24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 55:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T500,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_100% Sample 6c35a48cedb3… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 6c35a48cedb3…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 10/28 AV engines flagged this file. 6 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15ee1ca","keywords":["Malicious","Win/malicious_confidence_100%","malware analysis","sandbox report","threat intelligence","6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15ee1ca"],"about":{"@type":"SoftwareApplication","name":"6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15ee1ca","applicationCategory":["pedll","64bits","executable"],"identifier":"6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15ee1ca","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_100%","antivirusDetections":{"malicious":10,"total":28},"behavioralIndicators":{"malicious":6,"suspicious":11},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T796,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00001176.00000001.119790.00080000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00001176.00000001.119790.00080000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00001176.00000001.119790.00080000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00001176.00000001.119790.00080000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00003964.00000000.118869.04D4C000.00000020.mdmp, 00000000-00003964.00000001.118905.00080000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00003964.00000000.118869.04D4C000.00000020.mdmp, 00000000-00003964.00000001.118905.00080000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00003964.00000001.118905.00080000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00003964.00000001.118905.00080000.00000004.mdmp")26:Ta25,"powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\0E9612411A0A4ABD15B84FFACBA6DB3166916E75") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\0E9612411A0A4ABD15B84FFACBA6DB3166916E75") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\18F7C1FCC3090203FD5BAA2F861A754976C8DD25") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\18F7C1FCC3090203FD5BAA2F861A754976C8DD25") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\245C97DF7514E7CF2DF8BE72AE957B9E04741E85") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\245C97DF7514E7CF2DF8BE72AE957B9E04741E85") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\3B1EFD3A66EA28B16697394703A72CA340A05BD5") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\3B1EFD3A66EA28B16697394703A72CA340A05BD5") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\7F88CD7223F3C813818C994614A89C99FA3B5247") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\7F88CD7223F3C813818C994614A89C99FA3B5247") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\8F43288AD272F3103B6FB1428485EA3014C0BCFE") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\8F43288AD272F3103B6FB1428485EA3014C0BCFE") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\92B46C76E13054E104F230517E6E504D43AB10B5") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\92B46C76E13054E104F230517E6E504D43AB10B5") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\A43489159A520F0D93D032CCAF37E7FE20A8B419")27:T5f4,Found api reference "CryptEncrypt" (Indicator: "CryptEncrypt"; Source: "00000000-00001176.00000000.119771.D8850000.00000004.mdmp, 00000000-00001176.00000001.119790.D8850000.00000004.mdmp") Found api reference "CryptImportKey" (Indicator: "CryptImportKey"; Source: "00000000-00001380.00000000.119576.767A0000.00000004.mdmp") Found api reference "CryptEncrypt" (Indicator: "CryptEncrypt"; Source: "00000000-00001380.00000000.119576.767A0000.00000004.mdmp") Found api reference "CryptExportKey" (Indicator: "CryptExportKey"; Source: "00000000-00001380.00000001.119647.767A0000.00000004.mdmp") Found api reference "CryptDecrypt" (Indicator: "CryptDecrypt"; Source: "00000000-00001380.00000001.119647.767A0000.00000004.mdmp") Found api reference "CryptDecrypt" (Indicator: "CryptDecrypt"; Source: "00000000-00002440.00000001.119285.8E9A0000.00000004.mdmp") Found api reference "CryptEncrypt" (Indicator: "CryptEncrypt"; Source: "00000000-00003964.00000000.118869.8FCD0000.00000004.mdmp") Found api reference "CryptDecrypt" (Indicator: "CryptDecrypt"; Source: "00000000-00003964.00000000.118869.8FCD0000.00000004.mdmp") Found api reference "CryptDecrypt" (Indicator: "CryptDecrypt"; Source: "00000000-00004404.00000000.120491.DC610000.00000004.mdmp") Found api reference "CryptImportKey" (Indicator: "CryptImportKey"; Source: "00000000-00004404.00000000.120491.DC610000.00000004.mdmp") Found api reference "CryptExportKey" (Indicator: "CryptExportKey"; Source: "00000000-00004404.00000000.120491.DC610000.00000004.mdmp")28:T486,Found string ":\WINDOWS\System32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00001176.00000000.119771.D8850000.00000004.mdmp, 00000000-00001176.00000001.119790.D8850000.00000004.mdmp") Found string ":\WINDOWS\System32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00001380.00000000.119576.767A0000.00000004.mdmp, 00000000-00001380.00000001.119647.767A0000.00000004.mdmp") Found string ":\WINDOWS\System32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00002440.00000000.119249.8E9A0000.00000004.mdmp, 00000000-00002440.00000001.119285.8E9A0000.00000004.mdmp") Found string ":\WINDOWS\System32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00003964.00000000.118869.8FCD0000.00000004.mdmp, 00000000-00003964.00000001.118905.8FCD0000.00000004.mdmp") Found string ":\WINDOWS\SYSTEM32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00004404.00000000.120491.C1E00000.00000004.mdmp") Found string ":\WINDOWS\System32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00004864.00000000.119229.4B7E0000.00000004.mdmp, 00000000-00004864.00000001.119256.4B7E0000.00000004.mdmp")29:T4fd,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains reference to crypto DLLs Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Able to import cryptographic keys (seen in ransomware) Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Able to decrypt/decode data Matched sigs: Contains reference to cryptographic keys Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Able to access crypto-related API (String) Matched sigs: Contains ability to perform encryption (API string) Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Reads the cryptographic machine GUID Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: YARA signature match - AES encryption2a:Td315,Found XOR loop in file "sample.bin" at offset 11636; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 16012; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 44603; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 63583; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 129116; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 134266; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 226543; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 234787; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 263515; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 320627; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 569661; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 648167; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 759019; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 766996; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 789076; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 942694; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1076546; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1082316; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1176730; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1219923; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1338720; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1421066; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1532329; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1645452; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1689794; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1727661; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1749854; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1756569; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1896579; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1909456; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1942870; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1943275; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1945053; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1946698; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1959479; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2002450; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2026423; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2038102; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2062107; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2313718; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2434030; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2458299; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2515276; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2596721; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2743128; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2841343; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2853423; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2926266; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2968611; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2979958; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2980818; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3001673; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3338408; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3414082; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3424357; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3440583; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3485750; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3500728; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3556343; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3569531; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3631605; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3633317; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3757137; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3780198; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3822597; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3886948; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4040959; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4095501; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4265178; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4270347; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4351775; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4547206; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4602127; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4607050; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4659827; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4665912; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4716968; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4745342; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4922219; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5011969; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5069646; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5069770; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5212093; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5349587; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5427792; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5464053; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5518052; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5548368; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5618612; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5773371; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5832072; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5914272; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5939404; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5990480; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6053161; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6241481; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6255677; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6262323; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6281076; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6328335; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6331885; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6353104; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6531658; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6585539; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6610170; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6658976; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6759529; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6867967; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6965458; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7002724; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7026953; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7044153; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7112178; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7198092; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7277945; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7300666; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7784340; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8050999; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8958436; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 78434; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 134370; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 232585; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 319241; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 326469; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 350982; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 378556; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 600188; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 609071; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 635438; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 671361; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 833114; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 883086; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 887529; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1041642; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1060496; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1117230; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1156413; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1194139; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1452727; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1500057; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1617580; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1679113; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1690410; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1694917; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1752696; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1757658; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1894594; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1930299; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1964182; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2127945; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2182672; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2244630; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2292992; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2303462; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2378635; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2383712; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2467242; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2507748; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2750642; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2784752; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2804472; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2858092; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2867221; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2930961; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2960928; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3243045; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3343455; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3428004; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3518292; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3549580; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3581281; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3725571; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3751871; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3806169; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3901346; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3984001; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3986582; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4059392; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4249310; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4354536; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4617200; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4680824; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4687151; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4701846; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4832871; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5020732; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5095086; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5152420; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5186929; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5237894; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5250819; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5278607; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5300309; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5389838; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5501788; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5675405; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5731009; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5822894; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5949739; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5983562; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6082901; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6090586; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6245825; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6272118; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6283560; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6284075; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6298135; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6460079; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6461454; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6468850; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6569881; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6611138; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6628603; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6745334; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6771823; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6844216; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6883063; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6887275; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6929125; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6962500; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7125107; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7126501; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7143770; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7603818; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7607003; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7610589; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7611829; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7617257; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7620936; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7622168; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7624507; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7634696; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7635340; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7637952; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7642983; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7644501; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7648442; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7649678; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7656062; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7663390; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7670255; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7673511; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7674396; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7676100; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7686961; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7687868; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7689319; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7691816; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7699711; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7702596; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7710901; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7728149; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7728989; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7735597; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7743812; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7744703; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7752387; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7761728; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7762062; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7764835; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7766769; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7770565; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7771327; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7776838; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7778163; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7778379; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7780369; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7781739; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7787299; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7788692; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7791492; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7792805; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7793663; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7799997; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7805939; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7809263; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7814323; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7815020; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7820985; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7824113; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7827591; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7835614; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7841370; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7844073; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7846888; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7851120; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7851541; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7856789; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7865320; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7868888; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7869618; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7873188; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7879168; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7882704; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7884763; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7885071; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7887997; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7898753; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7898890; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7899645; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7900790; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7902860; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7913148; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7921112; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7925269; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7927506; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7929789; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7931288; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7932517; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7933304; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7939029; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7942072; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7942120; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7943592; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7950295; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7953768; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7959759; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7961052; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7963862; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7968533; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7970232; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7970658; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7972544; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7972642; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7972751; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7975395; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7978794; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7980667; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7981694; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7984273; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7996447; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7999144; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8002523; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8010428; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8011736; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8029769; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8033123; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8047374; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8047400; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8048303; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8049610; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8051972; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8058303; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8058452; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8058816; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8061708; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8065812; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8067028; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8072566; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8073635; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8082049; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8083977; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8084174; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8085088; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8087982; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8095945; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8097821; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8097860; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8099018; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8106123; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8106436; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8107079; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8107798; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8112852; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8114494; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8119836; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8123734; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8127778; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8127878; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8135636; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8144170; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8146012; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8146815; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8147580; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8149897; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8158925; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8162046; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8173045; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8174685; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8176618; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8177639; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8178546; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8184216; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8203838; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8206648; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8207406; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8214224; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8216235; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8225902; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8227785; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8228554; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8232265; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8233256; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8245575; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8249459; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8250382; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8250950; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8260898; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8260940; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8261030; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8262334; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8262503; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8263294; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8268720; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8278844; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8280330; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8284386; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8286145; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8286466; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8296229; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8306772; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8307036; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8311478; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8316395; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8319471; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8319640; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8322796; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8325140; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8327461; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8327800; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8328357; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8328660; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8329632; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8331778; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8335914; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8335996; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8336573; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8344820; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8346267; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8346838; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8352151; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8362002; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8362711; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8369879; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8370545; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8373164; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8374783; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8379748; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8381709; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8384563; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8386556; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8389370; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8389705; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8391586; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8395279; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8395356; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8397741; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8399991; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8400902; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8403758; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8411798; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8420161; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8421909; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8423185; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8424263; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8426223; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8435310; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8439744; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8445664; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8450179; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8457885; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8462926; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8471074; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8476638; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8477209; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8478356; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8487357; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8493376; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8493955; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8494452; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8496928; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8499075; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8506634; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8508470; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8516205; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8516859; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8517026; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8522788; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8524747; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8524769; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8532071; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8532755; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8542663; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8546694; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8547381; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8548182; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8548359; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8550552; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8554308; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8555982; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8556802; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8557788; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8559501; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8560081; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8566779; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8567304; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8568704; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8579642; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8580343; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8585355; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8587351; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8590341; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8600281; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8601990; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8604895; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8607616; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8613995; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8614927; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8618727; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8625720; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8628275; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8634668; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8636218; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8637896; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8638676; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8643522; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8645453; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8645620; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8651609; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8652034; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8653157; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8654717; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8655397; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8657436; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8660312; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8660457; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8662516; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8663295; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8667409; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8675916; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8677337; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8679666; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8679967; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8680403; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8682023; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8687653; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8690238; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8702921; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8710778; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8715257; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8719827; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8720518; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8725040; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8725069; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8729801; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8737778; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8738002; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8739670; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8742109; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8742123; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8743463; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8744583; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8754012; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8762842; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8764320; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8766526; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8766936; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8767480; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8771132; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8771790; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8778843; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8780092; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8781728; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8782587; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8782750; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8784367; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8784735; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8785415; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8785597; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8789963; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8793807; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8795692; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8802323; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8802481; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8804180; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8809448; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8816459; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8818667; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8819627; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8819848; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8826641; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8832510; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8834772; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8836854; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8838032; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8838927; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8843810; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8846069; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8849833; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8860061; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8860828; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8872890; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8882336; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8886252; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8886738; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8888025; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8889517; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8890237; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8890966; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8897063; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8897476; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8903259; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8912060; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8913232; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8924780; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8930331; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8931029; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8931103; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8933901; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8933987; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8935945; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8938045; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8939356; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8939895; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8940418; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8941312; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8941838; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8942354; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8944185; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8946894; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 55248; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 119381; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 206476; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 242489; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 281875; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 316210; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 338944; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 471739; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 608760; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 611814; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 621060; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 653460; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 685020; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 733044; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 795336; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 880308; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 926269; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 966235; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 