00000000-00002784"},{"pid":2908,"ppid":2900,"name":"schtasks.exe","command_line":"/create /f /tn \"PCI Monitor Task\" /xml \"%TEMP%\\tmpA9C5.tmp\"","sha256":"15018d0093befabba8b927743191030d1f8c17bb97fdb48c2fc3eab20e2d4b3d","normalized_path":"%WINDIR%\\system32\\schtasks.exe","parent_uid":"00000000-00002900","uid":"00000000-00002908"},{"pid":2972,"ppid":0,"name":"pcimon.exe","command_line":"","sha256":"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0","normalized_path":"%PROGRAMFILES%\\PCI Monitor\\pcimon.exe","uid":"00000000-00002972","icon":"$53"},{"pid":2980,"ppid":2972,"name":"schtasks.exe","command_line":"/create /f /tn \"PCI Monitor Task\" /xml \"%TEMP%\\tmp519.tmp\"","sha256":"15018d0093befabba8b927743191030d1f8c17bb97fdb48c2fc3eab20e2d4b3d","normalized_path":"%WINDIR%\\system32\\schtasks.exe","parent_uid":"00000000-00002972","uid":"00000000-00002980"}],"all_imported_dlls":["shfolder.dll","user32.dll","api-ms-win-crt-runtime-l1-1-0.dll","api-ms-win-crt-stdio-l1-1-0.dll","bcrypt.dll","msctf.dll","api-ms-win-core-localization-l1-2-0.dll","api-ms-win-core-file-l1-2-0.dll","profapi.dll","tzres.dll","KernelBase.dll","usp10.dll","imm32.dll","ws2_32.dll","api-ms-win-core-processthreads-l1-1-1.dll","api-ms-win-crt-convert-l1-1-0.dll","version.dll","System.Drawing.ni.dll","VxSSL32.dll","System.Windows.Forms.ni.dll","cryptsp.dll","rsaenh.dll","wship6.dll","dnsapi.dll","lpk.dll","msvcrt.dll","vcruntime140.dll","mscorrc.dll","shlwapi.dll","api-ms-win-core-file-l2-1-0.dll","api-ms-win-crt-time-l1-1-0.dll","ole32.dll","diasymreader.dll","RpcRtRemote.dll","mscoree.dll","ucrtbase.dll","api-ms-win-crt-locale-l1-1-0.dll","api-ms-win-crt-environment-l1-1-0.dll","winnsi.dll","msvcr80.dll","shell32.dll","apphelp.dll","psapi.dll","IPHLPAPI.DLL","taskschd.dll","gdi32.dll","api-ms-win-core-timezone-l1-1-0.dll","api-ms-win-crt-filesystem-l1-1-0.dll","oleaut32.dll","uxtheme.dll","System.ni.dll","dwmapi.dll","mscoreei.dll","mscorwks.dll","System.Windows.Forms.dll","Culture.dll","msvcp140.dll","api-ms-win-crt-string-l1-1-0.dll","rasadhlp.dll","kernel32.dll","fltLib.dll","api-ms-win-crt-heap-l1-1-0.dll","api-ms-win-crt-utility-l1-1-0.dll","clbcatq.dll","ntdll.dll","sechost.dll","api-ms-win-crt-math-l1-1-0.dll","mscorlib.ni.dll","sspicli.dll","ktmw32.dll","advapi32.dll","nsi.dll","rpcss.dll","mswsock.dll","System.Configuration.ni.dll","System.Xml.ni.dll","api-ms-win-core-synch-l1-2-0.dll","mscorjit.dll","Microsoft.VisualBasic.ni.dll","WSHTCPIP.DLL","rpcrt4.dll","cryptbase.dll","wow64.dll","msvcp_win.dll","cfgmgr32.dll","Microsoft.VisualBasic.dll","gdi32full.dll","SHCore.dll","ntmarta.dll","System.configuration.dll","edputil.dll","wow64win.dll","win32u.dll","bcryptprimitives.dll","windows.storage.dll","combase.dll","FWPUCLNT.DLL","wow64cpu.dll","kernel.appcore.dll","powrprof.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"pcimon.exe","sha256":"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"name":"DISMHOST.EXE.6AA909CD.bin","sha256":"ecb636b278261eade712e68ec7d805d20e802628248da872d3d0ada1432ffc11","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"name":"tmpF739.tmp","sha256":"30a72182b99b543c261f7503a9e3ae865e442b812ae440fa17dab71cadb464db","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"name":"tmpF99B.tmp","sha256":"4cd2cf740a16c11cd524cc743caeaf03beca08d37322e82be5f69b23d682bada","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"name":"KB_-1820449351.dat","sha256":"67ef123e0ca425b7cf24eb11cd67272221c99800ee6af7ed8b7b21f9c51b40cb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"name":"run.dat","sha256":"da3879a31eb6ea16e60bb81fce9ec7b9d0ea323b7cde0ecc932c3c69cd167673","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"name":"task.dat","sha256":"4e3778723061d368ebc22641c2ff7d0d1afb6285f5669323cb5c5d7d834c7a40","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"name":"dism.log","sha256":"b65b32e739f887c18604dcdb2c1d7d4075a35e73e78f0ae2ee7ec500d83ee7ea","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"name":"tmp3FBA.tmp","sha256":"2a09a343518e0f28beab225b2ea2bd9f2f2505df136a6ec950ea7e5c298e4a7b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"}]},{"name":"tmp41DE.tmp","sha256":"c470f45efd2e7c4c5b88534a18965a78dce0f8e154d3e45a9d5569ad0e334bdb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"}]},{"name":"scsisvc.exe","sha256":"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"}]},{"name":"scsisvc.exe%3AZone.Identifier","sha256":"1409cc4125f7e08d09a731da789dc35c09afa8e716c00ad22d9f3f1b17a2cb33","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"}]},{"name":"tmpA5FB.tmp","sha256":"2a09a343518e0f28beab225b2ea2bd9f2f2505df136a6ec950ea7e5c298e4a7b