24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 3f:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4a7,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious XLM.Formulas.Abracadabra.8 Sample f47af17b82cd… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample f47af17b82cd…. Malware family: XLM.Formulas.Abracadabra.8. Threat score 100/100. 13/25 AV engines flagged this file. 3 malicious and 4 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/f47af17b82cdd753cbba4f75be9e372ac7dca17452572c57df64f5bfea74abe9","keywords":["Malicious","XLM.Formulas.Abracadabra.8","malware analysis","sandbox report","threat intelligence","f47af17b82cdd753cbba4f75be9e372ac7dca17452572c57df64f5bfea74abe9"],"about":{"@type":"SoftwareApplication","name":"file","applicationCategory":["xls","office"],"identifier":"f47af17b82cdd753cbba4f75be9e372ac7dca17452572c57df64f5bfea74abe9","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"XLM.Formulas.Abracadabra.8","antivirusDetections":{"malicious":13,"total":25},"behavioralIndicators":{"malicious":3,"suspicious":4},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T677,"regsvr32.exe" called "LoadResource with parameter {'hModule': '1954480128', 'hResInfo': '1955855520'}" (UID: 00000000-00005940) "regsvr32.exe" called "LoadResource with parameter {'hModule': '1947664384', 'hResInfo': '1947828568'}" (UID: 00000000-00005940) "regsvr32.exe" called "LoadResource with parameter {'hModule': '1947664384', 'hResInfo': '1901384'}" (UID: 00000000-00005940) "regsvr32.exe" called "LoadResource with parameter {'hModule': '29294593', 'hResInfo': '29421344'}" (UID: 00000000-00005940) "regsvr32.exe" called "LoadResource with parameter {'hModule': '29294593', 'hResInfo': '29396496'}" (UID: 00000000-00005940) "regsvr32.exe" called "LoadResource with parameter {'hModule': '29294593', 'hResInfo': '29396528'}" (UID: 00000000-00005940) "regsvr32.exe" called "LoadResource with parameter {'hModule': '1954480128', 'hResInfo': '2951000'}" (UID: 00000000-00005940) "regsvr32.exe" called "LoadResource with parameter {'hModule': '1954480128', 'hResInfo': '1955855520'}" (UID: 00000000-00004540) "regsvr32.exe" called "LoadResource with parameter {'hModule': '1947664384', 'hResInfo': '1947828568'}" (UID: 00000000-00004540) "regsvr32.exe" called "LoadResource with parameter {'hModule': '1947664384', 'hResInfo': '5636936'}" (UID: 00000000-00004540) "regsvr32.exe" called "LoadResource with parameter {'hModule': '28835841', 'hResInfo': '28962592'}" (UID: 00000000-00004540) "regsvr32.exe" called "LoadResource with parameter {'hModule': '28835841', 'hResInfo': '28937744'}" (UID: 00000000-00004540) "regsvr32.exe" called "LoadResource with parameter {'hModule': '28835841', 'hResInfo': '28937776'}" (UID: 00000000-00004540)26:T13be,"regsvr32.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff2ba7778b7ba877ff2ba777837ba877e0551974ac012e0000002e000500e300bd0500000200f200bd05000000000000000000000600de00bd0500000300ed00bd050000b0702e0000000000b0702e000000000020000000804c300000000000804c3000a06d2e00c06e2e00587f330068722e0000000b00a4ce210095e1a37798d0210095e1a37700000000eccf2100a06a0b007ccf2100 (UID: 00000000-00005940) "regsvr32.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff2ba777ff7aa877e47d3200ac012e0000002e0000000000000000000100f700c3050000000000000000000000000000000000000200f200c30500000000000000000000b0702e00ff2ba777377aa8772c751974ac012e0000002e00a06d2e00c06e2e000000ffffc30500001a002b01d0cd21000000000098d021000100f700c305000098d0210095e1a377b0702e00feffffff20000000dd59a87700000000804c3000a06d2e00c06e2e00a87f330068722e00 (UID: 00000000-00005940) "regsvr32.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004540) "regsvr32.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff2ba7778f729277ff2ba77777729277e0551974ac013400000034000500e300740400000200f2007404000000000000000000000600de00740400000300ed0074040000b070340000000000b07034000000000020000000804c360000000000804c3600a06d3400c06e3400088939006872340000003100fccd1b0095e1a377f0cf1b0095e1a3770000000044cf1b00a06a3100d4ce1b00 (UID: 00000000-00004540) "regsvr32.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff2ba7775b719277e47d3800ac0134000000340000000000000000000100f7007a040000000000000000000000000000000000000200f2007a0400000000000000000000b0703400ff2ba777037192772c751974ac01340000003400a06d3400c06e34000000ffff7a0400001a002b0128cd1b0000000000f0cf1b000100f7007a040000f0cf1b0095e1a377b0703400feffffff20000000dd59a87700000000804c3600a06d3400c06e34005889390068723400 (UID: 00000000-00004540) "regsvr32.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004484) "regsvr32.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff2ba7772810ab77ff2ba7773010ab77e0551974ac010f0000000f000500e3002e0500000200f2002e05000000000000000000000600de002e0500000300ed002e050000b0700f0000000000b0700f000000000020000000804c110000000000804c1100a06d0f00c06e0f000049140068720f00000026004cd2220095e1a37740d4220095e1a3770000000094d32200a06a260024d32200 (UID: 00000000-00004484) "regsvr32.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff2ba7771c13ab77e47d1300ac010f0000000f0000000000000000000100f70034050000000000000000000000000000000000000200f200340500000000000000000000b0700f00ff2ba777a410ab772c751974ac010f0000000f00a06d0f00c06e0f000000ffff340500001a002b0178d122000000000040d422000100f7003405000040d4220095e1a377b0700f00feffffff20000000dd59a87700000000804c1100a06d0f00c06e0f005049140068720f00 (UID: 00000000-00004484)27:T8ce,"regsvr32.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000efef177499a935240200000044c7177400002200aeca1774d46a0b00a06a0b00d8cf21000000000098d0210044d6187465960350feffffffefef17746def1774aeca17742cd0210090e81774aeca177467c11d762875197448d02100c2c61774287519740000000078d1210000000000 (UID: 00000000-00005940) "regsvr32.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005940) "regsvr32.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000efef17749a06e2cf0200000044c7177400001c00aeca1774d46a3100a06a310030cf1b0000000000f0cf1b0044d618740e26eebbfeffffffefef17746def1774aeca177484cf1b0090e81774aeca177467c11d7628751974a0cf1b00c2c617742875197400000000d0d01b0000000000 (UID: 00000000-00004540) "regsvr32.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004540) "regsvr32.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000efef17747d0632e30200000044c7177400002300aeca1774d46a2600a06a260080d322000000000040d4220044d61874393a0797feffffffefef17746def1774aeca1774d4d3220090e81774aeca177467c11d7628751974f0d32200c2c61774287519740000000020d5220000000000 (UID: 00000000-00004484) "regsvr32.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004484)28:T1671,"regsvr32.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00005940) "regsvr32.exe" called "LoadLibrary" with a parameter C:\Datop\test.test (UID: 00000000-00005940) "regsvr32.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00005940) "regsvr32.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005940) "regsvr32.exe" called "LoadLibrary" with a parameter DUser.dll (UID: 00000000-00005940) "regsvr32.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\DUser.dll (UID: 00000000-00005940) "regsvr32.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00005940) "regsvr32.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00005940) "regsvr32.exe" called "LoadLibrary" with a parameter UxTheme.dll (UID: 00000000-00005940) "regsvr32.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005940) "regsvr32.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\xmllite.dll (UID: 00000000-00005940) "regsvr32.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00005940) "regsvr32.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005940) "regsvr32.exe" called "LoadLibrary" with a parameter imageres.dll (UID: 00000000-00005940) "regsvr32.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005940) "regsvr32.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ole32.dll (UID: 00000000-00005940) "regsvr32.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\MSCTF.dll (UID: 00000000-00005940) "regsvr32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004540) "regsvr32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004540) "regsvr32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004540) "regsvr32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004540) "regsvr32.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00004540) "regsvr32.exe" called "LoadLibrary" with a parameter C:\Datop\test1.test (UID: 00000000-00004540) "regsvr32.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00004540) "regsvr32.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004540) "regsvr32.exe" called "LoadLibrary" with a parameter DUser.dll (UID: 00000000-00004540) "regsvr32.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\DUser.dll (UID: 00000000-00004540) "regsvr32.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00004540) "regsvr32.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00004540) "regsvr32.exe" called "LoadLibrary" with a parameter UxTheme.dll (UID: 00000000-00004540) "regsvr32.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004540) "regsvr32.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\xmllite.dll (UID: 00000000-00004540) "regsvr32.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00004540) "regsvr32.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004540) "regsvr32.exe" called "LoadLibrary" with a parameter imageres.dll (UID: 00000000-00004540) "regsvr32.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004540) "regsvr32.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ole32.dll (UID: 00000000-00004540) "regsvr32.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\MSCTF.dll (UID: 00000000-00004540) "regsvr32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004484) "regsvr32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004484) "regsvr32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004484) "regsvr32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004484) "regsvr32.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00004484) "regsvr32.exe" called "LoadLibrary" with a parameter C:\Datop\test2.test (UID: 00000000-00004484) "regsvr32.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00004484) "regsvr32.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004484) "regsvr32.exe" called "LoadLibrary" with a parameter DUser.dll (UID: 00000000-00004484) "regsvr32.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\DUser.dll (UID: 00000000-00004484) "regsvr32.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00004484) "regsvr32.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00004484) "regsvr32.exe" called "LoadLibrary" with a parameter UxTheme.dll (UID: 00000000-00004484) "regsvr32.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004484) "regsvr32.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\xmllite.dll (UID: 00000000-00004484) "regsvr32.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00004484) "regsvr32.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004484) "regsvr32.exe" called "LoadLibrary" with a parameter imageres.dll (UID: 00000000-00004484) "regsvr32.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004484) "regsvr32.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ole32.dll (UID: 00000000-00004484) "regsvr32.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\MSCTF.dll (UID: 00000000-00004484)29:T969d,"regsvr32.