971106; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1117103; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1241518; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1311448; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1338633; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1356339; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1365915; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1417136; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1484183; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1484524; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1497184; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1592232; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1646246; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1687688; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2079026; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2378559; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2460406; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2549677; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2649636; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2835869; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2897373; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3026602; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3040410; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3049441; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3392851; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3418723; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3524636; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3532436; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3612470; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3655808; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3798989; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3802938; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3814307; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4142505; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4224288; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4395074; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4415636; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4494507; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4500523; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4501755; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4512298; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4547108; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4609712; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4661984; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4676496; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4846473; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4890941; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4959068; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4982235; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5008118; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5114389; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5256182; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5305182; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5305446; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5321878; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5323240; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5326259; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5326523; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5327291; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5342930; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5386569; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5435272; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5499119; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5540702; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5674577; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5686996; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5816874; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5911947; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5944884; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5971151; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6054259; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6076674; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6306218; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6333357; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6358045; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6504359; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6591986; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6681618; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6791303; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6895099; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7047601; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7091641; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7208911; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7231960; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7309206; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7379164; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7430536; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7483618; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7533836; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8041754; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8998184; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9001438; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9001685; code bytes = 80302b:T403,"rundll32.exe" called "GetTickCount" with parameters (UID: 00000000-00005972) "rundll32.exe" called "GetTickCount" with parameters (UID: 00000000-00003964) "rundll32.exe" called "GetTickCount" with parameters (UID: 00000000-00008172) "rundll32.exe" called "GetTickCount" with parameters (UID: 00000000-00006724) "rundll32.exe" called "GetTickCount" with parameters (UID: 00000000-00004864) "rundll32.exe" called "GetTickCount" with parameters (UID: 00000000-00007452) "rundll32.exe" called "GetTickCount" with parameters (UID: 00000000-00002440) "rundll32.exe" called "GetTickCount" with parameters (UID: 00000000-00001380) "rundll32.exe" called "GetTickCount" with parameters (UID: 00000000-00007592) "rundll32.exe" called "GetTickCount" with parameters (UID: 00000000-00006904) "rundll32.exe" called "GetTickCount" with parameters (UID: 00000000-00001176) "rundll32.exe" called "GetTickCount" with parameters (UID: 00000000-00006060) "powershell.exe" called "GetTickCount" with parameters (UID: 00000000-00004404)2c:T3db6,"rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005972) "rundll32.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005972) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003964) "rundll32.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003964) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008172) "rundll32.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008172) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006724) "rundll32.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006724) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004864) "rundll32.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004864) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007452) "rundll32.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007452) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002440) "rundll32.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002440) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001380) "rundll32.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001380) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007592) "rundll32.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007592) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006904) "rundll32.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006904) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001176) "rundll32.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001176) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006060) "rundll32.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006060) "rundll32.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006060)2d:T5dd,"powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS\27748148BBE67A43CDBFEC6C3784862CE134E6EA"; Key: "BLOB") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\043E4AD5D7CD1251BED7D5DEB038CDA7ED1481B7"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB")2e:T4ce7,"rundll32.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005972) "rundll32.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005972) "rundll32.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005972) "rundll32.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00005972) "rundll32.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00005972) "rundll32.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00005972) "rundll32.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00005972) "rundll32.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003964) "rundll32.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003964) "rundll32.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003964) "rundll32.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00003964) "rundll32.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00003964) "rundll32.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00003964) "rundll32.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00003964) "rundll32.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00008172) "rundll32.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00008172) "rundll32.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00008172) "rundll32.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00008172) "rundll32.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00008172) "rundll32.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00008172) "rundll32.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00008172) "rundll32.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006724) "rundll32.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00006724) "rundll32.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00006724) "rundll32.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00006724) "rundll32.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00006724) "rundll32.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00006724) "rundll32.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00006724) "rundll32.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004864) "rundll32.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004864) "rundll32.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004864) "rundll32.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00004864) "rundll32.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00004864) "rundll32.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00004864) "rundll32.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00004864) "rundll32.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007452) "rundll32.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00007452) "rundll32.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00007452) "rundll32.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00007452) "rundll32.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00007452) "rundll32.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00007452) "rundll32.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00007452) "rundll32.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002440) "rundll32.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00002440) "rundll32.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002440) "rundll32.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00002440) "rundll32.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00002440) "rundll32.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00002440) "rundll32.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00002440) "rundll32.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001380) "rundll32.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00001380) "rundll32.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001380) "rundll32.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00001380) "rundll32.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00001380) "rundll32.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00001380) "rundll32.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00001380) "rundll32.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007592) "rundll32.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00007592) "rundll32.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00007592) "rundll32.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00007592) "rundll32.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00007592) "rundll32.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00007592) "rundll32.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00007592) "rundll32.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006904) "rundll32.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00006904) "rundll32.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00006904) "rundll32.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00006904) "rundll32.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00006904) "rundll32.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00006904) "rundll32.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00006904) "rundll32.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001176) "rundll32.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00001176) "rundll32.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001176) "rundll32.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00001176) "rundll32.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00001176) "rundll32.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00001176) "rundll32.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00001176) "rundll32.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006060) "rundll32.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00006060) "rundll32.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00006060) "rundll32.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00006060) "rundll32.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00006060) "rundll32.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00006060) "rundll32.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00006060) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004404) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004404) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004404) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00004404) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00004404) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00004404) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00004404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00004404) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004404) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00004404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00004404) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00004404) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00004404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00004404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00004404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00004404) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004404) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00004404) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00004404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00004404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00004404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00004404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00004404) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00004404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00004404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00004404) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00004404) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00004404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00004404) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004404) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004404) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004404) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00004404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00004404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00004404) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00004404) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00004404) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00004404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00004404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00004404) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00004404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00004404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00004404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00004404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00004404) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00004404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00004404) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00004404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00004404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00004404) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00004404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00004404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00004404) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00004404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00004404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00004404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00004404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00004404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00004404) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00004404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00004404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00004404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00004404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00004404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00004404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00004404) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00004404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00004404) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00004404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00004404) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00004404) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00004404) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00004404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00004404) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00004404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00004404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00004404) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00004404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\d922445a828b30938c72d375a3b34a60\Microsoft.PowerShell.Commands (UID: 00000000-00004404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\120a0532577f871c2415502d9edacdd6\System.Configuration.Install. (UID: 00000000-00004404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00004404) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00004404)2f:T150ad,"rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005972) "rundll32.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005972) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005972) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005972) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005972) "rundll32.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005972) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00005972) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00005972) "rundll32.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005972) "rundll32.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00005972) "rundll32.exe" called "GetProcAddress" with a parameter AddVectoredContinueHandler (UID: 00000000-00005972) "rundll32.exe" called "GetProcAddress" with a parameter LoadLibraryExA (UID: 00000000-00005972) "rundll32.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00005972) "rundll32.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00005972) "rundll32.exe" called "GetProcAddress" with a parameter NtWaitForSingleObject (UID: 00000000-00005972) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetCurrentPeb (UID: 00000000-00005972) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetNtVersionNumbers (UID: 00000000-00005972) "rundll32.exe" called "GetProcAddress" with a parameter timeBeginPeriod (UID: 00000000-00005972) "rundll32.exe" called "GetProcAddress" with a parameter timeEndPeriod (UID: 00000000-00005972) "rundll32.exe" called "GetProcAddress" with a parameter WSAGetOverlappedResult (UID: 00000000-00005972) "rundll32.exe" called "GetProcAddress" with a parameter wine_get_version (UID: 00000000-00005972) "rundll32.exe" called "GetProcAddress" with a parameter PowerRegisterSuspendResumeNotification (UID: 00000000-00005972) "rundll32.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00005972) "rundll32.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00005972) "rundll32.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00005972) "rundll32.exe" called "GetProcAddress" with a parameter SetFileCompletionNotificationModes (UID: 00000000-00005972) "rundll32.exe" called "GetProcAddress" with a parameter WSAEnumProtocolsW (UID: 00000000-00005972) "rundll32.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00005972) "rundll32.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00005972) "rundll32.exe" called "GetProcAddress" with a parameter GetCommandLineW (UID: 00000000-00005972) "rundll32.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00005972) "rundll32.exe" called "GetProcAddress" with a parameter SetHandleInformation (UID: 00000000-00005972) "rundll32.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00005972) "rundll32.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00005972) "rundll32.exe" called "GetProcAddress" with a parameter GetDesktopWindow (UID: 00000000-00005972) "rundll32.exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00005972) "rundll32.exe" called "GetProcAddress" with a parameter GetMonitorInfoW (UID: 00000000-00005972) "rundll32.exe" called "GetProcAddress" with a parameter EnumDisplaySettingsW (UID: 00000000-00005972) "rundll32.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00005972) "rundll32.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00005972) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003964) "rundll32.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003964) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003964) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003964) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00003964) "rundll32.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003964) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00003964) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00003964) "rundll32.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003964) "rundll32.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00003964) "rundll32.exe" called "GetProcAddress" with a parameter AddVectoredContinueHandler (UID: 00000000-00003964) "rundll32.exe" called "GetProcAddress" with a parameter LoadLibraryExA (UID: 00000000-00003964) "rundll32.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00003964) "rundll32.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00003964) "rundll32.exe" called "GetProcAddress" with a parameter NtWaitForSingleObject (UID: 00000000-00003964) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetCurrentPeb (UID: 00000000-00003964) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetNtVersionNumbers (UID: 00000000-00003964) "rundll32.exe" called "GetProcAddress" with a parameter timeBeginPeriod (UID: 00000000-00003964) "rundll32.exe" called "GetProcAddress" with a parameter timeEndPeriod (UID: 00000000-00003964) "rundll32.exe" called "GetProcAddress" with a parameter WSAGetOverlappedResult (UID: 00000000-00003964) "rundll32.exe" called "GetProcAddress" with a parameter wine_get_version (UID: 00000000-00003964) "rundll32.exe" called "GetProcAddress" with a parameter PowerRegisterSuspendResumeNotification (UID: 00000000-00003964) "rundll32.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00003964) "rundll32.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00003964) "rundll32.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00003964) "rundll32.exe" called "GetProcAddress" with a parameter SetFileCompletionNotificationModes (UID: 00000000-00003964) "rundll32.exe" called "GetProcAddress" with a parameter WSAEnumProtocolsW (UID: 00000000-00003964) "rundll32.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00003964) "rundll32.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00003964) "rundll32.exe" called "GetProcAddress" with a parameter GetCommandLineW (UID: 00000000-00003964) "rundll32.