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"name":"tmpA9C5.tmp","sha256":"4cd2cf740a16c11cd524cc743caeaf03beca08d37322e82be5f69b23d682bada","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"name":"tmp519.tmp","sha256":"4cd2cf740a16c11cd524cc743caeaf03beca08d37322e82be5f69b23d682bada","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"name":"pcimon.exe.bin","sha256":"f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"name":"KB_-253857693.dat","sha256":"05b2fd5fcfecf5f8e4ff92e8bb869686aef01cf19f3052e44f89ce0c382ae20e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"name":"KB_-1818770256.dat","sha256":"66123c40a7f01c5443003eb28b668d2f0a1c42664863de1d1ec9133e8fc6b654","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]}],"files_written":[{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"path":"%APPDATA%\\733C94C5-CEBB-4F98-A75F-22A797D1D50B\\run.dat","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"path":"%PROGRAMFILES%\\PCI Monitor\\pcimon.exe","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"path":"%TEMP%\\tmpF739.tmp","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"path":"%APPDATA%\\733C94C5-CEBB-4F98-A75F-22A797D1D50B\\task.dat","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"path":"%TEMP%\\tmpF99B.tmp","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"path":"%APPDATA%\\733C94C5-CEBB-4F98-A75F-22A797D1D50B\\Logs\\%OSUSER%\\KB_-1820449351.dat","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"path":"%APPDATA%\\A3D27CFA-1E7A-4FF8-8004-2BE13417B6B1\\run.dat","sources":[{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"}]},{"path":"%PROGRAMFILES%\\(x86)\\SCSI Service\\scsisvc.exe","sources":[{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"}]},{"path":"%PROGRAMFILES%\\(x86)\\SCSI Service\\scsisvc.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"}]},{"path":"%TEMP%\\tmp3FBA.tmp","sources":[{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"}]},{"path":"%APPDATA%\\A3D27CFA-1E7A-4FF8-8004-2BE13417B6B1\\task.dat","sources":[{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"}]},{"path":"%TEMP%\\tmp41DE.tmp","sources":[{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"}]},{"path":"%APPDATA%\\A3D27CFA-1E7A-4FF8-8004-2BE13417B6B1\\Logs\\%OSUSER%\\KB_907440918.dat","sources":[{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"}]},{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"path":"%TEMP%\\tmpA5FB.tmp","sources":[{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"path":"%TEMP%\\tmpA9C5.tmp","sources":[{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"path":"%APPDATA%\\733C94C5-CEBB-4F98-A75F-22A797D1D50B\\Logs\\%OSUSER%\\KB_-253857693.dat","sources":[{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\FUSION\\GACCHANGENOTIFICATION\\DEFAULT\\","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\{12fb6143-1465-418f-99d8-637795f79fcf}","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\.net clr networking","sources":[{"report_type":"sandbox","report_id":"6aa8d5652c6e3302e30c2862"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"name":"Local\\SM0:7388:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"}]},{"name":"Global\\.net clr networking","sources":[{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"},{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]},{"name":"SM0:7388:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"}]},{"name":"SM0:7388:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"65fa2919dd05a192d408bcd4"}]},{"name":"Global\\{12fb6143-1465-418f-99d8-637795f79fcf}","sources":[{"report_type":"sandbox","report_id":"65fa28e6e606a9260d024362"}]}]}},"report_ids":{"sandbox_job_ids":["65fa2919dd05a192d408bcd4","65fa28e6e606a9260d024362","6aa8d5652c6e3302e30c2862"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.NanoCore Sample f2b8ab95d31e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample f2b8ab95d31e…. Malware family: Trojan.NanoCore. Threat score 100/100. 23/25 AV engines flagged this file. 15 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.NanoCore Sample f2b8ab95d31e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample f2b8ab95d31e…. Malware family: Trojan.NanoCore. Threat score 100/100. 23/25 AV engines flagged this file. 15 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/f2b8ab95d31e2e8381965f6ca4f2f1cf6226e11604375733bed3bc59334dfac0"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.NanoCore Sample f2b8ab95d31e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample f2b8ab95d31e…. Malware family: Trojan.NanoCore. Threat score 100/100. 23/25 AV engines flagged this file. 15 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L54","11",{}]]