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter SetProcessDPIAware (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter LoadIconWithScaleDown (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter RtlRunEncodeUnicodeString (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter RtlInitUnicodeString (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter RtlRunDecodeUnicodeString (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter RtlUnhandledExceptionFilter (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter RtlIsThreadWithinLoaderCallout (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter InitGadgets (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter RegisterMessagePumpHook (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter IsThemeActive (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter CreateGadget (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter SetGadgetMessageFilter (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter SetGadgetStyle (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter SetGadgetRootInfo (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter GetThemeAppProperties (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter CreateStreamOnHGlobal (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter CreateXmlReader (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter CreateXmlReaderInputWithEncodingName (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter GetThemeMargins (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter GetThemeFont (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter GetThemeColor (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter GetThemeMetric (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter SetGadgetParent (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter GetDUserModule (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter FindStdColor (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter AttachWndProcW (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter IsProcessorFeaturePresent (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter InterlockedPopEntrySList (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter InterlockedPushEntrySList (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter InterlockedCompareExchange (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter RegisterClassNameW (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter GetGadgetRect (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter GetGadgetRgn (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter GetGadgetTicket (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter GetLayout (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter GdiRealizationInfo (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter FontIsLinked (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter GetTextFaceAliasW (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter GetFontAssocStatus (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter GdiIsMetaPrintDC (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter EnableThemeDialogTexture (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter GetThemeBool (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter InvalidateGadget (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter GetGadgetFocus (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter GetThemeBackgroundContentRect (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter GetThemeTextExtent (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter GetThemeBackgroundExtent (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter CloseThemeData (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter CoRegisterInitializeSpy (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter CoRevokeInitializeSpy (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter CLSIDFromOle1Class (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter GetCatalogObject (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter GetCatalogObject2 (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter SetGadgetFocus (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter DUserSendEvent (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter SetGadgetRect (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter BufferedPaintInit (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter BeginBufferedPaint (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter BufferedPaintRenderAnimation (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter GetThemeTransitionDuration (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter BeginBufferedAnimation (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter IsThemeBackgroundPartiallyTransparent (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter DrawThemeParentBackground (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter DrawThemeBackground (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter DrawThemeText (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter EndBufferedAnimation (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter GetBufferedPaintDC (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter GetBufferedPaintTargetDC (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter EndBufferedPaint (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter ForwardGadgetMessage (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter FindGadgetFromPoint (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter BufferedPaintStopAllAnimations (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter BufferedPaintUnInit (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter DisableContainerHwnd (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter DUserFlushMessages (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter DUserFlushDeferredMessages (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter DeleteHandle (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter UnregisterMessagePumpHook (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter DetachWndProc (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00005940) "regsvr32.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter SetProcessDPIAware (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter LoadIconWithScaleDown (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter RtlRunEncodeUnicodeString (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter RtlInitUnicodeString (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter RtlRunDecodeUnicodeString (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter RtlUnhandledExceptionFilter (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter RtlIsThreadWithinLoaderCallout (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter InitGadgets (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter RegisterMessagePumpHook (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter IsThemeActive (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter CreateGadget (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter SetGadgetMessageFilter (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter SetGadgetStyle (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter SetGadgetRootInfo (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter GetThemeAppProperties (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter CreateStreamOnHGlobal (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter CreateXmlReader (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter CreateXmlReaderInputWithEncodingName (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter GetThemeMargins (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter GetThemeFont (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter GetThemeColor (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter GetThemeMetric (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter SetGadgetParent (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter GetDUserModule (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter FindStdColor (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter AttachWndProcW (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter IsProcessorFeaturePresent (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter InterlockedPopEntrySList (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter InterlockedPushEntrySList (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter InterlockedCompareExchange (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter RegisterClassNameW (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter GetGadgetRect (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter GetGadgetRgn (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter GetGadgetTicket (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter GetLayout (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter GdiRealizationInfo (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter FontIsLinked (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter GetTextFaceAliasW (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter GetFontAssocStatus (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter GdiIsMetaPrintDC (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter EnableThemeDialogTexture (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter GetThemeBool (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter InvalidateGadget (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter GetGadgetFocus (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter GetThemeBackgroundContentRect (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter GetThemeTextExtent (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter GetThemeBackgroundExtent (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter CloseThemeData (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter CoRegisterInitializeSpy (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter CoRevokeInitializeSpy (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter CLSIDFromOle1Class (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter GetCatalogObject (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter GetCatalogObject2 (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter SetGadgetFocus (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter DUserSendEvent (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter SetGadgetRect (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter BufferedPaintInit (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter BeginBufferedPaint (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter BufferedPaintRenderAnimation (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter GetThemeTransitionDuration (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter BeginBufferedAnimation (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter IsThemeBackgroundPartiallyTransparent (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter DrawThemeParentBackground (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter DrawThemeBackground (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter DrawThemeText (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter EndBufferedAnimation (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter GetBufferedPaintDC (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter GetBufferedPaintTargetDC (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter EndBufferedPaint (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter ForwardGadgetMessage (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter BufferedPaintStopAllAnimations (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter BufferedPaintUnInit (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter DisableContainerHwnd (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter DUserFlushMessages (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter DUserFlushDeferredMessages (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter DeleteHandle (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter UnregisterMessagePumpHook (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter DetachWndProc (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00004540) "regsvr32.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter SetProcessDPIAware (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter LoadIconWithScaleDown (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter RtlRunEncodeUnicodeString (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter RtlInitUnicodeString (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter RtlRunDecodeUnicodeString (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter RtlUnhandledExceptionFilter (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter RtlIsThreadWithinLoaderCallout (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter InitGadgets (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter RegisterMessagePumpHook (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter IsThemeActive (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter CreateGadget (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter SetGadgetMessageFilter (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter SetGadgetStyle (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter SetGadgetRootInfo (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter GetThemeAppProperties (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter CreateStreamOnHGlobal (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter CreateXmlReader (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter CreateXmlReaderInputWithEncodingName (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter GetThemeMargins (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter GetThemeFont (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter GetThemeColor (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter GetThemeMetric (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter SetGadgetParent (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter GetDUserModule (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter FindStdColor (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter AttachWndProcW (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter IsProcessorFeaturePresent (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter InterlockedPopEntrySList (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter InterlockedPushEntrySList (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter InterlockedCompareExchange (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter RegisterClassNameW (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter GetGadgetRect (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter GetGadgetRgn (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter GetGadgetTicket (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter GetLayout (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter GdiRealizationInfo (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter FontIsLinked (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter GetTextFaceAliasW (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter GetFontAssocStatus (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter GdiIsMetaPrintDC (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter EnableThemeDialogTexture (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter GetThemeBool (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter InvalidateGadget (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter GetGadgetFocus (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter GetThemeBackgroundContentRect (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter GetThemeTextExtent (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter GetThemeBackgroundExtent (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter CloseThemeData (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter CoRegisterInitializeSpy (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter CoRevokeInitializeSpy (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter CLSIDFromOle1Class (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter GetCatalogObject (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter GetCatalogObject2 (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter SetGadgetFocus (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter DUserSendEvent (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter SetGadgetRect (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter BufferedPaintInit (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter BeginBufferedPaint (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter BufferedPaintRenderAnimation (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter GetThemeTransitionDuration (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter BeginBufferedAnimation (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter IsThemeBackgroundPartiallyTransparent (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter DrawThemeParentBackground (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter DrawThemeBackground (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter DrawThemeText (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter EndBufferedAnimation (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter GetBufferedPaintDC (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter GetBufferedPaintTargetDC (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter EndBufferedPaint (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter FindGadgetFromPoint (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter ForwardGadgetMessage (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter SetGadgetFocusEx (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter BufferedPaintStopAllAnimations (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter BufferedPaintUnInit (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter DisableContainerHwnd (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter DUserFlushMessages (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter DUserFlushDeferredMessages (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter DeleteHandle (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter UnregisterMessagePumpHook (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter DetachWndProc (UID: 00000000-00004484) "regsvr32.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00004484)2a:T5e0,"\Sessions\1\BaseNamedObjects\Global\552FFA80-3393-423d-8671-7BA046BB5906" "Global\552FFA80-3393-423d-8671-7BA046BB5906" "Global\MsoSqmMutex_S-1-5-21-2092356043-4041700817-663127204-1001" "Local\10MU_ACB10_S-1-5-5-0-91674" "Local\10MU_ACBPIDS_S-1-5-5-0-91674" "Local\ZonesCacheCounterMutex" "Global\MTX_MSO_AdHoc1_S-1-5-21-2092356043-4041700817-663127204-1001" "Global\MTX_MSO_Formal1_S-1-5-21-2092356043-4041700817-663127204-1001" "Global\MsoShellExtRegAccess_S-1-5-21-2092356043-4041700817-663127204-1001" "RasPbFile" "KYTransactionServer.MutexObject.vCvx55b" "Local\ZonesLockedCacheCounterMutex" "KYIMEShareCachedData.MutexObject.vCvx55b" "\Sessions\1\BaseNamedObjects\Local\10MU_ACBPIDS_S-1-5-5-0-91674" "\Sessions\1\BaseNamedObjects\Local\10MU_ACB10_S-1-5-5-0-91674" "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Global\MTX_MSO_Formal1_S-1-5-21-2092356043-4041700817-663127204-1001" "\Sessions\1\BaseNamedObjects\Global\MTX_MSO_AdHoc1_S-1-5-21-2092356043-4041700817-663127204-1001" "\Sessions\1\BaseNamedObjects\KYIMEShareCachedData.MutexObject.vCvx55b" "\Sessions\1\BaseNamedObjects\KYTransactionServer.MutexObject.vCvx55b" "\Sessions\1\BaseNamedObjects\RasPbFile" "\Sessions\1\BaseNamedObjects\Global\MsoSqmMutex_S-1-5-21-2092356043-4041700817-663127204-1001" "\Sessions\1\BaseNamedObjects\Global\MsoShellExtRegAccess_S-1-5-21-2092356043-4041700817-663127204-1001"2b:T252e,"EXCEL.EXE" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70fa0000 "EXCEL.EXE" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "EXCEL.EXE" loaded module "KERNEL32" at base 76650000 "EXCEL.EXE" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "EXCEL.EXE" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6c8b0000 "EXCEL.EXE" loaded module "COMCTL32.DLL" at base 747f0000 "EXCEL.EXE" loaded module "MSO.DLL" at base 63560000 "EXCEL.EXE" loaded module "KERNEL32.DLL" at base 76650000 "EXCEL.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\CULTURES\OFFICE.ODF" at base 6f6f0000 "EXCEL.EXE" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74400000 "EXCEL.EXE" loaded module "DWMAPI.DLL" at base 747b0000 "EXCEL.EXE" loaded module "ADVAPI32.DLL" at base 77bc0000 "EXCEL.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\1033\MSOINTL.DLL" at base 6a010000 "EXCEL.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\MSORES.DLL" at base 5f030000 "EXCEL.EXE" loaded module "CRYPTBASE.DLL" at base 75820000 "EXCEL.EXE" loaded module "IMM32.DLL" at base 77b80000 "EXCEL.EXE" loaded module "CLBCATQ.DLL" at base 75fd0000 "EXCEL.EXE" loaded module "%WINDIR%\SYSTEM32\MSIMTF.DLL" at base 6e8b0000 "EXCEL.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\RICHED20.DLL" at base 6a450000 "EXCEL.EXE" loaded module "GDIPLUS.DLL" at base 74260000 "EXCEL.EXE" loaded module "%WINDIR%\WINSXS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.7601.23894_NONE_5C0BE957A009922E\GDIPLUS.DLL" at base 74260000 "EXCEL.EXE" loaded module "%WINDIR%\SYSTEM32\MSCOREE.DLL" at base 6bbc0000 "EXCEL.EXE" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 6a3c0000 "EXCEL.EXE" loaded module "UXTHEME.DLL" at base 74400000 "EXCEL.EXE" loaded module "SHLWAPI.DLL" at base 773a0000 "EXCEL.EXE" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 0 "EXCEL.EXE" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 0 "EXCEL.EXE" loaded module "VERSION.DLL" at base 74dc0000 "EXCEL.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICESOFTWAREPROTECTIONPLATFORM\OSPPC.DLL" at base 6da60000 "EXCEL.EXE" loaded module "RPCRT4.DLL" at base 76420000 "EXCEL.EXE" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 76650000 "EXCEL.EXE" loaded module "POWRPROF.DLL" at base 744a0000 "EXCEL.EXE" loaded module "USER32.DLL" at base 76060000 "EXCEL.EXE" loaded module "COMCTL32" at base 747f0000 "EXCEL.EXE" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 77400000 "EXCEL.EXE" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 77380000 "EXCEL.EXE" loaded module "CRYPTSP.DLL" at base 75330000 "EXCEL.EXE" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 750c0000 "EXCEL.EXE" loaded module "RPCRTREMOTE.DLL" at base 758c0000 "EXCEL.EXE" loaded module "WTSAPI32.DLL" at base 73cd0000 "EXCEL.EXE" loaded module "WINSTA.DLL" at base 75890000 "EXCEL.EXE" loaded module "SHELL32.DLL" at base 76730000 "EXCEL.EXE" loaded module "OLE32.DLL" at base 77400000 "EXCEL.EXE" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 77560000 "EXCEL.EXE" loaded module "GDI32.DLL" at base 76550000 "EXCEL.EXE" loaded module "OLEAUT32.DLL" at base 765a0000 "EXCEL.EXE" loaded module "SETUPAPI.DLL" at base 76280000 "EXCEL.EXE" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 744d0000 "EXCEL.EXE" loaded module "NTMARTA.DLL" at base 74d90000 "EXCEL.EXE" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 77380000 "EXCEL.EXE" loaded module "PROFAPI.DLL" at base 75930000 "EXCEL.EXE" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base 75b70000 "EXCEL.EXE" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 77690000 "EXCEL.EXE" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 75bd0000 "EXCEL.EXE" loaded module "SECUR32.DLL" at base 75650000 "EXCEL.EXE" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L2-1-0.DLL" at base 71b70000 "EXCEL.EXE" loaded module "MPR.DLL" at base 71fd0000 "EXCEL.EXE" loaded module "%WINDIR%\SYSTEM32\MSXML6.DLL" at base 713a0000 "EXCEL.EXE" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 77bc0000 "EXCEL.EXE" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 76650000 "EXCEL.EXE" loaded module "WINDOWSCODECS.DLL" at base 73d50000 "EXCEL.EXE" loaded module "WINMM.DLL" at base 6ed40000 "EXCEL.EXE" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 76730000 "EXCEL.EXE" loaded module "APPHELP.DLL" at base 757d0000 "EXCEL.EXE" loaded module "%WINDIR%\SYSTEM32\IEFRAME.DLL" at base 6aab0000 "EXCEL.EXE" loaded module "LINKINFO.DLL" at base 6e940000 "EXCEL.EXE" loaded module "NTSHRUI.DLL" at base 72780000 "EXCEL.EXE" loaded module "SRVCLI.DLL" at base 75520000 "EXCEL.EXE" loaded module "CSCAPI.DLL" at base 70b40000 "EXCEL.EXE" loaded module "SLC.DLL" at base 73ce0000 "EXCEL.EXE" loaded module "%PROGRAMFILES%\MICROSOFT OFFICE\OFFICE14\MSOSTYLE.DLL" at base 6db40000 "EXCEL.EXE" loaded module "SSPICLI.DLL" at base 757b0000 "EXCEL.EXE" loaded module "URLMON.DLL" at base 77690000 "EXCEL.EXE" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL" at base 72f30000 "EXCEL.EXE" loaded module "API-MS-WIN-DOWNLEVEL-OLE32-L1-1-0.DLL" at base 75be0000 "EXCEL.EXE" loaded module "WS2_32.DLL" at base 75c90000 "EXCEL.EXE" loaded module "WINHTTP.DLL" at base 71550000 "EXCEL.EXE" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 752f0000 "EXCEL.EXE" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 752e0000 "EXCEL.EXE" loaded module "IPHLPAPI.DLL" at base 73c80000 "EXCEL.EXE" loaded module "CRYPT32.DLL" at base 75a40000 "EXCEL.EXE" loaded module "USERENV.DLL" at base 75950000 "EXCEL.EXE" loaded module "DNSAPI.DLL" at base 751b0000 "EXCEL.EXE" loaded module "%WINDIR%\SYSTEM32\NETPROFM.DLL" at base 6d720000 "EXCEL.EXE" loaded module "DHCPCSVC6.DLL" at base 73b90000 "EXCEL.EXE" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 74e50000 "EXCEL.EXE" loaded module "RASADHLP.DLL" at base 71fc0000 "EXCEL.EXE" loaded module "DHCPCSVC.DLL" at base 73b10000 "EXCEL.EXE" loaded module "%WINDIR%\SYSTEM32\NPMPROXY.DLL" at base 6d230000 "EXCEL.EXE" loaded module "%WINDIR%\SYSTEM32\OLEAUT32.DLL" at base 765a0000 "EXCEL.EXE" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 73bf0000 "EXCEL.EXE" loaded module "%WINDIR%\SYSTEM32\WININET.DLL" at base 75d20000 "EXCEL.EXE" loaded module "%WINDIR%\SYSTEM32\WS2_32" at base 75c90000 "EXCEL.EXE" loaded module "CREDSSP.DLL" at base 74ff0000 "EXCEL.EXE" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 75130000 "EXCEL.EXE" loaded module "NCRYPT.DLL" at base 75460000 "EXCEL.EXE" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 75000000 "EXCEL.EXE" loaded module "WINTRUST.DLL" at base 75bf0000 "EXCEL.EXE" loaded module "GPAPI.DLL" at base 74f00000 "EXCEL.EXE" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL" at base 77380000 "EXCEL.EXE" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL" at base 77380000 "EXCEL.EXE" loaded module "PROPSYS.DLL" at base 744d0000 "EXCEL.EXE" loaded module "SXS.DLL" at base 75830000 "EXCEL.EXE" loaded module "SENSAPI.DLL" at base 6d240000 "EXCEL.EXE" loaded module "RASAPI32.DLL" at base 6c2c0000 "EXCEL.EXE" loaded module "RTUTILS.DLL" at base 73730000 "EXCEL.EXE" loaded module "WININET.DLL" at base 75d20000 "EXCEL.EXE" loaded module "%WINDIR%\SYSTEM32\WINMM.DLL" at base 6ed40000 "EXCEL.EXE" loaded module "%PROGRAMFILES%\MICROSOFT OFFICE\OFFICE14\USP10.DLL" at base 0 "EXCEL.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\USP10.DLL" at base 69f70000 "EXCEL.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICESOFTWAREPROTECTIONPLATFORM\OSPPCEXT.DLL" at base 69cf0000 "EXCEL.EXE" loaded module "NETAPI32.DLL" at base 74760000 "regsvr32.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74400000 "regsvr32.exe" loaded module "C:\DATOP\TEST.TEST" at base 0 "regsvr32.exe" loaded module "COMCTL32.DLL" at base 747f0000 "regsvr32.exe" loaded module "NTDLL.DLL" at base 77a20000 "regsvr32.exe" loaded module "DUSER.DLL" at base 74170000 "regsvr32.exe" loaded module "%WINDIR%\SYSTEM32\DUSER.DLL" at base 74170000 "regsvr32.exe" loaded module "USER32.DLL" at base 76060000 "regsvr32.exe" loaded module "DWMAPI.DLL" at base 747b0000 "regsvr32.exe" loaded module "UXTHEME.DLL" at base 74400000 "regsvr32.exe" loaded module "OLE32.DLL" at base 77400000 "regsvr32.exe" loaded module "%WINDIR%\SYSTEM32\XMLLITE.DLL" at base 74780000 "regsvr32.exe" loaded module "OLEAUT32.DLL" at base 765a0000 "regsvr32.exe" loaded module "KERNEL32.DLL" at base 76650000 "regsvr32.exe" loaded module "ADVAPI32.DLL" at base 77bc0000 "regsvr32.