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00003964) "rundll32.exe" called "GetProcAddress" with a parameter SetHandleInformation (UID: 00000000-00003964) "rundll32.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00003964) "rundll32.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00003964) "rundll32.exe" called "GetProcAddress" with a parameter GetDesktopWindow (UID: 00000000-00003964) "rundll32.exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00003964) "rundll32.exe" called "GetProcAddress" with a parameter GetMonitorInfoW (UID: 00000000-00003964) "rundll32.exe" called "GetProcAddress" with a parameter EnumDisplaySettingsW (UID: 00000000-00003964) "rundll32.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00003964) "rundll32.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00003964) "rundll32.exe" called "GetProcAddress" with a parameter CreateDirectoryW (UID: 00000000-00003964) "rundll32.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00003964) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00008172) "rundll32.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00008172) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00008172) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00008172) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00008172) "rundll32.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00008172) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00008172) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00008172) "rundll32.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00008172) "rundll32.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00008172) "rundll32.exe" called "GetProcAddress" with a parameter AddVectoredContinueHandler (UID: 00000000-00008172) "rundll32.exe" called "GetProcAddress" with a parameter LoadLibraryExA (UID: 00000000-00008172) "rundll32.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00008172) "rundll32.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00008172) "rundll32.exe" called "GetProcAddress" with a parameter NtWaitForSingleObject (UID: 00000000-00008172) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetCurrentPeb (UID: 00000000-00008172) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetNtVersionNumbers (UID: 00000000-00008172) "rundll32.exe" called "GetProcAddress" with a parameter timeBeginPeriod (UID: 00000000-00008172) "rundll32.exe" called "GetProcAddress" with a parameter timeEndPeriod (UID: 00000000-00008172) "rundll32.exe" called "GetProcAddress" with a parameter WSAGetOverlappedResult (UID: 00000000-00008172) "rundll32.exe" called "GetProcAddress" with a parameter wine_get_version (UID: 00000000-00008172) "rundll32.exe" called "GetProcAddress" with a parameter PowerRegisterSuspendResumeNotification (UID: 00000000-00008172) "rundll32.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00008172) "rundll32.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00008172) "rundll32.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00008172) "rundll32.exe" called "GetProcAddress" with a parameter SetFileCompletionNotificationModes (UID: 00000000-00008172) "rundll32.exe" called "GetProcAddress" with a parameter WSAEnumProtocolsW (UID: 00000000-00008172) "rundll32.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00008172) "rundll32.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00008172) "rundll32.exe" called "GetProcAddress" with a parameter GetCommandLineW (UID: 00000000-00008172) "rundll32.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00008172) "rundll32.exe" called "GetProcAddress" with a parameter SetHandleInformation (UID: 00000000-00008172) "rundll32.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00008172) "rundll32.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00008172) "rundll32.exe" called "GetProcAddress" with a parameter GetDesktopWindow (UID: 00000000-00008172) "rundll32.exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00008172) "rundll32.exe" called "GetProcAddress" with a parameter GetMonitorInfoW (UID: 00000000-00008172) "rundll32.exe" called "GetProcAddress" with a parameter EnumDisplaySettingsW (UID: 00000000-00008172) "rundll32.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00008172) "rundll32.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00008172) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006724) "rundll32.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006724) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006724) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006724) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006724) "rundll32.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006724) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00006724) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00006724) "rundll32.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006724) "rundll32.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00006724) "rundll32.exe" called "GetProcAddress" with a parameter AddVectoredContinueHandler (UID: 00000000-00006724) "rundll32.exe" called "GetProcAddress" with a parameter LoadLibraryExA (UID: 00000000-00006724) "rundll32.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00006724) "rundll32.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00006724) "rundll32.exe" called "GetProcAddress" with a parameter NtWaitForSingleObject (UID: 00000000-00006724) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetCurrentPeb (UID: 00000000-00006724) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetNtVersionNumbers (UID: 00000000-00006724) "rundll32.exe" called "GetProcAddress" with a parameter timeBeginPeriod (UID: 00000000-00006724) "rundll32.exe" called "GetProcAddress" with a parameter timeEndPeriod (UID: 00000000-00006724) "rundll32.exe" called "GetProcAddress" with a parameter WSAGetOverlappedResult (UID: 00000000-00006724) "rundll32.exe" called "GetProcAddress" with a parameter wine_get_version (UID: 00000000-00006724) "rundll32.exe" called "GetProcAddress" with a parameter PowerRegisterSuspendResumeNotification (UID: 00000000-00006724) "rundll32.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00006724) "rundll32.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00006724) "rundll32.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00006724) "rundll32.exe" called "GetProcAddress" with a parameter SetFileCompletionNotificationModes (UID: 00000000-00006724) "rundll32.exe" called "GetProcAddress" with a parameter WSAEnumProtocolsW (UID: 00000000-00006724) "rundll32.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00006724) "rundll32.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00006724) "rundll32.exe" called "GetProcAddress" with a parameter GetCommandLineW (UID: 00000000-00006724) "rundll32.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00006724) "rundll32.exe" called "GetProcAddress" with a parameter SetHandleInformation (UID: 00000000-00006724) "rundll32.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00006724) "rundll32.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00006724) "rundll32.exe" called "GetProcAddress" with a parameter GetDesktopWindow (UID: 00000000-00006724) "rundll32.exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00006724) "rundll32.exe" called "GetProcAddress" with a parameter GetMonitorInfoW (UID: 00000000-00006724) "rundll32.exe" called "GetProcAddress" with a parameter EnumDisplaySettingsW (UID: 00000000-00006724) "rundll32.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00006724) "rundll32.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00006724) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004864) "rundll32.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004864) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004864) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004864) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004864) "rundll32.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004864) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00004864) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00004864) "rundll32.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004864) "rundll32.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00004864) "rundll32.exe" called "GetProcAddress" with a parameter AddVectoredContinueHandler (UID: 00000000-00004864) "rundll32.exe" called "GetProcAddress" with a parameter LoadLibraryExA (UID: 00000000-00004864) "rundll32.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00004864) "rundll32.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00004864) "rundll32.exe" called "GetProcAddress" with a parameter NtWaitForSingleObject (UID: 00000000-00004864) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetCurrentPeb (UID: 00000000-00004864) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetNtVersionNumbers (UID: 00000000-00004864) "rundll32.exe" called "GetProcAddress" with a parameter timeBeginPeriod (UID: 00000000-00004864) "rundll32.exe" called "GetProcAddress" with a parameter timeEndPeriod (UID: 00000000-00004864) "rundll32.exe" called "GetProcAddress" with a parameter WSAGetOverlappedResult (UID: 00000000-00004864) "rundll32.exe" called "GetProcAddress" with a parameter wine_get_version (UID: 00000000-00004864) "rundll32.exe" called "GetProcAddress" with a parameter PowerRegisterSuspendResumeNotification (UID: 00000000-00004864) "rundll32.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00004864) "rundll32.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00004864) "rundll32.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00004864) "rundll32.exe" called "GetProcAddress" with a parameter SetFileCompletionNotificationModes (UID: 00000000-00004864) "rundll32.exe" called "GetProcAddress" with a parameter WSAEnumProtocolsW (UID: 00000000-00004864) "rundll32.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00004864) "rundll32.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00004864) "rundll32.exe" called "GetProcAddress" with a parameter GetCommandLineW (UID: 00000000-00004864) "rundll32.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00004864) "rundll32.exe" called "GetProcAddress" with a parameter SetHandleInformation (UID: 00000000-00004864) "rundll32.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00004864) "rundll32.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00004864) "rundll32.exe" called "GetProcAddress" with a parameter GetDesktopWindow (UID: 00000000-00004864) "rundll32.exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00004864) "rundll32.exe" called "GetProcAddress" with a parameter GetMonitorInfoW (UID: 00000000-00004864) "rundll32.exe" called "GetProcAddress" with a parameter EnumDisplaySettingsW (UID: 00000000-00004864) "rundll32.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00004864) "rundll32.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00004864) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007452) "rundll32.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007452) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007452) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007452) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007452) "rundll32.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007452) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00007452) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007452) "rundll32.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007452) "rundll32.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00007452) "rundll32.exe" called "GetProcAddress" with a parameter AddVectoredContinueHandler (UID: 00000000-00007452) "rundll32.exe" called "GetProcAddress" with a parameter LoadLibraryExA (UID: 00000000-00007452) "rundll32.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00007452) "rundll32.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00007452) "rundll32.exe" called "GetProcAddress" with a parameter NtWaitForSingleObject (UID: 00000000-00007452) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetCurrentPeb (UID: 00000000-00007452) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetNtVersionNumbers (UID: 00000000-00007452) "rundll32.exe" called "GetProcAddress" with a parameter timeBeginPeriod (UID: 00000000-00007452) "rundll32.exe" called "GetProcAddress" with a parameter timeEndPeriod (UID: 00000000-00007452) "rundll32.exe" called "GetProcAddress" with a parameter WSAGetOverlappedResult (UID: 00000000-00007452) "rundll32.exe" called "GetProcAddress" with a parameter wine_get_version (UID: 00000000-00007452) "rundll32.exe" called "GetProcAddress" with a parameter PowerRegisterSuspendResumeNotification (UID: 00000000-00007452) "rundll32.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00007452) "rundll32.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00007452) "rundll32.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00007452) "rundll32.exe" called "GetProcAddress" with a parameter SetFileCompletionNotificationModes (UID: 00000000-00007452) "rundll32.exe" called "GetProcAddress" with a parameter WSAEnumProtocolsW (UID: 00000000-00007452) "rundll32.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00007452) "rundll32.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00007452) "rundll32.exe" called "GetProcAddress" with a parameter GetCommandLineW (UID: 00000000-00007452) "rundll32.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00007452) "rundll32.exe" called "GetProcAddress" with a parameter SetHandleInformation (UID: 00000000-00007452) "rundll32.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00007452) "rundll32.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00007452) "rundll32.exe" called "GetProcAddress" with a parameter GetDesktopWindow (UID: 00000000-00007452) "rundll32.exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00007452) "rundll32.exe" called "GetProcAddress" with a parameter GetMonitorInfoW (UID: 00000000-00007452) "rundll32.exe" called "GetProcAddress" with a parameter EnumDisplaySettingsW (UID: 00000000-00007452) "rundll32.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00007452) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002440) "rundll32.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002440) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002440) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002440) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00002440) "rundll32.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00002440) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00002440) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00002440) "rundll32.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002440) "rundll32.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00002440) "rundll32.exe" called "GetProcAddress" with a parameter AddVectoredContinueHandler (UID: 00000000-00002440) "rundll32.exe" called "GetProcAddress" with a parameter LoadLibraryExA (UID: 00000000-00002440) "rundll32.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00002440) "rundll32.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00002440) "rundll32.exe" called "GetProcAddress" with a parameter NtWaitForSingleObject (UID: 00000000-00002440) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetCurrentPeb (UID: 00000000-00002440) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetNtVersionNumbers (UID: 00000000-00002440) "rundll32.exe" called "GetProcAddress" with a parameter timeBeginPeriod (UID: 00000000-00002440) "rundll32.exe" called "GetProcAddress" with a parameter timeEndPeriod (UID: 00000000-00002440) "rundll32.exe" called "GetProcAddress" with a parameter WSAGetOverlappedResult (UID: 00000000-00002440) "rundll32.exe" called "GetProcAddress" with a parameter wine_get_version (UID: 00000000-00002440) "rundll32.exe" called "GetProcAddress" with a parameter PowerRegisterSuspendResumeNotification (UID: 00000000-00002440) "rundll32.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00002440) "rundll32.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00002440) "rundll32.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00002440) "rundll32.exe" called "GetProcAddress" with a parameter SetFileCompletionNotificationModes (UID: 00000000-00002440) "rundll32.exe" called "GetProcAddress" with a parameter WSAEnumProtocolsW (UID: 00000000-00002440) "rundll32.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00002440) "rundll32.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00002440) "rundll32.exe" called "GetProcAddress" with a parameter GetCommandLineW (UID: 00000000-00002440) "rundll32.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00002440) "rundll32.exe" called "GetProcAddress" with a parameter SetHandleInformation (UID: 00000000-00002440) "rundll32.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00002440) "rundll32.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00002440) "rundll32.exe" called "GetProcAddress" with a parameter GetDesktopWindow (UID: 00000000-00002440) "rundll32.exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00002440) "rundll32.exe" called "GetProcAddress" with a parameter GetMonitorInfoW (UID: 00000000-00002440) "rundll32.exe" called "GetProcAddress" with a parameter EnumDisplaySettingsW (UID: 00000000-00002440) "rundll32.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00002440) "rundll32.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00002440) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001380) "rundll32.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001380) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001380) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001380) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00001380) "rundll32.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00001380) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00001380) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00001380) "rundll32.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001380) "rundll32.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00001380) "rundll32.exe" called "GetProcAddress" with a parameter AddVectoredContinueHandler (UID: 00000000-00001380) "rundll32.exe" called "GetProcAddress" with a parameter LoadLibraryExA (UID: 00000000-00001380) "rundll32.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00001380) "rundll32.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00001380) "rundll32.exe" called "GetProcAddress" with a parameter NtWaitForSingleObject (UID: 00000000-00001380) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetCurrentPeb (UID: 00000000-00001380) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetNtVersionNumbers (UID: 00000000-00001380) "rundll32.exe" called "GetProcAddress" with a parameter timeBeginPeriod (UID: 00000000-00001380) "rundll32.exe" called "GetProcAddress" with a parameter timeEndPeriod (UID: 00000000-00001380) "rundll32.exe" called "GetProcAddress" with a parameter WSAGetOverlappedResult (UID: 00000000-00001380) "rundll32.exe" called "GetProcAddress" with a parameter wine_get_version (UID: 00000000-00001380) "rundll32.exe" called "GetProcAddress" with a parameter PowerRegisterSuspendResumeNotification (UID: 00000000-00001380) "rundll32.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00001380) "rundll32.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00001380) "rundll32.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00001380) "rundll32.exe" called "GetProcAddress" with a parameter SetFileCompletionNotificationModes (UID: 00000000-00001380) "rundll32.exe" called "GetProcAddress" with a parameter WSAEnumProtocolsW (UID: 00000000-00001380) "rundll32.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00001380) "rundll32.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00001380) "rundll32.exe" called "GetProcAddress" with a parameter GetCommandLineW (UID: 00000000-00001380) "rundll32.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00001380) "rundll32.exe" called "GetProcAddress" with a parameter SetHandleInformation (UID: 00000000-00001380) "rundll32.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00001380) "rundll32.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00001380) "rundll32.exe" called "GetProcAddress" with a parameter GetDesktopWindow (UID: 00000000-00001380) "rundll32.exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00001380) "rundll32.exe" called "GetProcAddress" with a parameter GetMonitorInfoW (UID: 00000000-00001380) "rundll32.exe" called "GetProcAddress" with a parameter EnumDisplaySettingsW (UID: 00000000-00001380) "rundll32.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00001380) "rundll32.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00001380) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007592) "rundll32.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007592) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007592) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007592) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007592) "rundll32.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007592) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00007592) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007592) "rundll32.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007592) "rundll32.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00007592) "rundll32.exe" called "GetProcAddress" with a parameter AddVectoredContinueHandler (UID: 00000000-00007592) "rundll32.exe" called "GetProcAddress" with a parameter LoadLibraryExA (UID: 00000000-00007592) "rundll32.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00007592) "rundll32.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00007592) "rundll32.exe" called "GetProcAddress" with a parameter NtWaitForSingleObject (UID: 00000000-00007592) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetCurrentPeb (UID: 00000000-00007592) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetNtVersionNumbers (UID: 00000000-00007592) "rundll32.exe" called "GetProcAddress" with a parameter timeBeginPeriod (UID: 00000000-00007592) "rundll32.exe" called "GetProcAddress" with a parameter timeEndPeriod (UID: 00000000-00007592) "rundll32.exe" called "GetProcAddress" with a parameter WSAGetOverlappedResult (UID: 00000000-00007592) "rundll32.exe" called "GetProcAddress" with a parameter wine_get_version (UID: 00000000-00007592) "rundll32.exe" called "GetProcAddress" with a parameter PowerRegisterSuspendResumeNotification (UID: 00000000-00007592) "rundll32.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00007592) "rundll32.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00007592) "rundll32.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00007592) "rundll32.exe" called "GetProcAddress" with a parameter SetFileCompletionNotificationModes (UID: 00000000-00007592) "rundll32.exe" called "GetProcAddress" with a parameter WSAEnumProtocolsW (UID: 00000000-00007592) "rundll32.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00007592) "rundll32.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00007592) "rundll32.exe" called "GetProcAddress" with a parameter GetCommandLineW (UID: 00000000-00007592) "rundll32.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00007592) "rundll32.exe" called "GetProcAddress" with a parameter SetHandleInformation (UID: 00000000-00007592) "rundll32.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00007592) "rundll32.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00007592) "rundll32.exe" called "GetProcAddress" with a parameter GetDesktopWindow (UID: 00000000-00007592) "rundll32.exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00007592) "rundll32.exe" called "GetProcAddress" with a parameter GetMonitorInfoW (UID: 00000000-00007592) "rundll32.exe" called "GetProcAddress" with a parameter EnumDisplaySettingsW (UID: 00000000-00007592) "rundll32.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00007592) "rundll32.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00007592) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006904) "rundll32.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006904) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006904) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006904) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006904) "rundll32.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006904) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00006904) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00006904) "rundll32.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006904) "rundll32.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00006904) "rundll32.exe" called "GetProcAddress" with a parameter AddVectoredContinueHandler (UID: 00000000-00006904) "rundll32.exe" called "GetProcAddress" with a parameter LoadLibraryExA (UID: 00000000-00006904) "rundll32.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00006904) "rundll32.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00006904) "rundll32.exe" called "GetProcAddress" with a parameter NtWaitForSingleObject (UID: 00000000-00006904) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetCurrentPeb (UID: 00000000-00006904) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetNtVersionNumbers (UID: 00000000-00006904) "rundll32.exe" called "GetProcAddress" with a parameter timeBeginPeriod (UID: 00000000-00006904) "rundll32.exe" called "GetProcAddress" with a parameter timeEndPeriod (UID: 00000000-00006904) "rundll32.exe" called "GetProcAddress" with a parameter WSAGetOverlappedResult (UID: 00000000-00006904) "rundll32.exe" called "GetProcAddress" with a parameter wine_get_version (UID: 00000000-00006904) "rundll32.exe" called "GetProcAddress" with a parameter PowerRegisterSuspendResumeNotification (UID: 00000000-00006904) "rundll32.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00006904) "rundll32.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00006904) "rundll32.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00006904) "rundll32.exe" called "GetProcAddress" with a parameter SetFileCompletionNotificationModes (UID: 00000000-00006904) "rundll32.exe" called "GetProcAddress" with a parameter WSAEnumProtocolsW (UID: 00000000-00006904) "rundll32.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00006904) "rundll32.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00006904) "rundll32.exe" called "GetProcAddress" with a parameter GetCommandLineW (UID: 00000000-00006904) "rundll32.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00006904) "rundll32.exe" called "GetProcAddress" with a parameter SetHandleInformation (UID: 00000000-00006904) "rundll32.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00006904) "rundll32.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00006904) "rundll32.exe" called "GetProcAddress" with a parameter GetDesktopWindow (UID: 00000000-00006904) "rundll32.exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00006904) "rundll32.exe" called "GetProcAddress" with a parameter GetMonitorInfoW (UID: 00000000-00006904) "rundll32.exe" called "GetProcAddress" with a parameter EnumDisplaySettingsW (UID: 00000000-00006904) "rundll32.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00006904) "rundll32.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00006904) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001176) "rundll32.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001176) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001176) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001176) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00001176) "rundll32.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00001176) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00001176) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00001176) "rundll32.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001176) "rundll32.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00001176) "rundll32.exe" called "GetProcAddress" with a parameter AddVectoredContinueHandler (UID: 00000000-00001176) "rundll32.exe" called "GetProcAddress" with a parameter LoadLibraryExA (UID: 00000000-00001176) "rundll32.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00001176) "rundll32.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00001176) "rundll32.exe" called "GetProcAddress" with a parameter NtWaitForSingleObject (UID: 00000000-00001176) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetCurrentPeb (UID: 00000000-00001176) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetNtVersionNumbers (UID: 00000000-00001176) "rundll32.exe" called "GetProcAddress" with a parameter timeBeginPeriod (UID: 00000000-00001176) "rundll32.exe" called "GetProcAddress" with a parameter timeEndPeriod (UID: 00000000-00001176) "rundll32.exe" called "GetProcAddress" with a parameter WSAGetOverlappedResult (UID: 00000000-00001176) "rundll32.exe" called "GetProcAddress" with a parameter wine_get_version (UID: 00000000-00001176) "rundll32.exe" called "GetProcAddress" with a parameter PowerRegisterSuspendResumeNotification (UID: 00000000-00001176) "rundll32.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00001176) "rundll32.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00001176) "rundll32.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00001176) "rundll32.exe" called "GetProcAddress" with a parameter SetFileCompletionNotificationModes (UID: 00000000-00001176) "rundll32.exe" called "GetProcAddress" with a parameter WSAEnumProtocolsW (UID: 00000000-00001176) "rundll32.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00001176) "rundll32.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00001176) "rundll32.exe" called "GetProcAddress" with a parameter GetCommandLineW (UID: 00000000-00001176) "rundll32.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00001176) "rundll32.exe" called "GetProcAddress" with a parameter SetHandleInformation (UID: 00000000-00001176) "rundll32.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00001176) "rundll32.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00001176) "rundll32.exe" called "GetProcAddress" with a parameter GetDesktopWindow (UID: 00000000-00001176) "rundll32.exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00001176) "rundll32.exe" called "GetProcAddress" with a parameter GetMonitorInfoW (UID: 00000000-00001176) "rundll32.exe" called "GetProcAddress" with a parameter EnumDisplaySettingsW (UID: 00000000-00001176) "rundll32.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00001176) "rundll32.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00001176) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006060) "rundll32.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006060) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006060) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006060) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006060) "rundll32.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006060) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00006060) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00006060) "rundll32.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006060) "rundll32.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00006060) "rundll32.exe" called "GetProcAddress" with a parameter AddVectoredContinueHandler (UID: 00000000-00006060) "rundll32.exe" called "GetProcAddress" with a parameter LoadLibraryExA (UID: 00000000-00006060) "rundll32.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00006060) "rundll32.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00006060) "rundll32.exe" called "GetProcAddress" with a parameter NtWaitForSingleObject (UID: 00000000-00006060) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetCurrentPeb (UID: 00000000-00006060) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetNtVersionNumbers (UID: 00000000-00006060) "rundll32.exe" called "GetProcAddress" with a parameter timeBeginPeriod (UID: 00000000-00006060) "rundll32.exe" called "GetProcAddress" with a parameter timeEndPeriod (UID: 00000000-00006060) "rundll32.exe" called "GetProcAddress" with a parameter WSAGetOverlappedResult (UID: 00000000-00006060) "rundll32.exe" called "GetProcAddress" with a parameter wine_get_version (UID: 00000000-00006060) "rundll32.exe" called "GetProcAddress" with a parameter PowerRegisterSuspendResumeNotification (UID: 00000000-00006060) "rundll32.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00006060) "rundll32.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00006060) "rundll32.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00006060) "rundll32.exe" called "GetProcAddress" with a parameter SetFileCompletionNotificationModes (UID: 00000000-00006060) "rundll32.exe" called "GetProcAddress" with a parameter WSAEnumProtocolsW (UID: 00000000-00006060) "rundll32.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00006060) "rundll32.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00006060) "rundll32.exe" called "GetProcAddress" with a parameter GetCommandLineW (UID: 00000000-00006060) "rundll32.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00006060) "rundll32.exe" called "GetProcAddress" with a parameter SetHandleInformation (UID: 00000000-00006060) "rundll32.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00006060) "rundll32.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00006060) "rundll32.exe" called "GetProcAddress" with a parameter GetDesktopWindow (UID: 00000000-00006060) "rundll32.exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00006060) "rundll32.exe" called "GetProcAddress" with a parameter GetMonitorInfoW (UID: 00000000-00006060) "rundll32.exe" called "GetProcAddress" with a parameter EnumDisplaySettingsW (UID: 00000000-00006060) "rundll32.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00006060) "rundll32.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00006060) "rundll32.exe" called "GetProcAddress" with a parameter CreatePipe (UID: 00000000-00006060) "rundll32.exe" called "GetProcAddress" with a parameter CreateProcessW (UID: 00000000-00006060) "rundll32.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00006060) "rundll32.exe" called "GetProcAddress" with a parameter CancelIoEx (UID: 00000000-00006060) "rundll32.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00006060) "rundll32.exe" called "GetProcAddress" with a parameter CreateDirectoryW (UID: 00000000-00006060) "rundll32.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00006060) "rundll32.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00006060) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx_RetAddr (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObjectInternal (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter RtlVirtualUnwind (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter SysStringByteLen (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateStringReference (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter SetWaitableTimerEx (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter EventActivityIdControl (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSize (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfo (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValue (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageName (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageNameW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributes (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter EnumWindows (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter EnumWindowsW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessIdW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetWindow (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter IsWindowVisible (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter IsWindowVisibleW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter WTGetSignatureInfo (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter WerSetFlags (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguagesW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguagesW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleNameW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCP (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCPW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontEx (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontExW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleModeW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfo (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfoW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleMode (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleModeW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateContextProperty (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContextW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateData (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateDataW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChain (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChainW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChain (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChainW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrust (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrustW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContextW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformationW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenExW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembershipW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitle (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitleW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain_RetAddr (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry_RetAddr (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry_RetAddr (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitle (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitleW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariable (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariableW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimes (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimesW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipe (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipeW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter ConnectNamedPipe (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStrings (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStringsW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKey (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyEx (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameEx (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter EnumCalendarInfoExEx (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetCalendarInfoEx (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter EnumTimeFormatsEx (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSource (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSourceW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter DeregisterEventSource (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter ReportEvent (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter ReportEventW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetLogicalDrives (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetDriveType (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetDriveTypeW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformation (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformationW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPath (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPathW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectory (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetTempPath (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter DeleteFile (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguage (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguageW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter AmsiOpenSession (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter AmsiScanBuffer (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter MpManagerOpen (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter MpHandleClose (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter MpFreeMemory (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter MpScanStart (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter MpMemoryScanStart (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter MpScanResult (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter MpThreatOpen (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter MpThreatEnumerate (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter MpConfigOpen (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter MpConfigGetValue (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter MpConfigGetValueAlloc (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter MpConfigClose (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter MpFastMemoryScanOpen (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter MpFastMemoryScan (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryInitialize (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryUninitialize (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryAddToAverageDWORD (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiScan (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiCloseSession (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter MpConfigRegisterForNotifications (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter MpConfigUnregisterNotifications (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter MpClientUtilExportFunctions (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter MpManagerVersionQuery (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter UnregisterGPNotification (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter RoGetParameterizedTypeInstanceIID (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFile (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter FindNextFile (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter QueryUnbiasedInterruptTime (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter AmsiCloseSession (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter FormatMessage (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter SetFileAttributes (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter SetFileAttributesW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileName (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter AmsiUninitialize (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess_RetAddr (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00004404) "powershell.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00004404)30:T62f,"6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15ee1ca" contains export function called "_cgo_dummy_export" at ordinal 1 "6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15ee1ca" contains export function called "authorizerTrampoline" at ordinal 2 "6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15ee1ca" contains export function called "callbackTrampoline" at ordinal 3 "6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15ee1ca" contains export function called "commitHookTrampoline" at ordinal 4 "6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15ee1ca" contains export function called "compareTrampoline" at ordinal 5 "6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15ee1ca" contains export function called "doneTrampoline" at ordinal 6 "6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15ee1ca" contains export function called "oci" at ordinal 7 "6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15ee1ca" contains export function called "preUpdateHookTrampoline" at ordinal 8 "6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15ee1ca" contains export function called "rollbackHookTrampoline" at ordinal 9 "6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15ee1ca" contains export function called "stepTrampoline" at ordinal 10 "6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15ee1ca" contains export function called "updateHookTrampoline" at ordinal 11 "6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15ee1ca" contains export function called "we" at ordinal 1231:T5c4,"\REGISTRY\MACHINE\SOFTWARE\Classes" in Source: 00000000-00003964.00000000.118869.04D4C000.00000020.mdmp "\Registry\Machine\Software\Classes\" in Source: 00000000-00003964.00000000.118869.04D4C000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00004404.00000000.120491.6C02A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00004404.00000000.120491.6C02A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00004404.00000000.120491.6C02A000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00004404.00000000.120491.6C02A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00004404.00000000.120491.6C02A000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00004404.00000000.120491.6C02A000.00000002.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00004404.00000000.120491.C1E00000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00004404.00000000.120491.C1E00000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00004404.00000000.120491.DBFC0000.00000004.mdmp32:T6d9,Process "rundll32.exe" with commandline ""C:\\6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15ee1ca.dll",#1" (UID: 00000000-00005972) Process "rundll32.exe" with commandline ""C:\\6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15ee1ca.dll",#2" (UID: 00000000-00003964) Process "rundll32.exe" with commandline ""C:\\6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15ee1ca.dll",#4" (UID: 00000000-00008172) Process "rundll32.exe" with commandline ""C:\\6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15ee1ca.dll",#3" (UID: 00000000-00006724) Process "rundll32.exe" with commandline ""C:\\6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15ee1ca.dll",#5" (UID: 00000000-00004864) Process "rundll32.exe" with commandline ""C:\\6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15ee1ca.dll",#6" (UID: 00000000-00007452) Process "rundll32.exe" with commandline ""C:\\6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15ee1ca.dll",#7" (UID: 00000000-00002440) Process "rundll32.exe" with commandline ""C:\\6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15ee1ca.dll",#8" (UID: 00000000-00001380) Process "rundll32.exe" with commandline ""C:\\6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15ee1ca.dll",#9" (UID: 00000000-00007592) Process "rundll32.exe" with commandline ""C:\\6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15ee1ca.dll",#10" (UID: 00000000-00006904) Process "rundll32.exe" with commandline ""C:\\6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15ee1ca.dll",#11" (UID: 00000000-00001176) Process "rundll32.exe" with commandline ""C:\\6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15ee1ca.dll",#12" (UID: 00000000-00006060)33:Tc49,"powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135]34:T681,"\REGISTRY\MACHINE\SOFTWARE\Classes" in Source: 00000000-00003964.00000000.118869.04D4C000.00000020.mdmp "\Registry\Machine\Software\Classes\" in Source: 00000000-00003964.00000000.118869.04D4C000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00004404.00000000.120491.6C02A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00004404.00000000.120491.6C02A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00004404.00000000.120491.6C02A000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00004404.00000000.120491.6C02A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00004404.00000000.120491.6C02A000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00004404.00000000.120491.6C02A000.00000002.