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 77400000 "regsvr32.exe" loaded module "CLBCATQ.DLL" at base 75fd0000 "regsvr32.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 77560000 "regsvr32.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70fa0000 "regsvr32.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "regsvr32.exe" loaded module "KERNEL32" at base 76650000 "regsvr32.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "regsvr32.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6c8b0000 "regsvr32.exe" loaded module "C:\DATOP\TEST1.TEST" at base 0 "regsvr32.exe" loaded module "C:\DATOP\TEST2.TEST" at base 02c:T898,Observed system executable string:"C:\Windows\system32\apphelp.dll" [Source: 00004484.00001184.37518572.00050000.wprm] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00006020-00000C2B-3776] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00006020-00000C28-1491427660] Observed system executable string:"%WINDIR%\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\GdiPlus.dll" [Source: 00000000-00006020-00000C28-1492755906] Observed system executable string:"%WINDIR%\system32\mscoree.dll" [Source: 00000000-00006020-00000C28-1492839729] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll" [Source: 00000000-00006020-00000C28-1494443839] Observed system executable string:"%WINDIR%\system32\ole32.dll" [Source: 00000000-00006020-00000C28-1497118230] Observed system executable string:"%WINDIR%\system32\Msimtf.dll" [Source: 00000000-00006020-00000C60-1497202684] Observed system executable string:"%WINDIR%\system32\MSCTF.dll" [Source: 00000000-00006020-00000C28-1498659419] Observed system executable string:"%WINDIR%\System32\msxml6r.dll" [Source: 00000000-00006020-00000C28-1501769446] Observed system executable string:"%WINDIR%\system32\ADVAPI32.DLL" [Source: 00000000-00006020-00000C28-1502089561] Observed system executable string:"%WINDIR%\system32\KERNEL32.DLL" [Source: 00000000-00006020-00000C28-1502232975] Observed system executable string:"%WINDIR%\system32\bcryptprimitives.dll" [Source: 00000000-00006020-00000C28-1519808927] Observed system executable string:"%WINDIR%\system32\WINMM.dll" [Source: 00000000-00006020-00000C28-1571213189] Observed system executable string:"%WINDIR%\system32\msi.dll" [Source: 00000000-00006020-00000C60-1795642233] Observed system executable string:"%WINDIR%\system32\oleacc.dll" [Source: 00000000-00006020-00000C28-1795645059] Observed system executable string:"%WINDIR%\System32\DUser.dll" [Source: 00000000-00005940-00000C28-1524705580] Observed system executable string:"%WINDIR%\system32\xmllite.dll" [Source: 00000000-00005940-00000C28-1524845159]2d:T6ba,"EXCEL.EXE" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") "EXCEL.EXE" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CMF\CONFIG"; Key: ""; Value: "") "EXCEL.EXE" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\WINDOWS ERROR REPORTING\WMR"; Key: ""; Value: "") "EXCEL.EXE" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP"; Key: ""; Value: "") "EXCEL.EXE" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION"; Key: ""; Value: "") "EXCEL.EXE" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: ""; Value: "") "EXCEL.EXE" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: ""; Value: "") "EXCEL.EXE" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\PSCHED\PARAMETERS\WINSOCK"; Key: ""; Value: "") "EXCEL.EXE" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS"; Key: ""; Value: "") "EXCEL.EXE" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\PSCHED"; Key: ""; Value: "") "EXCEL.EXE" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: ""; Value: "") "EXCEL.EXE" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP"; Key: ""; Value: "") "EXCEL.EXE" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: ""; Value: "") "EXCEL.EXE" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS NT\DNSCLIENT"; Key: ""; Value: "")2e:T939,"EXCEL.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "EXCEL.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CMF\CONFIG"; Key: "SYSTEM"; Value: "") "EXCEL.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\WINDOWS ERROR REPORTING\WMR"; Key: "DISABLE"; Value: "") "EXCEL.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP"; Key: "SOURCEPATH"; Value: "") "EXCEL.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION"; Key: "DEVICEPATH"; Value: "") "EXCEL.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: "") "EXCEL.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "EXCEL.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\PSCHED\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "EXCEL.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\PSCHED"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "EXCEL.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "EXCEL.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "EXCEL.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") "EXCEL.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "") "EXCEL.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "USEDELAYEDACCEPTANCE"; Value: "") "EXCEL.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "HELPERDLLNAME"; Value: "") "EXCEL.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "EXCEL.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "")2f:T407,"EXCEL.EXE" trying to touch file "C:\Windows\AppPatch\sysmain.sdb" "EXCEL.EXE" trying to touch file "\FileSystem\Filters\FltMgrMsg" "EXCEL.EXE" trying to touch file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "EXCEL.EXE" trying to touch file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "EXCEL.EXE" trying to touch file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "EXCEL.EXE" trying to touch file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "EXCEL.EXE" trying to touch file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "EXCEL.EXE" trying to touch file "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE.config" "EXCEL.EXE" trying to touch file "\Device\MountPointManager" "EXCEL.EXE" trying to touch file "C:" "EXCEL.EXE" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Office\review.rcd" "EXCEL.EXE" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Office\adhoc.rcd" "EXCEL.EXE" trying to touch file "C:\Fil27.2.xls"30:T449,"regsvr32.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "1040255532" "cx": "36" "cy": "30"} "regsvr32.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "604048452" "cx": "36" "cy": "30"} "regsvr32.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "1040255532" "cx": "16" "cy": "16"} "regsvr32.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "604048452" "cx": "366" "cy": "30"} "regsvr32.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "1040255532" "cx": "350" "cy": "191"} "regsvr32.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "503385213" "cx": "68" "cy": "23"} "regsvr32.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "1040255532" "cx": "366" "cy": "30"} "regsvr32.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "604048452" "cx": "16" "cy": "16"} "regsvr32.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "503385213" "cx": "366" "cy": "30"} "regsvr32.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "604048452" "cx": "68" "cy": "23"}31:T7c0,"EXCEL.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: "") "EXCEL.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "EXCEL.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\PSCHED\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "EXCEL.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\PSCHED"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "EXCEL.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "EXCEL.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "EXCEL.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") "EXCEL.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "") "EXCEL.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "USEDELAYEDACCEPTANCE"; Value: "") "EXCEL.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "HELPERDLLNAME"; Value: "") "EXCEL.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "EXCEL.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "EXCEL.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "EXCEL.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "AUTODIALDLL"; Value: "")32:T83e,Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00005516.00000000.118272.026D0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00005516.00000000.118272.026D0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00005516.00000000.118272.026D0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00005516.00000000.118272.026D0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00007960.00000000.118267.02C70000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00007960.00000000.118267.02C70000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00007960.00000000.118267.02C70000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00007960.00000000.118267.02C70000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00008976.00000000.118277.03270000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00008976.00000000.118277.03270000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00008976.00000000.118277.03270000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00008976.00000000.118277.03270000.00000004.mdmp")33:T856,Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00005516.00000000.118272.026D0000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00005516.00000000.118272.026D0000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00005516.00000000.118272.026D0000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00005516.00000000.118272.026D0000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00007960.00000000.118267.02C70000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00007960.00000000.118267.02C70000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00007960.00000000.118267.02C70000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00007960.00000000.118267.02C70000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00008976.00000000.118277.03270000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00008976.00000000.118277.03270000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00008976.00000000.118277.03270000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00008976.00000000.118277.03270000.00000004.mdmp")34:T490,Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00005516.00000000.118272.026D0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00005516.00000000.118272.026D0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00007960.00000000.118267.02C70000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00007960.00000000.118267.02C70000.00000004.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00007960.00000000.118267.DFB44000.00000002.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00008976.00000000.118277.03270000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00008976.00000000.118277.03270000.00000004.mdmp")35:T1af6,Found reference to API (Indicator: "OleUninitialize"; Source: "00000000-00007960.00000000.118267.DFB44000.00000002.mdmp") Found reference to API (Indicator: "OleInitialize"; Source: "00000000-00007960.00000000.118267.DFB44000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00007960.00000000.118267.DFB44000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00007960.00000000.118267.DFB44000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00007960.00000000.118267.DFB44000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00007960.00000000.118267.DFB44000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00007960.00000000.118267.DFB44000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00007960.00000000.118267.DFB44000.00000002.mdmp") Found reference to API (Indicator: "CharNextW"; Source: "00000000-00007960.00000000.118267.DFB44000.00000002.