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00004404.00000000.120491.C1E00000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00004404.00000000.120491.C1E00000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00004404.00000000.120491.DBFC0000.00000004.mdmp "Y\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00006060.00000001.120179.22830000.00000004.mdmp35:T21b8,"rundll32.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7fff1f3c0000 "rundll32.exe" loaded module "C:\6C35A48CEDB38A3E2C8D001A6D79F571BF0A70DDEC99761AA4D3DE2AD15EE1CA.DLL" at base 7fff043b0000 "rundll32.exe" loaded module "KERNEL32.DLL" at base 7fff34e70000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7fff31120000 "rundll32.exe" loaded module "ADVAPI32.DLL" at base 26e700c0000 "rundll32.exe" loaded module "NTDLL.DLL" at base 7fff36790000 "rundll32.exe" loaded module "WINMM.DLL" at base 7fff2a0b0000 "rundll32.exe" loaded module "EXT-MS-WIN-KERNEL32-ERRORHANDLING-L1-1-0.DLL" at base 7fff34e70000 "rundll32.exe" loaded module "WS2_32.DLL" at base 7fff33e50000 "rundll32.exe" loaded module "POWRPROF.DLL" at base 7fff32b00000 "rundll32.exe" loaded module "USER32.DLL" at base 7fff34560000 "rundll32.exe" loaded module "ADVAPI32.DLL" at base 1c491890000 "rundll32.exe" loaded module "ADVAPI32.DLL" at base 181e7420000 "rundll32.exe" loaded module "ADVAPI32.DLL" at base 18d16250000 "rundll32.exe" loaded module "ADVAPI32.DLL" at base 2074d4f0000 "rundll32.exe" loaded module "ADVAPI32.DLL" at base 19234160000 "rundll32.exe" loaded module "ADVAPI32.DLL" at base 163904b0000 "rundll32.exe" loaded module "ADVAPI32.DLL" at base 12e78500000 "rundll32.exe" loaded module "ADVAPI32.DLL" at base 2760b140000 "rundll32.exe" loaded module "ADVAPI32.DLL" at base 18a539b0000 "rundll32.exe" loaded module "ADVAPI32.DLL" at base 1e7da4e0000 "rundll32.exe" loaded module "ADVAPI32.DLL" at base 2d5244a0000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7fff1f3c0000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 7fff33cd0000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7fff33410000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7fff33410000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7fff33410000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7fff1ff40000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 7fff33c60000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7fff32b50000 "powershell.exe" loaded module "VERSION.DLL" at base 7fff2a0a0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7fff04ed0000 "powershell.exe" loaded module "USER32.DLL" at base 7fff34560000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7fff33410000 "powershell.exe" loaded module "MSCOREE.DLL" at base 7fff24af0000 "powershell.exe" loaded module "NTDLL" at base 7fff36790000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7fff349e0000 "powershell.exe" loaded module "KERNEL32.DLL" at base 7fff34e70000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\FE2524177EB3088C77BE666722039F52\MSCORLIB.NI.DLL" at base 7fff038d0000 "powershell.exe" loaded module "RPCRT4.DLL" at base 7fff35130000 "powershell.exe" loaded module "OLE32.DLL" at base 7fff34410000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7fff349e0000 "powershell.exe" loaded module "OLEAUT32.DLL" at base 7fff346f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\E43DD9C73AB5615E461BF5109C3FACD6\SYSTEM.NI.DLL" at base 7fff02c60000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\0D59B0E237D7519417DE10CD84BDA4E7\SYSTEM.CORE.NI.DLL" at base 7fff021e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\B5BA37E1558CED178A99011A1D659B52\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 7fff0f560000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7fff31f80000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7fff33be0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAA57FC8CC#\6DA01910C256231D1C50AD0AACEE5941\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 7fff00170000 "powershell.exe" loaded module "COMBASE.DLL" at base 7fff349e0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7fff349e0000 "powershell.exe" loaded module "NTDLL.DLL" at base 7fff36790000 "powershell.exe" loaded module "PSAPI.DLL" at base 1e3c3ad0000 "powershell.exe" loaded module "SHELL32.DLL" at base 7fff35320000 "powershell.exe" loaded module "WINTRUST.DLL" at base 7fff32b90000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 7fff32b90000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7fff33870000 "powershell.exe" loaded module "AMSI.DLL" at base 7fff1cb20000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7fff2a0a0000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7fff1a090000 "powershell.exe" loaded module "CRYPT32.DLL" at base 7fff33870000 "powershell.exe" loaded module "KERNEL32" at base 7fff34e70000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\AFVYHKQK.DLL" at base 7fff13f00000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\7B1F35FB0C2D6955CE5AF2BD372C65F2\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7fff000d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\B221AF81285C1305324612E6DC9C88FF\SYSTEM.MANAGEMENT.NI.DLL" at base 7ffefff60000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\8AD4C0AF5B3D51A0F3A4DAC0D44D85D4\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ffeffdf0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\5EE35DEBFC22F727E70E4479DDCBC045\SYSTEM.XML.NI.DLL" at base 7ffeff540000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.NUMERICS\86CFD69CE1261BAF4740E7606CADE014\SYSTEM.NUMERICS.NI.DLL" at base 7fff1fde0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\7BED49C46DE9295A8453DB205C60A028\SYSTEM.DATA.NI.DLL" at base 7ffefebd0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7ffefe860000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7fff33410000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ffefe710000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\7FF5199E757CB8AF9AD949453F698D09\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7fff1fd70000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\4BEB1EECA20B27D4BD1BB9880F03CC2A\SYSTEM.CONFIGURATION.NI.DLL" at base 7ffefe5d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\604272B0FAEC2E09D53D38E03BC89C6C\SYSTEM.TRANSACTIONS.NI.DLL" at base 7ffefe4f0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7fff11e70000 "powershell.exe" loaded module "SECUR32.DLL" at base 7fff29140000 "powershell.exe" loaded module "SSPICLI.DLL" at base 7fff329e0000 "powershell.exe" loaded module "WLDP.DLL" at base 7fff31b40000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7fff31120000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 7ffefe410000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7fff34e70000 "powershell.exe" loaded module "USERENV.DLL" at base 7fff32a10000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7fff33cd0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 7fff349e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PAE3498D9#\D922445A828B30938C72D375A3B34A60\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 7ffefe1d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFE64A9051#\120A0532577F871C2415502D9EDACDD6\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 7fff17540000 "powershell.exe" loaded module "BCRYPT.DLL" at base 7fff3264000036:Tfd1,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00004404-00000C2E-212360876] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00004404-00000C2B-872744342] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00004404-00000C2B-872787879] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00004404-00000C2B-872857199] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll" [Source: 00000000-00004404-00000C2B-872965017] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00004404-00000C2B-872986398] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00004404-00000C2B-873008541] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00004404-00000C2B-873033053] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll" [Source: 00000000-00004404-00000C2B-873077203] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll" [Source: 00000000-00004404-00000C2B-873104903] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00004404-00000C2B-873327585] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00004404-00000C2B-873428047] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00004404-00000C2B-873472897] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00004404-00000C2B-873565887] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00004404-00000C2B-873567826] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" [Source: 00000000-00004404-00000C2B-873811792] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00004404-00000C2B-873857314] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00004404-00000C2B-873992728] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00004404-00000C2B-874016188] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll" [Source: 00000000-00004404-00000C2B-874051492] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" [Source: 00000000-00004404-00000C2B-874186467] Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00004404-00000C2B-874246181] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" [Source: 00000000-00004404-00000C2B-874412764] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll" [Source: 00000000-00004404-00000C2B-874425134] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" [Source: 00000000-00004404-00000C2B-874476166]37:T7ce,Spawned process "rundll32.exe" with commandline ""C:\\6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15 ..." (UID: 00000000-00003964), Spawned process "rundll32.exe" with commandline ""C:\\6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15 ..." (UID: 00000000-00008172) Spawned process "rundll32.exe" with commandline ""C:\\6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15 ..." (UID: 00000000-00006724), Spawned process "rundll32.exe" with commandline ""C:\\6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15 ..." (UID: 00000000-00004864) Spawned process "rundll32.exe" with commandline ""C:\\6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15 ..." (UID: 00000000-00007452), Spawned process "rundll32.exe" with commandline ""C:\\6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15 ..." (UID: 00000000-00002440) Spawned process "rundll32.exe" with commandline ""C:\\6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15 ..." (UID: 00000000-00001380), Spawned process "rundll32.exe" with commandline ""C:\\6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15 ..." (UID: 00000000-00007592) Spawned process "rundll32.exe" with commandline ""C:\\6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15 ..." (UID: 00000000-00006904), Spawned process "rundll32.exe" with commandline ""C:\\6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15 ..." (UID: 00000000-00001176) Spawned process "rundll32.exe" with commandline ""C:\\6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15 ..." (UID: 00000000-00006060), Spawned process "schtasks.exe" with commandline "schtasks /delete /f /tn "ChromeUpdateTaskMachineUAC"" (UID: 00000000-00004232), Spawned process "schtasks.exe" with commandline "schtasks /delete /f /tn "ChromeUpdateTaskMachineUAC"" (UID: 00000000-00006540), Spawned process "powershell.exe" with commandline "-executionpolicy bypass -File "%USERPROFILE%\\.tmp\\2687540094.p ..." (UID: 00000000-00004404)38:T7ce,Spawned process "rundll32.exe" with commandline ""C:\\6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15 ..." (UID: 00000000-00003964), Spawned process "rundll32.exe" with commandline ""C:\\6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15 ..." (UID: 00000000-00008172) Spawned process "rundll32.exe" with commandline ""C:\\6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15 ..." (UID: 00000000-00006724), Spawned process "rundll32.exe" with commandline ""C:\\6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15 ..." (UID: 00000000-00004864) Spawned process "rundll32.exe" with commandline ""C:\\6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15 ..." (UID: 00000000-00007452), Spawned process "rundll32.exe" with commandline ""C:\\6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15 ..." (UID: 00000000-00002440) Spawned process "rundll32.exe" with commandline ""C:\\6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15 ..." (UID: 00000000-00001380), Spawned process "rundll32.exe" with commandline ""C:\\6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15 ..." (UID: 00000000-00007592) Spawned process "rundll32.exe" with commandline ""C:\\6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15 ..." (UID: 00000000-00006904), Spawned process "rundll32.exe" with commandline ""C:\\6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15 ..." (UID: 00000000-00001176) Spawned process "rundll32.exe" with commandline ""C:\\6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15 ..." (UID: 00000000-00006060), Spawned process "schtasks.exe" with commandline "schtasks /delete /f /tn "ChromeUpdateTaskMachineUAC"" (UID: 00000000-00004232), Spawned process "schtasks.exe" with commandline "schtasks /delete /f /tn "ChromeUpdateTaskMachineUAC"" (UID: 00000000-00006540), Spawned process "powershell.exe" with commandline "-executionpolicy bypass -File "%USERPROFILE%\\.tmp\\2687540094.p ..." (UID: 00000000-00004404)39:T578,The input sample is signed with a certificate issued by "CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB" (SHA1: 32:9B:78:A5:C9:EB:C2:04:32:42:DE:90:CE:1B:7C:6B:1B:A6:C6:92; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Assured ID Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: A9:9D:5B:79:E9:F1:CD:A5:9C:DA:B6:37:31:69:D5:35:3F:58:74:C6; see report for more information) The input sample is signed with a certificate issued by "CN=Sectigo Public Code Signing Root R46, O=Sectigo Limited, C=GB" (SHA1: 0B:C5:E7:67:73:D2:E4:4F:C9:90:3D:4D:FE:FE:45:15:53:BB:EC:4A; see report for more information) The input sample is signed with a certificate issued by "CN=Sectigo Public Code Signing CA R36, O=Sectigo Limited, C=GB" (SHA1: 30:DB:7D:67:80:45:E4:4D:88:2D:76:52:BA:6A:AA:65:93:C0:23:28; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Trusted Root G4, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: B6:C8:AF:83:4D:4E:53:B6:73:C7:68:72:AA:8C:95:0C:7C:54:DF:5F; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA, O="DigiCert Inc.", C=US" (SHA1: 66:F0:2B:32:C2:C2:C9:0F:82:5D:CE:AA:8A:C9:C6:4F:19:9C:CF:40; see report for more information)3a:T66a,"rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\POLICIES\MICROSOFT\CRYPTOGRAPHY\CONFIGURATION"; Key: ""; Value: "")3b:T640,"rundll32.exe" queries basic process information of the "C:\Windows\System32\rundll32.exe" (UID: 5972) "rundll32.exe" queries basic process information of the "C:\Windows\System32\rundll32.exe" (UID: 3964) "rundll32.exe" queries basic process information of the "C:\Windows\System32\rundll32.exe" (UID: 8172) "rundll32.exe" queries basic process information of the "C:\Windows\System32\rundll32.exe" (UID: 6724) "rundll32.exe" queries basic process information of the "C:\Windows\System32\rundll32.exe" (UID: 4864) "rundll32.exe" queries basic process information of the "C:\Windows\System32\rundll32.exe" (UID: 7452) "rundll32.exe" queries basic process information of the "C:\Windows\System32\rundll32.exe" (UID: 2440) "rundll32.exe" queries basic process information of the "C:\Windows\System32\rundll32.exe" (UID: 1380) "rundll32.exe" queries basic process information of the "C:\Windows\System32\rundll32.exe" (UID: 7592) "rundll32.exe" queries basic process information of the "C:\Windows\System32\rundll32.exe" (UID: 6904) "rundll32.exe" queries basic process information of the "C:\Windows\System32\rundll32.exe" (UID: 1176) "rundll32.exe" queries basic process information of the "C:\Windows\System32\rundll32.exe" (UID: 6060) "schtasks.exe" queries basic process information of the "C:\Windows\System32\schtasks.exe" (UID: 4232) "schtasks.exe" queries basic process information of the "C:\Windows\System32\schtasks.exe" (UID: 6540) "powershell.exe" queries basic process information of the "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (UID: 4404)3c:Tef7,"rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "USEFILTER"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "DISABLEHEAPLOOKASIDE"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "FRONTENDHEAPDEBUGOPTIONS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "SHUTDOWNFLAGS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "UNLOADEVENTTRACEDEPTH"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "MAXLOADERTHREADS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "USEIMPERSONATEDDEVICEMAP"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "TRACINGFLAGS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "CFGOPTIONS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "MINIMUMSTACKCOMMITINBYTES"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "BREAKONINITIALIZEPROCESSFAILURE"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "KEEPACTIVATIONCONTEXTSALIVE"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "TRACKACTIVATIONCONTEXTRELEASES"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "MAXDEADACTIVATIONCONTEXTS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "GLOBALFLAG"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "DEBUGPROCESSHEAPONLY"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "SEARCHPATHMODE"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "")3d:T40a,"rundll32.exe" trying to access non-existent file "C:\WTSAPI32.DLL" "rundll32.exe" trying to access non-existent file "C:\Windows\System32\POWERSHELL.EXE" "rundll32.exe" trying to access non-existent file "C:\powershell.exe" "rundll32.exe" trying to access non-existent file "C:\Windows\System\POWERSHELL.EXE" "rundll32.exe" trying to access non-existent file "C:\Windows\POWERSHELL.EXE" "rundll32.exe" trying to access non-existent file "C:\ProgramData\Oracle\Java\javapath_target_114250\POWERSHELL.EXE" "rundll32.exe" trying to access non-existent file "C:\Windows\System32\wbem\POWERSHELL.EXE" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\ATL.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\ATL.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\MSCOREE.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\mscoree.dll"3e:T14b2,Heuristic match: "he.bs" Heuristic match: "gu.tj" Heuristic match: "=k.gp" Heuristic match: "j$.si" Heuristic match: "0].pa" Heuristic match: "r[.rs" Pattern match: "root.go/s/troll/agent/main" Heuristic match: "pathext=.com" Heuristic match: ".vbs;.vbe;.js;.jse;.wsf;.wsh;.ms" Pattern match: "http://www.validationtest.contoso.com/test%d.html" Pattern match: "http://schemas.microsoft.com/smi/2016/windowssettings" Pattern match: "http://go.microsoft.com/fwlink/?linkid=42127" Pattern match: "microsoft.net/framework64/v4.0.30319/" Heuristic match: "em.co" Heuristic match: "t.net" Heuristic match: "ntrust.net" Pattern match: "www.entr@" Pattern match: "http://www.microsoft.com0" Heuristic match: ":\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "40094.ps" Pattern match: "microsoft.net/assembly/gac_64/mscorlib/v4.0_4.0.0.0__b77a5c561934e089/mscorlib.dll" Heuristic match: "15.cat" Heuristic match: "ment.automation.re" Pattern match: "www.digicert.com1$0" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/thawtepca-g3.crl0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "www.digicert.com1" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "http://repository.swisssign.com/0" Pattern match: "0www.entrust.net/cps" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "www.digicert.com1!0" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0a" Pattern match: "www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0" Heuristic match: "c:\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "ystem.configuration.in" Heuristic match: "ype=system.web.pro" Heuristic match: "" - Source: "00000000-00004404.00000000.120491.1A0A2000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00004404.00000000.120491.C1E00000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l" - Source: "00000000-00004404.00000000.120491.C1E00000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czco!yjcq8" - Source: "00000000-00004404.00000000.120491.DBFC0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00004404.00000000.120491.DBFC0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00004404.00000000.120491.DBFC0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00004404.00000000.120491.DBFC0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00004404.00000000.120491.DBFC0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00004404.00000000.120491.DBFC0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00004404.00000000.120491.DBFC0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00004404.00000000.120491.DBFC0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0uz_]microsoft" - Source: "00000000-00004404.00000000.120491.DBFC0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00004404.00000000.120491.DBFC0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3il" - Source: "00000000-00004404.00000000.120491.DBFC0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004404.00000000.120491.DBFC0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00004404.00000000.120491.DBFC0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004404.00000000.120491.DBFC0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0" - Source: "00000000-00004404.00000000.120491.DC610000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004404.00000000.120491.DC610000.00000004.mdmp")40:T8de,"powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00004404) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00004404) "powershell.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00004404) "powershell.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00004404) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00004404) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00004404) "powershell.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00004404) "powershell.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00004404) "powershell.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00004404) "powershell.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00004404) "powershell.