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00007960.00000000.118267.DFB44000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00007960.00000000.118267.DFB44000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00007960.00000000.118267.DFB44000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00007960.00000000.118267.DFB44000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00007960.00000000.118267.DFB44000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00007960.00000000.118267.DFB44000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00007960.00000000.118267.DFB44000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00007960.00000000.118267.DFB44000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00007960.00000000.118267.DFB44000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00007960.00000000.118267.DFB44000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00007960.00000000.118267.DFB44000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00007960.00000000.118267.DFB44000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00007960.00000000.118267.DFB44000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00007960.00000000.118267.DFB44000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00007960.00000000.118267.DFB44000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00007960.00000000.118267.DFB44000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00007960.00000000.118267.DFB44000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00007960.00000000.118267.DFB44000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00007960.00000000.118267.DFB44000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00007960.00000000.118267.DFB44000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00007960.00000000.118267.DFB44000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00007960.00000000.118267.DFB44000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007960.00000000.118267.DFB44000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00007960.00000000.118267.DFB44000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00007960.00000000.118267.DFB44000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00007960.00000000.118267.DFB44000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00007960.00000000.118267.DFB44000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00007960.00000000.118267.DFB44000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00007960.00000000.118267.DFB44000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00007960.00000000.118267.DFB44000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00007960.00000000.118267.DFB44000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00007960.00000000.118267.DFB44000.00000002.mdmp") Found reference to API (Indicator: "lstrlenW"; Source: "00000000-00007960.00000000.118267.DFB44000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00007960.00000000.118267.DFB44000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpW"; Source: "00000000-00007960.00000000.118267.DFB44000.00000002.mdmp") Found reference to API (Indicator: "Wow64EnableWow64FsRedirection"; Source: "00000000-00007960.00000000.118267.DFB44000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process2"; Source: "00000000-00007960.00000000.118267.DFB44000.00000002.mdmp") Found reference to API (Indicator: "GetSystemWow64Directory2W"; Source: "00000000-00007960.00000000.118267.DFB44000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00007960.00000000.118267.DFB44000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00007960.00000000.118267.DFB44000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00007960.00000000.118267.DFB44000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00007960.00000000.118267.DFB44000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00007960.00000000.118267.DFB44000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00007960.00000000.118267.DFB44000.00000002.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00007960.00000000.118267.DFB44000.00000002.mdmp") Found reference to API (Indicator: "VirtualQuery"; Source: "00000000-00007960.00000000.118267.DFB44000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00007960.00000000.118267.DFB44000.00000002.mdmp")36:T7f6,Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00005516.00000000.118272.026D0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00005516.00000000.118272.026D0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00005516.00000000.118272.026D0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00005516.00000000.118272.026D0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00007960.00000000.118267.02C70000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00007960.00000000.118267.02C70000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00007960.00000000.118267.02C70000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00007960.00000000.118267.02C70000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00008976.00000000.118277.03270000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00008976.00000000.118277.03270000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00008976.00000000.118277.03270000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00008976.00000000.118277.03270000.00000004.mdmp")37:T4e4,"y\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00005516.00000000.118272.026D0000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00005516.00000000.118272.026D0000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00005516.00000000.118272.026D0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00005516.00000000.118272.026D0000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{FA445657-9" in Source: 00000000-00007960.00000000.118267.02C70000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{F" in Source: 00000000-00007960.00000000.118267.02C70000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{FA445657-9379-11D6-B41A-00065B83EE" in Source: 00000000-00007960.00000000.118267.02C70000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00007960.00000000.118267.02C70000.00000004.mdmp38:T3774,"GET /UGqWNCLT/hr.html HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: shalsa3d.comConnection: Keep-Alive" "HTTP/1.1 200 OKCache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0Content-Encoding: gzipContent-Type: text/html; charset=UTF-8Date: Fri, 08 Nov 2024 19:25:19 GMTExpires: Mon, 26 Jul 1997 05:00:00 GMTLast-Modified: Fri, 08 Nov 2024 19:25:19 GMTPragma: no-cacheServer: Parking/1.0Vary: Accept-EncodingX-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANnylWw2vLY4hUn9w06zQKbhKBfvjFUCsdFlb6TdQhxb9RXWXuI4t31c+o8fYOv/s8q1LGPga3DE1L/tHU4LENMCAwEAAQ==_pVh/Texr8xsy6+OKzluwJRk96C4l98NuI8QKlkC8wgVa/vN/zGE8dEFkyHE1MQ90zsbVwdJvmquLMrScxLHcSA==X-Cache-Miss-From: parking-5d9fc4dbcf-mn65bTransfer-Encoding: chunked" "1ee1��W�n�8��u1��e�9[�$i2Mst�s�EPe��DIYv��5��I�#)�H즳��g�ޞ|��)�U�^��t4l��P�vp�3��d6�:+�W7_�\��Ǔ��x��:��^�1�n��/��ɷ��'2��N�+�E_�Nڲ�g��Gx��i粭^ܻ<��:9*N��n�û�S��@��7��o/�Y^�y7�wO�X�w��n.��W�>��}��i/<=�^�v�n��?�I�g~y%��L'8|y��Qc!�6r9��CE#/e��Ļa+��S_f�~��<��!:O#.�(O[�m��HqB��%Eƅj�� !�Ѐ8fѤ)U3G��a��6<�I��>츍51!��VcEҪ1�J4�QD�TFw��k+f�� 4KS��_�1��4�-t&�爤D`��h �%.�"�JS�� Dd��@��1��ԋ�DTiZ�3A1ψ�7��0p�� y~`4�U��a��-5��E4�#�� $6�m��Z��<�B��i+�d+"ی��l��;��eX�_J5�`/��1�8fD��i��Xy��b5H��1��ٴ��R<�:��#G�{�u��8��{��^�"��<`�8�e��g(Ցc@��D��r�?��t�K%�Ո�8��)X��~i�:1�cnu�N"E�VA(�riL�i��S��y8�[c=��BQP��%I3�\Ѵnk�xҔ��<��0�Lq*��|��T��Z�� (�&��3�%�L�I�J� e,�>�jր�r-�e:��w|BD��&TRH�2>F�'�ͼ��\f8��`��s��y:6�J��"L:rL3��+�ľ/��Js*pY��d��ID�0n?A!Г��R��Q��Tm>�9e�!�c?lJ�d�%a�VQ��QJ��G�[�뺥��L�h2M�le�`��*��A�%5.�j��%��R�ǒh�m^y�q[;��fO��!��/�FS#��\�ب��jX��U�Z�*QS�}\��{��|�Ø�!IK?�Rh"Y��A��P׌�E+4�(��f�Y��J��d�*}ѱ��"GX<�r�]�*j��]�cF�}��UoQM�S��ҳ@bj��"��8&�=�M�D�X'7��֬[�v�3�+^Z�1Ơ�8��v��i��D��V�2Q�u��r�~q^�Ɋjv4�[m��ʠ��ã"�9;�}�ȗ2�hl]�mw��}�&�4e��3�P�ڨ�g*Ţ�0{R&�I�V��b�Qn�y�;&x3�z�Z+��W[�n�w[8M�+$��ϲKx�w��c;��<�%LX�P6�Z�AG�⇧��T�4��z��c»��MB}��[);n�k��+��N��Y��)�z��3�#B!+CO�+r�d��L�e�-�` �߿��7�f��-B�P�6B��U��Pl�~��;�*�Z�:�L�b��"*��g��/�P�3p�U.�VU��F�F�)��x�x�{LႣh�H]L��dvQ��5��k��&S&�bC��L2e�[p�k�<-�E?�s�R/g��;�Lޭ�/��H�j%vw6z�.u��,��r��u��݃�U�2��QO�x�EOՌ1�5��h�ϻ�~��io�2�/�'�<08��м�ͥ��Ym��0�FZ��s�P`7�LQY�A\~��8��j4�g�q^��X�A�h��1@�++y��NުsN&X��(<��eH� v:�q��B�]P��r�m�5?��M��6��VJ�c��7h�?sb��[UAgF�ji2��˪X�E�X�Xϳ�[�� =ǔ�#J��]�q�,3�"gC�#U)Sn��k\�[c�BW$��p��r��e)��zFܫd��B�h��h��&�O��]A7P*�{�Q��C��1=�7{ 1�9��'�Xh{.rν�:8��uZ[�6<�z@Bg`sy_��7�|�a�')��t��h2$f�!I��r��ă �tdfӣ��!c�h�o��O��T��7a�Na��g߉��@�m�R��ؗ��$��W=��E�j@��A��u5�^��#��&�AɸL��N��K��H ��>�N5�f��':B=�m�z��d&~) �nÿ��ZO5�3��*�&��/x]�8|a��6?�;ޕ7��o��zuU��f�F�_56h�z��Q�p�]ݴ.V�F�t��#j�GE��n�H��awvq��(�{��"%QY��)1�Ai0�~��؇�y��+uu��!9�^�}߇qι�u�"I�O��Doh�I|�6}=�8�#.�|�@��w&Yn�E�bes��"�m�c��(2��[F��5��z<�i�y �D﹯�� b'��#HA��+ML��<�O}�vD�.'w�;�)9��g��?��9�߂.�<�_�N��Z`�্?�>��w��=��k[3T }L�d��G?�<��>X��d~�� l�"��@�W4(�p'Gh��>od51h��k��+ܳt��5��<+@w}p�4��nh��l2�c��W�7��gg�?�F1��J�Iӑ�^��(�˷��K��@nq&ɼ��dZf��<��ĞC�|9��2$/H��ǿP|z�"��I��w%�>w�a�>wl(��6�?��Ɏ��#��d�Ak?G��/};8��,0�W��}=�d��/�4w|�N�г��#N�zyJ��^��4�ħ��V��&��}L]��Gf�Mj�Y��<�\�%.��;.��\��*�$��r��Q�p<#k��,yq\Ӌ`��5,'0px��y�w:ꎌ�x0�z�. _�jaߦB��i?��:Y��#�c�d ��q��u#�N(��3��H� 5^�RZ��a(��8�2>L"F��hH�#>H��IW��s�8h��pۅ�N��x��\�q��x��3�3<��%��2T>��4_��2�j�р.C��U��mm�0�i�_�-w��%^�&�cr]�YT٨P�8�Y�B)Zo��T�=�-��6?yi�R}#湕E�&��X}�� [��G�-V;��pT]ZAY(�¡^ZC0��p�8R��~i�9c�WPE�굔v��U)S T+7X��eAebJ��j�q�G���Nϖ%0h��d��f��VcDЙ6��̴�aض��S�'\�h_.w��Z�5��,2��d�A��j��X~;t�5��v1c�Y��i�(Iamh��W&�[ބ��ڰ�eex�9z-��M�hl�<�muam��j�^x�XҸ�^��'��#$j�W�~Yޖ+Ś#*��@j-Ak��4�'ꌔ�`��zo�ݶ7��3�8v]j�~Ѥ*��)8aw\�ޔ|�_��Hgc��n˞��u�y��W�AC��ې��w�?�,*EyB)�2�k��{TYn�9�D}�;�Uu�u��_Z4��8��o��D*"�eAp�C�t"��G&�6�V�;�z��t)-��!T�Ž>��+�Sb>n��s�^�`|]2:}��^�L�bo��wBeu��s�A��2�g�#��5��Hi"Q�<�?g<��CH`aȫC�(��A3�y#Y�ϑt��rp�j�yawu=�d��GGF��@Ձ�XLN�C�M�)Ր�cvA�� G;�HSh��14��T�7��Vړ$�II�Oe��Ϲ|+'�0�n�XC�bg��@��o�2w��b��7Z��\��ʞ^O��FQjӓ��#��Iߙ�ܩ�+�c�íW�o��X_/ͼV��VI��弪��H@$�&Q.�r��ƪ��ƀ}ZTA��̝7_�:;-$O��8ld��o*��r�/mI�\�r�;}��M�F�Wu�J��A�s��Q�Gΰ�v�8Q*Fz��v��oF�ﰨ�+8��x��5p�$Z�P��l�S�Ͻ��FzN�LuY�l�w|O�k��z��<=��P�Ā �]s�&ͦ�^�g��e`��j��)Y�i&h�!5��e��9��D��ɋ��];�NyyJ*��X��`��@��:��L�N��zo�1�_T�5�//�U��R��/�`{qy�#�yRq��Ge��6G��/�p��q�*۞�!_�y�'lNEl��u��Ȼ+<��s\=�A&�!��/O2$2�kB�Kf�]:��'x�wB�W��a~��ݕO7�5N�<1K"x��PҨ��i�wg&Q��i�;s�"W��z>�{&/��"`��-P�c[9H�HQ��O��-l�"�^�;��J��DKbiX��c?b�#��X��-�8p�悸v�B��g�as�AZ��Gs� �Q��|?��9՗�pag�b��s/H�!\v��s��;@x�87?��$��7��m��m��G��o7��s�/��S�6��>=��rާ�OI�x�$�אW�$?��]>#��ko�6�8� X��mV�"1�-@�lNl0�@��D�b��,U��ww�H�a'��/��w<��Z2��f��mj��X��98<�O�{��/��{�f�_�F'�KӻD�U8��חe~��,��o36�!OO6�q|��t�Ǘ�<�-�}��C|t��埳�5��牮#^ٴ�>ؼ��N/Y��CL0#r��G7��Gß~>>��it4�A��iUv� P-��h��h��~��)�L5�I�m<��.Y�$lV��$|N��G��{�<2�[��{�|4Ŀ�?Q�1��yo��n��w��-�t"��etM��;/�K/��P�ktqe.b�|d��B-��&��1-vV��ˢ�/��y��WI2<��M��<��!0A��dI��Kyu�H��}"��cu�tu�,K�wCƌcp��ֶ�.��{�H��k�+��-��(�Jr��eN#u��\��q� 7֔��0�Ji�`�g�m+��0��_��l��~��"��:eF��0Z伿ڮI8}�D�(�+��Ux\��i,#X�z�Y<-��0��P�@��7,��㣸�b%ڳ��Y�7^��T2��&��#��S�$>�}.��pJ�A�h<�1��F��i�JhӰ瀱Ám�6�)d0�H@�P�Ro�1ʹ�W�r9V-�R|E?EQ�.�|��ߖ��?��@9��O�zN�џӋq��k��]�Yn�Z��i��[��.��4�XPX+��Wu��i�ʑtO�O��]qr䔍��D.��S}c��^�(9��Bʟ�Z��6aѠ��~�.<-4��*k2�.QF�=,��`2�%�1\YR��+�S@�-�>y�A_��D��Y��id�H�Y�Ŕ�6�@��NH��O6�t3��$$�F�N��̓�tHT[7�i& E�S��ﻇ�8(�TU!��;��>�N�D��㻀��e{��ݺ�t��L-�)5��M�c��/`l詥�N��~��.��*�c ��5Ki䂇+�RVA��W��1j^��M�1�H�@�d�z��?[�^P�>��ypX*CHkq��^^�*��I�P{�Q)�%�R�q��X�U��-G�(�J}�Bc�@e��ʣ��ɏf�x�e`bvl�O��|�]��Vi�-��T��M��u��J@�$�,@�P,kDea}%yʓ�"�QΟ�|#��([��h:��`!�z�Ԣ9�8��p�t"|��%6V�l�O��@/�IÀ�x|~��?֑t�\��]�W��.�;4Y�c�T�!�*.�ra��8r�Z��CB��B�C�E-8gvf�b��PT��0Ť�O�I0�P݋u�1.)��K��eZ6`6��Ҕ�ʗ�4��OS�4/4Ż�ȕF��Zat�2?[])��N��-O�=]}!.��LyRʄL�ulkp��6��XVZ��6n��'��)"��~M�I�3R�)g�X%�w�m�D�B��4�S�%�S��ƪ�m�{�K�}�A��֛[WOū�_}$��=L~<��&�,�nmL�{1%��G8BS�Lk��[��)M�C��(�8��ȧ��7��l��ls��5D�䶱Y�G��/h��-��'��WU^�%g��(�-�5�t7iSG5��y�K�9-�T�=��l��Oh��Tk��Z"39:T52a,Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00005516.00000000.118272.026D0000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00005516.00000000.118272.026D0000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00007960.00000000.118267.02C70000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00007960.00000000.118267.02C70000.00000004.mdmp") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; Source: "00000000-00007960.00000000.118267.DFB44000.00000002.mdmp") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; Source: "00000000-00007960.00000000.118267.DFB44000.00000002.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00008976.00000000.118277.03270000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00008976.00000000.118277.03270000.00000004.mdmp")3a:T40c,Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00005516.00000000.118272.026D0000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00005516.00000000.118272.026D0000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00007960.00000000.118267.02C70000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00007960.00000000.118267.02C70000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00008976.00000000.118277.03270000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00008976.00000000.118277.03270000.00000004.mdmp")3b:T43c,Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00005516.00000000.118272.026D0000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00005516.00000000.118272.026D0000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00007960.00000000.118267.02C70000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00007960.00000000.118267.02C70000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00008976.00000000.118277.03270000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00008976.00000000.118277.03270000.00000004.mdmp")3c:T460,Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00005516.00000000.118272.026D0000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00005516.00000000.118272.026D0000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00007960.00000000.118267.02C70000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00007960.00000000.118267.02C70000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00008976.00000000.118277.03270000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00008976.00000000.118277.03270000.00000004.mdmp")3d:T430,Found reference to API "" (Indicator: "AccessCheck"; Source: "00000000-00005516.00000000.118272.026D0000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileSecurityW"; Source: "00000000-00005516.00000000.118272.026D0000.00000004.mdmp") Found reference to API "" (Indicator: "AccessCheck"; Source: "00000000-00007960.00000000.118267.02C70000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileSecurityW"; Source: "00000000-00007960.00000000.118267.02C70000.00000004.mdmp") Found reference to API "" (Indicator: "AccessCheck"; Source: "00000000-00008976.00000000.118277.03270000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileSecurityW"; Source: "00000000-00008976.00000000.118277.03270000.00000004.mdmp")3e:Tabc,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAH0klEQVR4Xs2W+1NU5x3G/S/aSdtJO7VtahqDGg3TaCdMNfESLCSYYEgC4gUhgqIGMRhHtGoQAqhBt8hVbgLLclFugiJGHSUqiMptYZfLsuyFXVhYLnt9+n3fw56waAo/dKY9zDNn5syc/TzP9/IeFi36f73KG55gtsputqD0RjOXrL4ZJXWPIGWqfYTi2ocoqvkRhdVNuEIqqHpAuo98uiuVauh0Osz9/XkvBl3o5XSSXHeSwwHYSXmV93HgVBo30afX/7yJpNojOFMZjVNlBxEr3Ysj+WGIyt6J/ZcCsSdlK0KSPsK2M5vx2ckN8D+2Fn5fvwufqNXw3u+JjftWiWAOn2Ug99o9qIyAf/iJ/2wiseYIKp4VoLQ1F9KWbFx5mI6cBxJk3j2P1MZEXKiLw9nqE4i/+g1Ol0bjePEBHCvci5i8PW4GZsNtpJyKO9xAt8aGNX5f/ryJM9eiuQGxpPRndzroR2yw2qyYtk1j0joJs8WMsakxjEyOwGA24tDlEG6gttmAmsfDggFy4jKQVXZbNNCimMBK7x0vN3Gy7AClz5lJ4eCy2Qlut2DaSnALwafNMHH4KAwTBujH9TiYvR3rI1a6V8A5UwE7kClrnGXAjB+eGfHm+4EvmjhWGI7i5iz6ESfCS3cjrGgXQvK249OL/hw+Pj0O/9gtbtKOaRCZEYT39ix/ofwuA+klDWhoHUbdYx0qm4Ygu6NC4c0+0YRo4HDubuQ3pdKLdqy/uBaytgLE1EUhunYf/L7bzIERFcHYkuODtxKXYdHORVCPqhGRFoC1oR642qRFxQMNyu5rILs3hJK7ahTfGUS69CaCv0rA55Hf4uOwWHgHH8baTyPxzoeh3IRo4GDGNmTfTeFlt1DZ133vhZzmdOwvD0VwyRfYeNSLw5fHvynCVSMqhKV+gnd3LRUrILunFtNb7U5YbE7ceiBH6W058uoUonLqle4GIiSf4VJjEr1gwZR1ChOWCbyT4In0HyXUCn98mOMLr73LBfiIGgPGAfQZ+hAi8cWa4NdFAyy1ywCDT1udyLnRh4lpJ8annDBNOjAy4UB23RwDoec+Rkp9nAhnPWeJPU68gYTGUwiQvIeN6RvgGfQHBGUFcvUOKxGcsgl/DfwTpAQu+oH6e1uFglsDyG/oRy71+nJ9L7IIZiYDY5NOjJIB47gDmdeFORAN7EjwRXLVcYILa8bgkeXbsSV/M147/HucbPzGzURCSSx6dD0IPPc+VgUsFic//1a/UH4bePopUkatgtI7KL0TI2YHDGQgrXaOgS9Ob0RcRYyYfKnPEjctPvRbRFWFu5no1skRkOyFFZ/87qeTj1JbbULvGXzC4kRadY+QfsIJIxkYHnMgtbrf3cDW2HU4WRLFd9xoNmCYdlw7psWQaYiGbRD/lMa+YKpL2wX/xDXw8HuVg1mvecmvK3nqtJoeXKrqxr8q5bz3DG4guM7kwIVKlbsBvxgvxBZG0uk2AzcRfGbSB4z91O9eKIYVlLoHcq2c4J3oGOqAX8LbZObXM2V3Um8VvPSTlFwYPAcuXu0SS68z2aEZtePc1UF3Az6HViMmP5yfblqTRlyzfhdcr6Ced0NOZe/UdHF4+1A7fONWYIn3K7zkTCz1bDhL/n15J4frKb1m1AG10Y6k8jkGvA94IjonFFF0tn9Fx+u+zCBEpAfwPQ+R+NC0f8AHjvXcP3E1/OLfJvhb8InzwJ83/QIZNQre61QqueSanKdOqegkeAfOl3bwvmsp/dCIAyqDHfGlancD7IPCxM719eErsC5sGf6+2wNeu97A37a/jtWBr8Hz8z9i5dbFfOg8PnoVS31/g7/841dY8sEvxdSSa13ivo/SvhvMQnIBbufw/mE7Tss07gZedmXKbvNJZsqjvZ4iCBd7Rvf0WeVme87AYzNgdticlbUjuaQNoWeqOHyQSj9AcKXOhhPF2vkNZNCXjK0R00snvFqYcAa+wMvdyWF82qnnSdI2/i57pjKy5Db0EryHvoxHC/ULMCC9ReeCgw8TO80YSJCDDisH77Wr1KzXLtjwzLR/V/xcfNavtwtwrQ3yIRu+LjDMbyCtuIGfXgzCUrO7AGSHioOnZuvFjtZzpe0iLJHACUXPEF/4VHym1Nl58i6CdwxaEZW3AAOXim7yXjKIa8JZyWdPOAOzIUsq+ancbM1UBhvirrSKz9g/JC5424AV+3NG5jeQWniD95KJgdkq6Wf2WTdm53Ctie22e7kHaNL7qOSn85+IzzrVVrSrBPjTfiv2Xh6d34DkSj3vJVshllpLICYG1IwIqVlaNt3xVHIXrJfKrdDacSqvRXzWrrLgOcFb+6xo6bViT5ZpAQYK6vj6MKXQhJ8vE0qeLGujCX8u9poBFqInfRYOf6y0IjRjbH4DF/Pr+PqwfrIDREVrNEBiE92vp5UisZ1WaoXpFvpsRReVu4OVm/Ss34KnlPoJgZuVFjxSWNDUbcGu9PH5DVzIu8576VKvXjhEGFAhQq3opuFiUN5nNmQMPNPr1l4LmkmPCfywR4Dfl1uwI828MANsfe48UqL6bg+kNxS4XKOApGIAyfQ1cymxYhDxZWp8WzpEn3Qtjkt1OFqkp10fpnUz8omPyDYhjPoekjGOHZQ++NICDKTk1iI05iw2BR3i/8Wu8t6JZRu28Rf/W5rL/J9c/wYRsReyPBNKrwAAAABJRU5ErkJggg==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"f47af17b82cdd753cbba4f75be9e372ac7dca17452572c57df64f5bfea74abe9","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791311381035,"unified_at":"2026-10-06T18:29:41.035Z","metadata":{"hashes":{"sha256":"f47af17b82cdd753cbba4f75be9e372ac7dca17452572c57df64f5bfea74abe9","sha1":"d12c01f5bef3f87d920b901612d5b7fdcd54bf7f","md5":"f630d3f3eaa928641215e892999bdc29","sha512":"302b22c3f6c8b8a67030d767937b2c8a85ce507e8ff5d2b1ad70696562d523cc3b5e6533fb793c97a1b05ba74d00480ee38c2e79c011a8be0184be4dc77558dd","ssdeep":"6144:CKpb8rGYrMPe3q7Q0XV5xtuEsi8/dgI9jWXcZZRBTq1BOzTwvOsPDslAvS32vI7o:M9jVzTmszTwvTDy33LvfP1OWa","ssdeep_chunks":["6144:CKpb8rG","6144:Kpb8rGY","6144:pb8rGYr","6144:b8rGYrM","6144:8rGYrMP","6144:rGYrMPe","6144:GYrMPe3","6144:YrMPe3q","6144:rMPe3q7","6144:MPe3q7Q","6144:Pe3q7Q0","6144:e3q7Q0X","6144:3q7Q0XV","6144:q7Q0XV5","6144:7Q0XV5x","6144:Q0XV5xt","6144:0XV5xtu","6144:XV5xtuE","6144:V5xtuEs","6144:5xtuEsi","6144:xtuEsi8","6144:tuEsi8/","6144:uEsi8/d","6144:Esi8/dg","6144:si8/dgI","6144:i8/dgI9","6144:8/dgI9j","6144:/dgI9jW","6144:dgI9jWX","6144:gI9jWXc","6144:I9jWXcZ","6144:9jWXcZZ","6144:jWXcZZR","6144:WXcZZRB","6144:XcZZRBT","6144:cZZRBTq","6144:ZZRBTq1","6144:ZRBTq1B","6144:RBTq1BO","6144:BTq1BOz","6144:Tq1BOzT","6144:q1BOzTw","6144:1BOzTwv","6144:BOzTwvO","6144:OzTwvOs","6144:zTwvOsP","6144:TwvOsPD","6144:wvOsPDs","6144:vOsPDsl","6144:OsPDslA","6144:sPDslAv","6144:PDslAvS","6144:DslAvS3","6144:slAvS32","6144:lAvS32v","6144:AvS32vI","6144:vS32vI7","6144:S32vI7o","12288:CKpb8rG","12288:Kpb8rGY","12288:pb8rGYr","12288:b8rGYrM","12288:8rGYrMP","12288:rGYrMPe","12288:GYrMPe3","12288:YrMPe3q","12288:rMPe3q7","12288:MPe3q7Q","12288:Pe3q7Q0","12288:e3q7Q0X","12288:3q7Q0XV","12288:q7Q0XV5","12288:7Q0XV5x","12288:Q0XV5xt","12288:0XV5xtu","12288:XV5xtuE","12288:V5xtuEs","12288:5xtuEsi","12288:xtuEsi8","12288:tuEsi8/","12288:uEsi8/d","12288:Esi8/dg","12288:si8/dgI","12288:i8/dgI9","12288:8/dgI9j","12288:/dgI9jW","12288:dgI9jWX","12288:gI9jWXc","12288:I9jWXcZ","12288:9jWXcZZ","12288:jWXcZZR","12288:WXcZZRB","12288:XcZZRBT","12288:cZZRBTq","12288:ZZRBTq1","12288:ZRBTq1B","12288:RBTq1BO","12288:BTq1BOz","12288:Tq1BOzT","12288:q1BOzTw","12288:1BOzTwv","12288:BOzTwvO","12288:OzTwvOs","12288:zTwvOsP","12288:TwvOsPD","12288:wvOsPDs","12288:vOsPDsl","12288:OsPDslA","12288:sPDslAv","12288:PDslAvS","12288:DslAvS3","12288:slAvS32","12288:lAvS32v","12288:AvS32vI","12288:vS32vI7","12288:S32vI7o","6144:M9jVzTm","6144:9jVzTms","6144:jVzTmsz","6144:VzTmszT","6144:zTmszTw","6144:TmszTwv","6144:mszTwvT","6144:szTwvTD","6144:zTwvTDy","6144:TwvTDy3","6144:wvTDy33","6144:vTDy33L","6144:TDy33Lv","6144:Dy33Lvf","6144:y33LvfP","6144:33LvfP1","6144:3LvfP1O","6144:LvfP1OW","6144:vfP1OWa"],"imphash":"Unknown"},"file_info":{"file_name":"file","file_type":["xls","office"],"file_type_id":"xls","file_size":234496,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1635332996000,"last_seen":1731093851000,"last_multi_scan":1731093851000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["agent","encdoc","malicious"]},"stats":{"av":{"malicious_count":13,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":47},"sandbox_signatures":{"informative_count":107,"suspicious_count":4,"malicious_count":3,"total":114},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Downloader/XLS.XLMacro","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Downloader]/MSOffice.EncDoc.qbt","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"XLM.Formulas.Abracadabra.8.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Xls.Downloader.SquirrelWaffle1021-9903731-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"msoffice/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"XLM.Formulas.Abracadabra.8.Gen (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"DOC/TrojanDownloader.Agent.DJM trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 00568efb1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"X97M/Downloader.lr","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Mal/DocDl-M","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"XF/SneakyBin.G.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"X97M.Dwnldr.FYH","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"XLM.Formulas.Abracadabra.8","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","identifiers":[{"type":"malicious","value":"Application communicates with a malicious domain"}],"sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"},{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads rich edit control libraries"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"},{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"},{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"tactic":"Persistence","technique":"Shortcut Modification","attack_id":"T1547.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/009","identifiers":[{"type":"informative","value":"Creates/edits LNK file (Windows shortcut)"}],"sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"},{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"},{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Renames files"},{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"},{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"},{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Calls an API typically used to set the date and time of the file"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"},{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"tactic":"Defense Evasion","technique":"System Binary Proxy Execution","attack_id":"T1218","attack_id_wiki":"https://attack.mitre.org/techniques/T1218","sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"},{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"}],"sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"},{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Contains ability to delete registry key/value (API string)"}],"sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"},{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"tactic":"Defense Evasion","technique":"Regsvr32","attack_id":"T1218.010","attack_id_wiki":"https://attack.mitre.org/techniques/T1218/010","identifiers":[{"type":"malicious","value":"Detected regsvr32 execution"}],"sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"},{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Calls an API typically used for keylogging"}],"sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Contains ability to query registry keys (API string)"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"},{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"}],"sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"},{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"}],"sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"},{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API typically used to get handle of currently active window"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to get active windows title"}],"sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"},{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"}],"sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"},{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"},{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Opens a handle to the specified process"}],"sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"},{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"},{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Writes log files"}],"sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"},{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Calls an API possibly used to take screenshots"}],"sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"},{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Tries to open documents files"}],"sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"},{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Calls an API typically used to create a new HTTP request"},{"type":"informative","value":"Calls an API typically used to create a HTTP or FTP session"},{"type":"informative","value":"Contacts server"},{"type":"suspicious","value":"Spawned process connects to a network"}],"sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"},{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"informative","value":"GETs files from a webserver (HTTPS)"},{"type":"informative","value":"Found user-agent related strings"},{"type":"informative","value":"Calls an API used to connect to internet"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Communicates with HTTPS webserver (GET/POST requests)"},{"type":"informative","value":"Found string related to HTTP headers"}],"sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"},{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"},{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Decrypted SSL network traffic"}],"sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"},{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"},{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"},{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains ability to modify process attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"tactic":"Exfiltration","technique":"Data Transfer Size Limits","attack_id":"T1030","attack_id_wiki":"https://attack.mitre.org/techniques/T1030","identifiers":[{"type":"suspicious","value":"Multiple POSTs requests with same length but different payloads to a webserver (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to find a resource in a module","description":"\"regsvr32.exe\" called \"FindResourceW\" with parameter \"4255\" - (UID: 00000000-00005940)\n \"regsvr32.exe\" called \"FindResourceW\" with parameter \"1010\" - (UID: 00000000-00005940)\n \"regsvr32.exe\" called \"FindResourceW\" with parameter \"4255\" - (UID: 00000000-00004540)\n \"regsvr32.exe\" called \"FindResourceW\" with parameter \"1010\" - (UID: 00000000-00004540)\n \"regsvr32.exe\" called \"FindResourceW\" with parameter \"4255\" - (UID: 00000000-00004484)\n \"regsvr32.exe\" called \"FindResourceW\" with parameter \"1010\" - (UID: 00000000-00004484)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to load a resource in memory","description":"$25","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Renames files","description":"\"EXCEL.EXE\" renamed original file\"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\CVRB6FF.tmp\" to \"%TEMP%\\CVRB6FF.tmp.cvr\"","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"},{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.638961221999","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"},{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Sample file has high entropy (likely encrypted/compressed content)","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"},{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"regsvr32.exe\" called \"GetForegroundWindow\" (UID: 00000000-00005940)\n \"regsvr32.exe\" called \"GetForegroundWindow\" (UID: 00000000-00004540)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"regsvr32.exe\" called \"IsWow64Process\" with parameter \"5940\" - (UID: 00000000-00005940)\n \"regsvr32.exe\" called \"IsWow64Process\" with parameter \"4540\" - (UID: 00000000-00004540)\n \"regsvr32.exe\" called \"IsWow64Process\" with parameter \"4484\" - (UID: 00000000-00004484)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"regsvr32.exe\" called \"GetWindowTextW\" (UID: 00000000-00005940)\n \"regsvr32.exe\" called \"GetWindowTextW\" with parameter \"4f004b00\" - (UID: 00000000-00005940)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"},{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get handle of currently active window","description":"\"regsvr32.exe\" called \"GetActiveWindow\" (UID: 00000000-00005940)\n \"regsvr32.exe\" called \"GetActiveWindow\" (UID: 00000000-00004540)\n \"regsvr32.exe\" called \"GetActiveWindow\" (UID: 00000000-00004484)","origin":"API Call","mitre_attack_id":"T1010","relevance":5,"id":"api-150","sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"regsvr32.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005940)\n \"regsvr32.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00004540)\n \"regsvr32.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00004484)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"},{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$26","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"},{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"regsvr32.exe\" called \"OpenMutexW\" with parameter \"Local\\MSCTF.Asm.MutexDefault1\" - (UID: 00000000-00005940)\n \"regsvr32.exe\" called \"OpenMutexW\" with parameter \"Local\\MSCTF.Asm.MutexDefault1\" - (UID: 00000000-00004540)\n \"regsvr32.exe\" called \"OpenMutexW\" with parameter \"Local\\MSCTF.Asm.MutexDefault1\" - (UID: 00000000-00004484)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$27","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"EXCEL.EXE\" called \"LookupAccountSidW\" with param Name vCvx55b (UID: 00000000-00006020)\n \"EXCEL.EXE\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00006020)\n \"EXCEL.EXE\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00006020)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"},{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"regsvr32.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00005940)\n \"regsvr32.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00004540)\n \"regsvr32.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00004484)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"regsvr32.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"},{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$28","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"},{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$29","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"},{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"91.195.240.94:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"},{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$2a","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"},{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\"regsvr32.exe\" failed to load missing module \"C:\\Datop\\test.test\" - [base:0; Status:c0000135]\n \"regsvr32.exe\" failed to load missing module \"api-ms-win-core-fibers-l1-1-1\" - [base:0; Status:c0000135]\n \"regsvr32.exe\" failed to load missing module \"api-ms-win-core-localization-l1-2-1\" - [base:0; Status:c0000135]\n \"regsvr32.exe\" failed to load missing module \"C:\\Datop\\test1.test\" - [base:0; Status:c000012f]\n \"regsvr32.exe\" failed to load missing module \"C:\\Datop\\test2.test\" - [base:0; Status:c0000135]","origin":"API Call","mitre_attack_id":"T1574.002","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"},{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"level":"informative","category":"General","name":"Found user-agent related strings","description":"Found string \"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)\" (Indicator: \"mozilla/4.0 (\"; Source: \"00000000-00006020-00000C95-70235\")\n Found string \"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729;\" (Indicator: \"mozilla/4.0 (\"; Source: \"00000000-00006020-00000C96-70240\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$2b","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"},{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"EXCEL.EXE\" loaded module \"%COMMONPROGRAMFILES%\\microsoft shared\\OFFICE14\\RICHED20.DLL\" at 6A450000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-2","sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"},{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"regsvr32.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 76420000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"},{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"15001600c02e946c@ADVAPI32.dll\"\n \"0e000f00702f946c@ADVAPI32.dll\"\n \"0e000f00cc2f946c@ADVAPI32.dll\"\n \"11001200b437946c@ADVAPI32.dll\"\n \"110012004838946c@ADVAPI32.dll\"\n \"120013008c38946c@ADVAPI32.dll\"\n \"12001300e438946c@ADVAPI32.dll\"\n \"14001500385e946c@ADVAPI32.dll\"\n \"14001500505e946c@ADVAPI32.dll\"\n \"14001500685e946c@ADVAPI32.dll\"\n \"17001800805e946c@ADVAPI32.dll\"\n \"0d000e00985e946c@ADVAPI32.dll\"\n \"11001200a85e946c@ADVAPI32.dll\"\n \"11001200bc5e946c@ADVAPI32.dll\"\n \"0d000e004456946c@WININET.dll\"\n \"0d000e00b456946c@WININET.dll\"\n \"10001100ec56946c@WININET.dll\"\n \"100011009057946c@WININET.dll\"\n \"10001100005f946c@WININET.dll\"\n \"10001100145f946c@WININET.dll\"\n \"14001500285f946c@WININET.dll\"\n \"14001500405f946c@WININET.dll\"\n \"12001300585f946c@WININET.dll\"\n \"120013006c5f946c@WININET.dll\"\n \"10001100d057946c@WININET.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"},{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"file\" was detected as \"Microsoft Compound\" and name: \"Archive\"\n \"file\" was detected as \"Microsoft Compound\" and name: \"Data\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"},{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\System32\\regsvr32.exe\" [Source: 00000000-00006020-00000C44-73680]\n Observed system executable string:\"\"%WINDIR%\\System32\\regsvr32.exe\" C:\\Datop\\test.test\" [Source: 00000000-00006020-00000C44-73680]\n Observed system executable string:\"\"%WINDIR%\\System32\\regsvr32.exe\" C:\\Datop\\test1.test\" [Source: 00000000-00006020-00000C44-1009831760]\n Observed system executable string:\"\"%WINDIR%\\System32\\regsvr32.exe\" C:\\Datop\\test2.test\" [Source: 00000000-00006020-00000C44-4183355088]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"},{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"regsvr32.exe\" (UID: 00000000-00005940) was launched with new environment variables: \"WecVersionForRosebud.1784=\"4\"\"\n Process \"regsvr32.exe\" (UID: 00000000-00005940) was launched with modified environment variables: \"LOCALAPPDATA, APPDATA, USERNAME, HOMEPATH, TEMP, USERPROFILE, TMP\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"},{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"dharmasasthatrust.com\"\n \"haroldhallroofing.net\"\n \"shalsa3d.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"},{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"regsvr32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"regsvr32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"regsvr32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"},{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"},{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"regsvr32.exe\" with commandline \"C:\\\\Datop\\\\test.test\" (UID: 00000000-00005940)\n Spawned process \"regsvr32.exe\" with commandline \"C:\\\\Datop\\\\test1.test\" (UID: 00000000-00004540)\n Spawned process \"regsvr32.exe\" with commandline \"C:\\\\Datop\\\\test2.test\" (UID: 00000000-00004484)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"},{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=Encryption Everywhere DV TLS CA - G2, OU=www.digicert.com, O=DigiCert Inc, C=US\" (SHA1: E4:6E:03:AC:8A:7A:F8:5F:BA:84:5A:0B:95:12:82:74:3C:E6:31:F8; see report for more information)\n The input sample is signed with a certificate issued by \"CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US\" (SHA1: ED:63:02:68:4A:32:59:AA:04:F1:0F:E9:A9:7A:8F:D3:0B:96:5D:26; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"},{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"level":"informative","category":"General","name":"Tries to open documents files","description":"\"EXCEL.EXE\" opens a file C:\\file.xls (UID: 00000000-00006020)\n \"EXCEL.EXE\" opens a file C:\\FIL27.2.XLS (UID: 00000000-00006020)","origin":"API Call","mitre_attack_id":"T1005","relevance":2,"id":"api-248","sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"},{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"level":"informative","category":"Installation/Persistence","name":"Calls an API typically used to set the date and time of the file","description":"\"EXCEL.EXE\" called \"SetFileTime\" on file C:\\file.xls (UID: 00000000-00006020)","origin":"API Call","mitre_attack_id":"T1070.006","relevance":2,"id":"api-205","sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"regsvr32.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates/edits LNK file (Windows shortcut)","description":"\"EXCEL.EXE\" writes to LNK file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Office\\Recent\\file.xls.LNK\"\n \"EXCEL.EXE\" writes to LNK file \"%APPDATA%\\Microsoft\\Office\\Recent\\file.xls.LNK\"","origin":"API Call","mitre_attack_id":"T1547.009","relevance":3,"id":"api-204","sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"},{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"file.xls.LNK\" has type \"MS Windows shortcut Item id list present Points to a file or directory Has Relative path Archive ctime=Fri Nov 8 19:24:12 2024 mtime=Fri Nov 8 19:24:12 2024 atime=Fri Nov 8 18:48:00 2024 length=234496 window=hide\"- Location: [%APPDATA%\\Microsoft\\Office\\Recent\\file.xls.LNK]- [targetUID: 00000000-00006020]\n \"test1.test\" has type \"HTML document Unicode text UTF-8 text with very long lines (9721)\"- Location: [C:\\Datop\\test1.test]- [targetUID: 00000000-00006020]\n \"index.dat\" has type \"data\"- Location: [%APPDATA%\\Microsoft\\Office\\Recent\\index.dat]- [targetUID: 00000000-00006020]\n \"hr_1_.htm\" has type \"HTML document Unicode text UTF-8 text with very long lines (9721)\"- [targetUID: N/A]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"},{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$2d","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"},{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$2e","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"},{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"regsvr32.exe\" reads file \"c:\\windows\\fonts\\staticcache.dat\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"},{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$2f","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"},{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"regsvr32.exe\" touched file \"C:\\Windows\\AppPatch\\sysmain.sdb\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"\"regsvr32.exe\" trying to access non-existent file \"C:\\Windows\\System32\\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL\"\n \"regsvr32.exe\" trying to access non-existent file \"C:\\Windows\\System32\\API-MS-WIN-CORE-LOCALIZATION-L1-2-1.DLL\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"regsvr32.exe\" trying to access non-existent file \"C:\\Windows\\System32\\REGSVR32.EXE.LOCAL\"\n \"regsvr32.exe\" trying to access non-existent file \"C:\\Windows\\System32\\REGSVR32.EXE.CONFIG\"\n \"regsvr32.exe\" trying to access non-existent file \"C:\\Datop\\TEST.TEST\"\n \"regsvr32.exe\" trying to access non-existent file \"C:\\Datop\\TEST2.TEST\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"},{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"EXCEL.EXE\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat\"\n \"EXCEL.EXE\" writes a file \"%APPDATA%\\Microsoft\\Office\\Recent\\index.dat\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"},{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to create a HTTP or FTP