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00004404) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\* (UID: 00000000-00004404) "powershell.exe" called "FindNextFileW" with parameter fe2524177eb3088c77be666722039f52 (UID: 00000000-00004404) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\* (UID: 00000000-00004404) "powershell.exe" called "FindNextFileW" with parameter b5ba37e1558ced178a99011a1d659b52 (UID: 00000000-00004404) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\* (UID: 00000000-00004404) "powershell.exe" called "FindNextFileW" with parameter e43dd9c73ab5615e461bf5109c3facd6 (UID: 00000000-00004404) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\* (UID: 00000000-00004404) "powershell.exe" called "FindNextFileW" with parameter 0d59b0e237d7519417de10cd84bda4e7 (UID: 00000000-00004404) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\* (UID: 00000000-00004404)41:T672,Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15ee1ca") Found reference to API "480,7264,3121,,CreateToolhelp32Snapshot,kernel32.dll,"00:31:11.390",RX=0,PX=0" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00001176.00000000.119771.D8850000.00000004.mdmp, 00000000-00001176.00000001.119790.D8850000.00000004.mdmp") Found reference to API "788,6604,3121,,CreateToolhelp32Snapshot,kernel32.dll,"00:31:03.421",RX=0,PX=0" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00002440.00000001.119285.8E9A0000.00000004.mdmp") Found reference to API "846,3280,3121,,CreateToolhelp32Snapshot,kernel32.dll,"00:30:57.640",RX=0,PX=0" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00003964.00000001.118905.8FCD0000.00000004.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00004404.00000000.120491.1A0A2000.00000002.mdmp, 00000000-00004404.00000000.120491.6C02A000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00004404.00000000.120491.1A0A2000.00000002.mdmp, 00000000-00004404.00000000.120491.6C02A000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00004404.00000000.120491.1A0A2000.00000002.mdmp, 00000000-00004404.00000000.120491.6C02A000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004404.00000000.120491.1A0A2000.00000002.mdmp, 00000000-00004404.00000000.120491.6C02A000.00000002.mdmp")42:T851,Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00001176.00000001.119790.00080000.00000004.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00001176.00000001.119790.00080000.00000004.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00003964.00000001.118905.00080000.00000004.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00003964.00000001.118905.00080000.00000004.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00004404.00000000.120491.1A0A2000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00004404.00000000.120491.1A0A2000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00004404.00000000.120491.1A0A2000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00004404.00000000.120491.1A0A2000.00000002.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00004404.00000000.120491.1A0A2000.00000002.mdmp") Found reference to API "GetFileVersionInfoExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00004404.00000000.120491.1A0A2000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00004404.00000000.120491.1A0A2000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00004404.00000000.120491.1A0A2000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00004404.00000000.120491.1A0A2000.00000002.mdmp, 00000000-00004404.00000000.120491.6C02A000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00004404.00000000.120491.1A0A2000.00000002.mdmp")43:T873,Found string "master secret" (Indicator: "secret"; Source: "00000000-00001176.00000000.119771.04893000.00000004.mdmp") Found string "master secret" (Indicator: "secret"; Source: "00000000-00001380.00000000.119576.04893000.00000004.mdmp, 00000000-00001380.00000001.119647.04893000.00000004.mdmp") Found string "master secret" (Indicator: "secret"; Source: "00000000-00002440.00000000.119249.04893000.00000004.mdmp") Found string "master secret" (Indicator: "secret"; Source: "00000000-00003964.00000001.118905.04893000.00000004.mdmp") Found string "passwordderivebytes" (Indicator: "password"; Source: "00000000-00004404.00000000.120491.A5A80000.00000004.mdmp") Found string "sha1fornonsecretpurposes" (Indicator: "secret"; Source: "00000000-00004404.00000000.120491.A5AA0000.00000004.mdmp") Found string "passwordpropertytextattribute" (Indicator: "password"; Source: "00000000-00004404.00000000.120491.A5AA0000.00000004.mdmp") Found string "secretagreementflags" (Indicator: "secret"; Source: "00000000-00004404.00000000.120491.A5AC0000.00000004.mdmp") Found string "safencryptsecrethandle" (Indicator: "secret"; Source: "00000000-00004404.00000000.120491.A5AC0000.00000004.mdmp") Found string "passwordauthenticationmechanism" (Indicator: "password"; Source: "00000000-00004404.00000000.120491.A5B20000.00000004.mdmp") Found string "passwordencodingmethod" (Indicator: "password"; Source: "00000000-00004404.00000000.120491.A5B60000.00000004.mdmp") Found string "dsmakepasswordcredentials" (Indicator: "password"; Source: "00000000-00004404.00000000.120491.A5B60000.00000004.mdmp") Found string "dsfreepasswordcredentials" (Indicator: "password"; Source: "00000000-00004404.00000000.120491.A5B60000.00000004.mdmp") Found string "passwordFormat=." (Indicator: "password"; Source: "00000000-00004404.00000000.120491.DC610000.00000004.mdmp") Found string "passwordFormat="Hashed"" (Indicator: "password"; Source: "00000000-00004404.00000000.120491.DC610000.00000004.mdmp") Found string "master secret" (Indicator: "secret"; Source: "00000000-00004864.00000000.119229.04893000.00000004.mdmp, 00000000-00004864.00000001.119256.04893000.00000004.mdmp")44:Tb16,Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00001176.00000000.119771.D8850000.00000004.mdmp, 00000000-00001176.00000001.119790.D8850000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\rundll32.exe" (Indicator: "\Device\"; Source: "00000000-00001176.00000000.119771.D8850000.00000004.mdmp, 00000000-00001176.00000001.119790.D8850000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00001380.00000000.119576.767A0000.00000004.mdmp, 00000000-00001380.00000001.119647.767A0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\rundll32.exe" (Indicator: "\Device\"; Source: "00000000-00001380.00000000.119576.767A0000.00000004.mdmp, 00000000-00001380.00000001.119647.767A0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00002440.00000000.119249.8E9A0000.00000004.mdmp, 00000000-00002440.00000001.119285.8E9A0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\rundll32.exe" (Indicator: "\Device\"; Source: "00000000-00002440.00000000.119249.8E9A0000.00000004.mdmp, 00000000-00002440.00000001.119285.8E9A0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00003964.00000000.118869.8FCD0000.00000004.mdmp, 00000000-00003964.00000001.118905.8FCD0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\rundll32.exe" (Indicator: "\Device\"; Source: "00000000-00003964.00000000.118869.8FCD0000.00000004.mdmp, 00000000-00003964.00000001.118905.8FCD0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00004404.00000000.120491.C1E00000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00004404.00000000.120491.DBFC0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\DosDevices\C:\??\Volume{815ead30-0000-0000-0000-501f00000000}00000" (Indicator: "\Device\"; Source: "00000000-00004404.00000000.120491.DBFC0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\DosDevices\C:\??\Volume{815ead30-0000-0000-0000-501f00000000}00000" (Indicator: "\DosDevices\"; Source: "00000000-00004404.00000000.120491.DBFC0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00004864.00000000.119229.4B7E0000.00000004.mdmp, 00000000-00004864.00000001.119256.4B7E0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\rundll32.exe" (Indicator: "\Device\"; Source: "00000000-00004864.00000000.119229.4B7E0000.00000004.mdmp, 00000000-00004864.00000001.119256.4B7E0000.00000004.mdmp")45:T9ce,"rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES64"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000009"; Key: "PACKEDCATALOGITEM"; Value: "")46:T7a6,"powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT")47:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC48:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC49:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC4a:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC4b:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC4c:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC4d:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC4e:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC4f:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC50:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC51:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC52:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC53:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC54:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15ee1ca","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790326959137,"unified_at":"2026-09-25T09:02:39.137Z","metadata":{"hashes":{"sha256":"6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15ee1ca","sha1":"5e980cc41f6da45f13a5783ae58b98e88e5c48dc","md5":"dc636da03e807258d2a10825780b4639","sha512":"7cfafbbb32c0dcc78753f232d341e6263d3d994db25c190d934d457876722f4c19e2607ab08a26d21785eeee974610ea72819a82a6ae1c04cfde852022ff7799","ssdeep":"196608:tM88vXmey460q5latyKyw1OAT1jN0YVqSTlzln15:MWAyxWw6X0YPhZ7","ssdeep_chunks":["196608:tM88vXm","196608:M88vXme","196608:88vXmey","196608:8vXmey4","196608:vXmey46","196608:Xmey460","196608:mey460q","196608:ey460q5","196608:y460q5l","196608:460q5la","196608:60q5lat","196608:0q5laty","196608:q5latyK","196608:5latyKy","196608:latyKyw","196608:atyKyw1","196608:tyKyw1O","196608:yKyw1OA","196608:Kyw1OAT","196608:yw1OAT1","196608:w1OAT1j","196608:1OAT1jN","196608:OAT1jN0","196608:AT1jN0Y","196608:T1jN0YV","196608:1jN0YVq","196608:jN0YVqS","196608:N0YVqST","196608:0YVqSTl","196608:YVqSTlz","196608:VqSTlzl","196608:qSTlzln","196608:STlzln1","196608:Tlzln15","393216:tM88vXm","393216:M88vXme","393216:88vXmey","393216:8vXmey4","393216:vXmey46","393216:Xmey460","393216:mey460q","393216:ey460q5","393216:y460q5l","393216:460q5la","393216:60q5lat","393216:0q5laty","393216:q5latyK","393216:5latyKy","393216:latyKyw","393216:atyKyw1","393216:tyKyw1O","393216:yKyw1OA","393216:Kyw1OAT","393216:yw1OAT1","393216:w1OAT1j","393216:1OAT1jN","393216:OAT1jN0","393216:AT1jN0Y","393216:T1jN0YV","393216:1jN0YVq","393216:jN0YVqS","393216:N0YVqST","393216:0YVqSTl","393216:YVqSTlz","393216:VqSTlzl","393216:qSTlzln","393216:STlzln1","393216:Tlzln15","196608:MWAyxWw","196608:WAyxWw6","196608:AyxWw6X","196608:yxWw6X0","196608:xWw6X0Y","196608:Ww6X0YP","196608:w6X0YPh","196608:6X0YPhZ","196608:X0YPhZ7"],"imphash":"6d86f70f74801f37e2db25edd59c53e9"},"file_info":{"file_name":"6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15ee1ca","file_type":["pedll","64bits","executable"],"file_type_id":"64-bit dll","file_size":9003928,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1718962520000,"last_seen":1788253584000,"last_multi_scan":1788253584000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["evasive"]},"stats":{"av":{"malicious_count":10,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":73},"sandbox_signatures":{"informative_count":175,"suspicious_count":11,"malicious_count":6,"total":192},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Infostealer/Win.TrollAgent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-6","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W64.Evo","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"MalCert-S.RN (A)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of WinGo/Kimsuky.C trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005e746e1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Mal/VMProtBad-A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W64/ABTrojan.JGED-4518","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.BroPass.Win64.781","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win/malicious_confidence_100%","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"suspicious","value":"Entrypoint in PE header is within an uncommon section"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"PE file contains zero-sized sections"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"YARA signature match - AES encryption"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Able to execute applications using .NET process API"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"suspicious","value":"Calls an API typically used to find and list the Windows drive types"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads the cryptographic machine GUID"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"malicious","value":"Executes powershell requesting to bypass execution policy"},{"type":"informative","value":"Observed Powershell command strings"},{"type":"informative","value":"Able to build PowerShell events through modules contained in the .NET code"},{"type":"informative","value":"Executes PowerShell with command line"},{"type":"informative","value":"YARA signature match - PowerShell file content"}],"sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Able to access control system service controller"}],"sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the .NET runtime environment"}],"sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"malicious","value":"Loads the task scheduler COM API"}],"sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"suspicious","value":"Modifies Software Policy Settings"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"tactic":"Privilege Escalation","technique":"Thread Local Storage","attack_id":"T1055.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/005","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"tactic":"Defense Evasion","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution (Powershell command string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Able to delete items (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"suspicious","value":"Queries process mitigation policy via NtQueryInformationProcess"},{"type":"informative","value":"Contains a Wine emulator-related string"},{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"},{"type":"malicious","value":"Tries to delete scheduled tasks"},{"type":"suspicious","value":"Able to delete scheduled task(s)"},{"type":"informative","value":"Contains ability to disable Windows Defender using PowerShell"},{"type":"informative","value":"Contains strings related to AMSI (Anti Malware Scan Interface)"}],"sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"malicious","value":"PE file is protected by VMProtect"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"tactic":"Defense Evasion","technique":"Rootkit","attack_id":"T1014","attack_id_wiki":"https://attack.mitre.org/techniques/T1014","identifiers":[{"type":"informative","value":"References device drivers used by rootkit malware"}],"sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"tactic":"Defense Evasion","technique":"Indicator Blocking","attack_id":"T1562.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/006","identifiers":[{"type":"informative","value":"Modifies process error mode to suppress error dialogs"}],"sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"tactic":"Defense Evasion","technique":"Match Legitimate Resource Name or Location","attack_id":"T1036.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/005","identifiers":[{"type":"informative","value":"Creates file(s) in System32 or SysWOW64 directory"}],"sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"tactic":"Defense Evasion","technique":"Rundll32","attack_id":"T1218.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1218/011","identifiers":[{"type":"informative","value":"Executes a DLL using Rundll32 process"}],"sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Spawns Windows crash diagnostic and reporting process"}],"sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"tactic":"Defense Evasion","technique":"Junk Code Insertion","attack_id":"T1027.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/016","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Spawns new processes that are not known child processes"}],"sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Tries to access Powershell profile file"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Reads Windows Trust Settings"}],"sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"}],"sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Calls an API typically used to enumerate Windows drive types"}],"sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1021.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1021/001","identifiers":[{"type":"informative","value":"Contains ability to perform remote desktop activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Able to perform SQL operations"}],"sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contains ability to communicate with network (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains ability to perform encryption/decryption using RSA algorithm"}],"sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"},{"type":"informative","value":"Able to import cryptographic keys (seen in ransomware)"},{"type":"informative","value":"Contains reference to cryptographic keys"},{"type":"informative","value":"Able to access crypto-related API (String)"},{"type":"informative","value":"Contains ability to perform encryption (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]}],"sandbox_signatures":[{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (On Sensor) detected file with medium confidence","description":"\"Portable Executable (On Sensor) Model\" detected file as \"dirty\" with \"medium\" confidence","origin":"Static Analysis","id":"mlmodel-13","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"Found reference to API (Indicator: \"LoadLibraryA\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"SetThreadAffinityMask\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"ExitProcess\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"GetModuleFileNameW\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"LocalFree\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"GetVersionExA\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"LocalAlloc\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.001","id":"string-318","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-310","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1489","id":"string-316","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-164","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"AEsJ\" (Indicator: \"aes\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-57","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionExA\" (Indicator: \"GetVersionExA\"; Source: \"sample.bin\"), Found reference to API \"GetVersionExA\" (Indicator: \"GetVersion\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-171","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to build PowerShell events through modules contained in the .NET code","description":"Found string \":\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll\" (Source: \"00000000-00004404.00000000.120491.C1E00000.00000004.mdmp\")\n Found string \":\\WINDOWS\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\6da01910c256231d1c50ad0aacee5941\\System.Management.Automation.ni.dll\" (Source: \"00000000-00004404.00000000.120491.C1E00000.00000004.mdmp\")\n Found string \"System.Management.Automation.dll\" (Source: \"00000000-00004404.00000000.120491.C1E00000.00000004.mdmp\")\n Found string \"C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\wldp.dll\" (Source: \"00000000-00004404.00000000.120491.DC610000.00000004.mdmp\")\n Found string \"C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\shlwapi.dll\" (Source: \"00000000-00004404.00000000.120491.DC610000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-942","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"Found string \"System.IO.Compression.ZipFile\" (Source: \"00000000-00004404.00000000.120491.6C02A000.00000002.mdmp\")\n Found string \"system.io.compression\" (Source: \"00000000-00004404.00000000.120491.A5AA0000.00000004.mdmp, 00000000-00004404.00000000.120491.A5AC0000.00000004.mdmp\")\n Found string \"compressionmode\" (Source: \"00000000-00004404.00000000.120491.A5AA0000.00000004.mdmp\")\n Found string \"decompressionmethods\" (Source: \"00000000-00004404.00000000.120491.A5AA0000.00000004.mdmp\")\n Found string \"compressionlevel\" (Source: \"00000000-00004404.00000000.120491.A5AA0000.00000004.mdmp\")\n Found string \"compressionstrategy\" (Source: \"00000000-00004404.00000000.120491.A5AA0000.00000004.mdmp\")\n Found string \"compressionmethod\" (Source: \"00000000-00004404.00000000.120491.A5AA0000.00000004.mdmp\")\n Found string \"compressiontracingswitchlevel\" (Source: \"00000000-00004404.00000000.120491.A5AC0000.00000004.mdmp\")\n Found string \"compressiontracingswitch\" (Source: \"00000000-00004404.00000000.120491.A5AC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to delete items (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Remove-Item\"; File: \"2687540094.ps1\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-333","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"MpFreeMemory\" (Indicator: \"FreeMemory\"; Source: \"00000000-00004404.00000000.120491.1A0A2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"powershell.exe\" called \"FindResourceW\" with parameter \"7\" - (UID: 00000000-00004404)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"63\" - (UID: 00000000-00004404)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"64\" - (UID: 00000000-00004404)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"8\" - (UID: 00000000-00004404)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"powershell.exe\" called \"LoadResource with parameter {'hModule': '2077752492033', 'hResInfo': '2077752493280'}\" (UID: 00000000-00004404)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '2077752492033', 'hResInfo': '2077752493312'}\" (UID: 00000000-00004404)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '2077752492033', 'hResInfo': '2077752493328'}\" (UID: 00000000-00004404)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '2077752492033', 'hResInfo': '2077752493296'}\" (UID: 00000000-00004404)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Start-Sleep\"; File: \"2687540094.ps1\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-397","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15ee1ca\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"00000000-00004404.00000000.120491.1A0A2000.00000002.mdmp, 00000000-00004404.00000000.120491.6C02A000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00004404.00000000.120491.1A0A2000.00000002.mdmp, 00000000-00004404.00000000.120491.6C02A000.00000002.mdmp\")\n Found reference to API \"WaitForSingleObjectEx\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00004404.00000000.120491.6C02A000.00000002.mdmp\")\n Found reference to API \"WaitForSingleObjectEx\" (Indicator: \"WaitForSingleObjectEx\"; Source: \"00000000-00004404.00000000.120491.6C02A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"$25","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"SA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00004404.00000000.120491.DBFC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"Observed string: \":\\WINDOWS\\SYSTEM32\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00004404.00000000.120491.DBFC0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-231","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"rundll32.