session","description":"\"EXCEL.EXE\" called \"InternetConnectW\" to server \"dharmasasthatrust.com\" on port 443 (UID: 00000000-00006020)\n \"EXCEL.EXE\" called \"InternetConnectW\" to server \"shalsa3d.com\" on port 443 (UID: 00000000-00006020)\n \"EXCEL.EXE\" called \"InternetConnectW\" to server \"haroldhallroofing.net\" on port 443 (UID: 00000000-00006020)","origin":"API Call","mitre_attack_id":"T1071","relevance":3,"id":"api-215","sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"},{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to create a new HTTP request","description":"\"EXCEL.EXE\" called \"HttpOpenRequestW\" with parameter HTTP method:\"GET\" object: /cEJYcStqlAf/hr.html\" - (UID: 00000000-00006020), \"EXCEL.EXE\" called \"HttpOpenRequestW\" with parameter HTTP method:\"GET\" object: /UGqWNCLT/hr.html\" - (UID: 00000000-00006020)\n \"EXCEL.EXE\" called \"HttpOpenRequestW\" with parameter HTTP method:\"GET\" object: /pAz8O63Gn/hr.html\" - (UID: 00000000-00006020)","origin":"API Call","mitre_attack_id":"T1071","relevance":3,"id":"api-143","sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"},{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"level":"informative","category":"Network Related","name":"Calls an API used to connect to internet","description":"\"EXCEL.EXE\" called \"InternetOpenA with parameter Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)\" (UID: 00000000-00006020)\n \"EXCEL.EXE\" called \"InternetOpenW with parameter Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729;\" (UID: 00000000-00006020)","origin":"API Call","mitre_attack_id":"T1071.001","relevance":1,"id":"api-199","sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"2.5.29.35\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"shalsa3d.com/ugqwnclt/hr.h\"\n Pattern match: \"dharmasasthatrust.com/cejycstqlaf/hr.h\"\n Pattern match: \"img.sedoparking.com/templates/logos/sedo_logo.png/\"\n Heuristic match: \"dharmasasthatrust.com\"\n Heuristic match: \"haroldhallroofing.net\"\n Heuristic match: \"shalsa3d.com\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"},{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 7dcce5b76c8b17472d024758970a406b","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"},{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"},{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"91.195.240.94\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"},{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"$30","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"},{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for keylogging","description":"\"regsvr32.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"18\"}\n \"regsvr32.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"17\"}\n \"regsvr32.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"16\"}\n \"regsvr32.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"91\"}\n \"regsvr32.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"92\"}","origin":"API Call","mitre_attack_id":"T1056.001","relevance":10,"id":"api-40","sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$31","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"},{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"details too long to display","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"},{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"file.xls.LNK\" - Location: [%APPDATA%\\Microsoft\\Office\\Recent\\file.xls.LNK]- [targetUID: 00000000-00006020]\n Dropped file: \"index.dat\" - Location: [%APPDATA%\\Microsoft\\Office\\Recent\\index.dat]- [targetUID: 00000000-00006020]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"},{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"regsvr32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"},{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 91.195.240.94 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"},{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"level":"suspicious","category":"Network Related","name":"Spawned process connects to a network","description":"Process \"%PROGRAMFILES%\\Microsoft Office\\Office14\\EXCEL.EXE\" connects to 91.195.240.94 on port 443 (TCP); Domain: \"shalsa3d.com\"","origin":"Monitored Target","mitre_attack_id":"T1071","relevance":5,"id":"target-412","sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"},{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected text artifact in screenshot that indicate file could be ransomware","description":"\"viruses.\" (Source: screen_24.png, Indicator: \"virus\")","origin":"File/Memory","relevance":10,"id":"string-12","sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Detected regsvr32 execution","description":"Process \"regsvr32.exe\" with commandline \"C:\\\\Datop\\\\test.test\" (UID: 00000000-00005940)\n Process \"regsvr32.exe\" with commandline \"C:\\\\Datop\\\\test1.test\" (UID: 00000000-00004540)\n Process \"regsvr32.exe\" with commandline \"C:\\\\Datop\\\\test2.test\" (UID: 00000000-00004484)","origin":"Monitored Target","mitre_attack_id":"T1218.010","relevance":10,"id":"target-112","sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"},{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: msoffice/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"},{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"level":"malicious","category":"Network Related","name":"Application communicates with a malicious domain","description":"Contacted Domain: \"shalsa3d.com\" has been identified as malicious","origin":"Network Traffic","mitre_attack_id":"T1566","relevance":10,"id":"network-88","sources":[{"report_type":"sandbox","report_id":"672e6555da5c7012b5055baa"},{"report_type":"sandbox","report_id":"672e654f4b714596690236b2"},{"report_type":"sandbox","report_id":"672e655b94cf2d0b6c0413ca"},{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00007960.00000000.118267.DFB44000.00000002.mdmp\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"00000000-00007960.00000000.118267.DFB44000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00007960.00000000.118267.DFB44000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00007960.00000000.118267.DFB44000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007960.00000000.118267.DFB44000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007960.00000000.118267.DFB44000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify registry key/value (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00007960.00000000.118267.DFB44000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process2\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00007960.00000000.118267.DFB44000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00007960.00000000.118267.DFB44000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00007960.00000000.118267.DFB44000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"GetSystemInfo\" (Indicator: \"GetSystemInfo\"; Source: \"00000000-00007960.00000000.118267.DFB44000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00007960.00000000.118267.DFB44000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"regsvr32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00007960.00000000.118267.DFB44000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"level":"informative","category":"General","name":"Contains ability to create/load registry keys (API string)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00007960.00000000.118267.DFB44000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$35","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"$36","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00007960.00000000.118267.DFB44000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00007960.00000000.118267.DFB44000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00007960.00000000.118267.DFB44000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$37","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"regsvr32.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 5C850000\n \"regsvr32.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 5C000000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007960.00000000.118267.DFB44000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007960.00000000.118267.DFB44000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens a handle to the specified process","description":"\"EXCEL.EXE\" opens a process \"C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE\" (UID: 00000000-00008196)\n \"EXCEL.EXE\" opens a process \"C:\\Windows\\explorer.exe\" (UID: 00000000-00008196)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-237","sources":[{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"regsvr32.exe\" queries basic process information of the \"C:\\Windows\\System32\\regsvr32.exe\" (UID: 7960)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTPS webserver (GET/POST requests)","description":"Found requests in header \"GET /UGqWNCLT/hr.html HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: shalsa3d.comConnection: Keep-Alive\"; in File: \"SSL\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-505","sources":[{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"level":"informative","category":"Network Related","name":"Decrypted SSL network traffic","description":"$38","origin":"File/Memory","mitre_attack_id":"T1573","relevance":3,"id":"string-102","sources":[{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"file/memory contains long string with (Indicator: \"HTTP/1.1\"; File: \"SSL\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"level":"informative","category":"Network Related","name":"GETs files from a webserver (HTTPS)","description":"GET /service/msn/livetile/singletile?market=en-US&source=appxmanifest&tenant=amp&vertical=finance HTTP/1.1Connection: Keep-Alive\n User-Agent: Microsoft-WNS/10.0\n Host: assets.msn.com\n\n GET /UGqWNCLT/hr.html HTTP/1.1Accept: */*\n UA-CPU: AMD64\n Accept-Encoding: gzip\n deflate\n User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)\n Host: shalsa3d.com\n Connection: Keep-Alive\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://assets.msn.com/service/msn/livetile/singletile?market=en-US&source=appxmanifest&tenant=amp&vertical=finance\n Found HTTPS GET request to https://shalsa3d.com/UGqWNCLT/hr.html","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"regsvr32.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00007960.00000000.118267.DFB44000.00000002.mdmp\")\n Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00007960.00000000.118267.DFB44000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00007960.00000000.118267.DFB44000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"$39","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00007960.00000000.118267.DFB44000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00007960.00000000.118267.DFB44000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00007960.00000000.118267.DFB44000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetSystemDirectoryW\" (Indicator: \"GetSystemDirectory\"; Source: \"00000000-00007960.00000000.118267.DFB44000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00007960.00000000.118267.DFB44000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\HarddiskVolume2\\Windows\\System32\\regsvr32.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00005516.00000000.118272.026D0000.00000004.mdmp\")\n Found string \"\\Device\\HarddiskVolume2\\Windows\\System32\\regsvr32.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00007960.00000000.118267.02C70000.00000004.mdmp\")\n Found string \"\\Device\\HarddiskVolume2\\Windows\\System32\\regsvr32.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00008976.00000000.118277.03270000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete registry key/value (API string)","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00007960.00000000.118267.DFB44000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"672e6542026c0c831a0b41db"},{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"SURICATA IPv4 invalid checksum\" (SID: 2200073, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"\n Detected alert \"SURICATA UDPv4 invalid checksum\" (SID: 2200075, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify process attributes (API string)","description":"Found reference to API \"InitializeProcThreadAttributeList\" (Indicator: \"InitializeProcThreadAttributeList\"; Source: \"00000000-00007040.00000002.167539.C69F4000.00000002.mdmp\")\n Found reference to API \"UpdateProcThreadAttribute\" (Indicator: \"UpdateProcThreadAttribute\"; Source: \"00000000-00007040.00000002.167539.C69F4000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-402","sources":[{"report_type":"sandbox","report_id":"672e6548c7cd80832409c6b4"}]},{"level":"suspicious","category":"Network Related","name":"Multiple POSTs requests with same length but different payloads to a webserver (HTTPS)","description":"Found more than 2 POST requests like this POST /RST2.srf HTTP/1.0Connection: Keep-Alive\n Content-Type: application/soap+xml\n Accept: */*\n User-Agent: MSAWindows/45 (OS 10.0.22621.0.0 ni_release; IDK 10.0.22621.1 ni_release; Cfg 16.000.29325.00; Test 0)\n Content-Length: 4694\n Host: login.live.com\n with payload ==>