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"powershell.exe\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","mitre_attack_id":"T1562.006","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$26","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Spawns Windows crash diagnostic and reporting process","description":"Process \"WerFault.exe\" [UID: 00000000-00002964]\n Process \"WerFault.exe\" [UID: 00000000-00005316]\n Process \"WerFault.exe\" [UID: 00000000-00004896]\n Process \"WerFault.exe\" [UID: 00000000-00003500]\n Process \"WerFault.exe\" [UID: 00000000-00002104]\n Process \"WerFault.exe\" [UID: 00000000-00005116]","origin":"Monitored Target","mitre_attack_id":"T1564","relevance":1,"id":"target-585","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-sized sections","description":"Raw size of \".text\" is zero\n Raw size of \".data\" is zero\n Raw size of \".rdata\" is zero\n Raw size of \".pdata\" is zero\n Raw size of \".xdata\" is zero\n Raw size of \".bss\" is zero\n Raw size of \".edata\" is zero\n Raw size of \".idata\" is zero\n Raw size of \".CRT\" is zero\n Raw size of \".tls\" is zero\n Raw size of \".vmp0\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00004404.00000000.120491.DC610000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"Found reference to API \"tripledescryptoserviceprovider\" (Indicator: \"TripleDESCryptoServiceProvider\"; Source: \"00000000-00004404.00000000.120491.A5A80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to import cryptographic keys (seen in ransomware)","description":"Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00001380.00000000.119576.767A0000.00000004.mdmp\")\n Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00004404.00000000.120491.DC610000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-603","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$27","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"Assembly shows XOR instruction xor bx\n 51A7h in Stream UID: 35975-46562-0000000235E8A742\n Assembly shows XOR instruction xor al\n byte ptr [r9+rdx] in Stream UID: 35975-46564-0000000235E8AD5F\n Assembly shows XOR instruction xor al\n byte ptr [rcx+rdx] in Stream UID: 35975-46564-0000000235E8AD5F\n Assembly shows XOR instruction xor dh\n bl in Stream UID: 35975-46564-0000000235E8AD5F","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00001380.00000001.119647.767A0000.00000004.mdmp\")\n Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00002440.00000001.119285.8E9A0000.00000004.mdmp\")\n Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00003964.00000000.118869.8FCD0000.00000004.mdmp\")\n Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00004404.00000000.120491.DC610000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00004404.00000000.120491.DC610000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"rsacryptoserviceprovider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00004404.00000000.120491.A5A80000.00000004.mdmp\")\n Found string \"psrsacryptoserviceprovider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00004404.00000000.120491.A5B00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-352","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"$28","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00004404.00000000.120491.DBFC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.95819","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$29","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2a","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004404-00000C2C-873529097\")\n Found reference to API \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004404-00000C2C-874094206\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"etUserNameW\" (Source: \"00000000-00001176.00000000.119771.D8850000.00000004.mdmp, 00000000-00001176.00000001.119790.D8850000.00000004.mdmp\")\n Found string \"etUserNameA\" (Source: \"00000000-00001380.00000001.119647.767A0000.00000004.mdmp\")\n Found string \"etUserNameExA\" (Source: \"00000000-00002440.00000000.119249.8E9A0000.00000004.mdmp\")\n Found string \"etUserNameW\" (Source: \"00000000-00002440.00000001.119285.8E9A0000.00000004.mdmp\")\n Found string \"etUserNameW\" (Source: \"00000000-00003964.00000000.118869.8FCD0000.00000004.mdmp\")\n Found string \"etUserNameA\" (Source: \"00000000-00003964.00000000.118869.8FCD0000.00000004.mdmp\")\n Found string \"etUserNameExW\" (Source: \"00000000-00003964.00000000.118869.8FCD0000.00000004.mdmp\")\n Found string \"etUserNameW\" (Source: \"00000000-00004404.00000000.120491.DC610000.00000004.mdmp\")\n Found string \"etUserNameExW\" (Source: \"00000000-00004404.00000000.120491.DC610000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004404-00000C2C-873529097\")\n Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004404-00000C2C-874094206\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005972-00000C2C-851937475\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00001176.00000001.119790.00080000.00000004.mdmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00003964.00000001.118905.00080000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00004404-00000C2C-872856718\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00004404-00000C2C-872856897\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00004404-00000C2C-874525126\")\n Found reference to API \"CheckTokenMembershipW\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00004404-00000C2C-874525160\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00004404.00000000.120491.6C02A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetUserObjectInformationW\" in file \"6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15ee1ca\"\n Found system information discovery API: \"GetMonitorInfoW\" in \"00000000-00001176.00000001.119790.00080000.00000004.mdmp\"\n Found system information discovery API: \"GetUserObjectInformationA\" in \"00000000-00003964.00000000.118869.04D4C000.00000020.mdmp\"\n Found system information discovery API: \"GetMonitorInfoW\" in \"00000000-00003964.00000001.118905.00080000.00000004.mdmp\"\n Found system information discovery API: \"RtlNtStatusToDosError\" in \"00000000-00004404.00000000.120491.1A0A2000.00000002.mdmp\"\n Found system information discovery API: \"ExpandEnvironmentStringsW\" in \"00000000-00004404.00000000.120491.6C02A000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; Source: \"00000000-00004404.00000000.120491.6C02A000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00004404.00000000.120491.6C02A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"WTSSendMessageW\" (Indicator: \"sendmessage\"; File: \"6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15ee1ca\")\n Found reference to API \"EnumWindows\" (Indicator: \"enumwindows\"; Source: \"00000000-00004404-00000C2C-873855905\")\n Found reference to API \"EnumWindowsW\" (Indicator: \"enumwindows\"; Source: \"00000000-00004404-00000C2C-873855928\")\n Found reference to API \"ystem.ServiceModel.Activities.Configuration.SendMessageChannelCacheElement, System.ServiceModel.Activities, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\" (Indicator: \"sendmessage\"; Source: \"00000000-00004404.00000000.120491.DC610000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"$2b","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"rundll32.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00005972)\n \"rundll32.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00005972)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"rundll32.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00005972)\n \"rundll32.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00003964)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"powershell.exe\" called \"IsWow64Process\" with parameter \"4404\" - (UID: 00000000-00004404)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00004404)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"rundll32.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005972)\n \"rundll32.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00003964)\n \"rundll32.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00008172)\n \"rundll32.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00006724)\n \"rundll32.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00004864)\n \"rundll32.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007452)\n \"rundll32.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002440)\n \"rundll32.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00001380)\n \"rundll32.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007592)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2c","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"powershell.exe\" called \"GetVersionExA\" with parameter 940000000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010916023001500800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004404)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00004404)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00004404)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00004404)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Environment Awareness","name":"Contains a Wine emulator-related string","description":"\"wine_get_version\" (Indicator: \"wine_get_version\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":5,"id":"string-62","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00004404.00000000.120491.6C02A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"rundll32.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"rundll32.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LEVELS\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"DEFAULTLEVEL\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"SAFERFLAGS\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"POLICYSCOPE\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LOGFILENAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15ee1ca\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00004404.00000000.120491.1A0A2000.00000002.mdmp, 00000000-00004404.00000000.120491.6C02A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; Source: \"00000000-00003964.00000000.118869.04D4C000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"General","name":"Able to execute applications using .NET process API","description":"Found string \"processstartinfo\" (Source: \"00000000-00004404.00000000.120491.A5AA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-934","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"Found string \"GetCommandLineW\" (Source: \"00000000-00001176.00000001.119790.00080000.00000004.mdmp\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00003964.00000001.118905.00080000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00004404.00000000.120491.1A0A2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$2d","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"General","name":"An application crash occurred","description":"Report process \"WerFault.exe\" was created by \"svchost.exe\"\n Report process \"WerFault.exe\" was created by \"rundll32.exe\"","origin":"Monitored Target","id":"target-2","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"General","name":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)","description":"\"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00004404)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":1,"id":"api-179","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"rundll32.exe\" called \"CreateDirectoryW\" with parameter %APPDATA%\\pCloud\\ (UID: 00000000-00003964)\n \"rundll32.exe\" called \"CreateDirectoryW\" with parameter %APPDATA%\\pCloud\\local\\ (UID: 00000000-00003964)\n \"rundll32.exe\" called \"CreateDirectoryW\" with parameter %APPDATA%\\local\\ (UID: 00000000-00003964)\n \"rundll32.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\.tmp (UID: 00000000-00006060)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"rundll32.exe\" called \"CreateProcessW\" with parameter \"schtasks /delete /f /tn \"ChromeUpdateTaskMachineUAC\"\" - (UID: 00000000-00006060)\n \"rundll32.exe\" called \"CreateProcessW\" with parameter \"powershell.exe -executionpolicy bypass -File \"%USERPROFILE%\\.tmp\\2687540094.ps1\"\" - (UID: 00000000-00006060)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"rundll32.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\" - (UID: 00000000-00006060)\n \"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.134327272385562760.4404.DefaultAppDomain.powershell\" - (UID: 00000000-00004404)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2e","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2f","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00003964.00000001.118905.00080000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00003964.00000001.118905.00080000.00000004.mdmp\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00004404.00000000.120491.1A0A2000.00000002.mdmp, 00000000-00004404.00000000.120491.6C02A000.00000002.mdmp\")\n Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; Source: \"00000000-00004404.00000000.120491.6C02A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00004404.00000000.120491.6C02A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: 6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15ee1ca)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; Source: \"00000000-00004404.00000000.120491.1A0A2000.00000002.mdmp\")\n Found reference to API \"LockResource\" (Indicator: \"LockResource\"; Source: \"00000000-00004404.00000000.120491.1A0A2000.00000002.mdmp\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00004404.00000000.120491.1A0A2000.00000002.mdmp, 00000000-00004404.00000000.120491.6C02A000.00000002.mdmp\")\n Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; Source: \"00000000-00004404.00000000.120491.1A0A2000.00000002.mdmp\")\n Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; Source: \"00000000-00004404.00000000.120491.6C02A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00001176.00000001.119790.00080000.00000004.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00003964.00000001.118905.00080000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00004404.00000000.120491.1A0A2000.00000002.mdmp, 00000000-00004404.00000000.120491.6C02A000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00004404.00000000.120491.1A0A2000.00000002.mdmp, 00000000-00004404.00000000.120491.6C02A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"$30","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$31","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"2687540094.ps1\" as clean (type is \"Unicode text UTF-8 (with BOM) text\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"General","name":"Executes PowerShell with command line","description":"Process \"powershell.exe\" with commandline \"-executionpolicy bypass -File \"%USERPROFILE%\\\\.tmp\\\\2687540094.ps1\"\" (UID: 00000000-00004404)","origin":"Monitored Target","mitre_attack_id":"T1059.001","relevance":1,"id":"target-486","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"General","name":"Executes a DLL using Rundll32 process","description":"$32","origin":"Monitored Target","mitre_attack_id":"T1218.011","relevance":1,"id":"target-400","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$33","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15ee1ca\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"premium-server@thawte.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\PSHost.134327272385562760.4404.DefaultAppDomain.powershell","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$34","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$35","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll\" at 038D0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 1CB20000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"rundll32.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 33BE0000\n \"schtasks.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 33BE0000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 33BE0000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 32640000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at 04ED0000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"rundll32.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 35130000\n \"schtasks.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 35130000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 35130000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a000000000040c75833ff7f0000@ntdll.dll\"\n \"220023000000000018c75833ff7f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15ee1ca\" was detected as \"VMProtect\" and name: \"Protector\"\n \"6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15ee1ca\" was detected as \"MinGW\" and name: \"Compiler\"\n \"6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15ee1ca\" was detected as \"GNU linker ld (GNU Binutils)\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"General","name":"Observed Powershell command strings","description":"file/memory contains long string with (Indicator: \"Test-Path\"; File: \"2687540094.ps1\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-187","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"powershell.exe\" touched \"Windows Defender IOfficeAntiVirus implementation\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{2781761E-28E0-4109-99FE-B9D127C57AFE}\\INPROCSERVER32\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15ee1ca\" has an executable section named \".text\"\n \"6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15ee1ca\" has an executable section named \".vmp0\"\n \"6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15ee1ca\" has an executable section named \".vmp1\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15ee1ca\" has an writable section named \".data\"\n \"6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15ee1ca\" has an writable section named \".bss\"\n \"6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15ee1ca\" has an writable section named \".idata\"\n \"6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15ee1ca\" has an writable section named \".CRT\"\n \"6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15ee1ca\" has an writable section named \".tls\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15ee1ca\" file has an entrypoint instructions - \"push\t0x67a9c586,call\t0x235ea7d4f,ret\t,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".vmp1\" is \"0x893200\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x4e17f0\" greater than 0x100000\n Virtual size of \".rdata\" is \"0x3ffbb0\" greater than 0x100000\n Virtual size of \".vmp0\" is \"0x3b0ebb\" greater than 0x100000\n Virtual size of \".vmp1\" is \"0x89305c\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15ee1ca\" has high imagebase \"0x234a00000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\System32\\schtasks.exe\" [Source: 00000000-00006060-00000BC0-866864195]\n Observed system executable string:\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" [Source: 00000000-00006060-00000BC0-871905067]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"rundll32.exe\" (UID: 00000000-00005972) was launched with new environment variables: \"PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"rundll32.exe\" (UID: 00000000-00005972) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles\"\n Process \"schtasks.exe\" (UID: 00000000-00004232) was launched with new environment variables: \"USERDNSDOMAIN=\"DESKTOP-FVVF82A\"\"\n Process \"schtasks.exe\" (UID: 00000000-00004232) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS\"\n Process \"schtasks.exe\" (UID: 00000000-00004232) was launched with missing environment variables: \"PROCESSOR_ARCHITEW6432\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"rundll32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"rundll32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$36","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$37","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$38","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$39","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_zfgrmh45.ser.ps1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_m44d4u1i.fsz.psm1\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates file(s) in System32 or SysWOW64 directory","description":"\"powershell.exe\" create file \"C:\\Windows\\System32\\CatRoot\"\n \"powershell.exe\" create file \"C:\\Windows\\System32\\catroot2\"\n \"powershell.exe\" create file \"%WINDIR%\\System32\\CatRoot\"\n \"powershell.exe\" create file \"%WINDIR%\\System32\\catroot2\"","origin":"API Call","mitre_attack_id":"T1036.005","relevance":5,"id":"api-324","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"2687540094.ps1\" has type \"Unicode text UTF-8 (with BOM) text\"- Location: [%USERPROFILE%\\.tmp\\2687540094.ps1]- [targetUID: 00000000-00006060]\n \"StartupProfileData-NonInteractive\" has type \"data\"- Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive]- [targetUID: 00000000-00004404]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$3a","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"$3b","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$3c","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"powershell.exe\" reads file \"c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe.config\"\n \"powershell.exe\" reads file \"c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\config\\machine.config\"\n \"powershell.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll.aux\"\n \"powershell.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.pb378ec07#\\b5ba37e1558ced178a99011a1d659b52\\microsoft.powershell.consolehost.ni.dll.aux\"\n \"powershell.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system\\e43dd9c73ab5615e461bf5109c3facd6\\system.ni.dll.aux\"\n \"powershell.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.core\\0d59b0e237d7519417de10cd84bda4e7\\system.core.ni.dll.aux\"\n \"powershell.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.manaa57fc8cc#\\6da01910c256231d1c50ad0aacee5941\\system.management.automation.ni.dll.aux\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to delay execution (Powershell command string)\n Matched sigs: Contains a Wine emulator-related string\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"rundll32.exe\" trying to touch file \"\\Device\\CNG\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\System32\\KernelBase.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\WINDOWS\\SYSTEM32\\kernelbase.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\windows\\temp\\VxSSL64.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\System32\\fltLib.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\WINDOWS\\System32\\FLTLIB.DLL\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\System32\\msvcp140.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\System32\\vcruntime140.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\WINDOWS\\System32\\VCRUNTIME140.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\System32\\vcruntime140_1.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\WINDOWS\\System32\\VCRUNTIME140_1.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"powershell.exe\" touched file \"C:\\Windows\\System32\\CatRoot\"\n \"powershell.exe\" touched file \"C:\\Windows\\System32\\catroot2\"\n \"powershell.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive\"\n \"powershell.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access Powershell profile file","description":"\"powershell.exe\" trying to access file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Users\\%OSUSER%\\Documents\\WINDOWSPOWERSHELL\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Users\\%OSUSER%\\Documents\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WINDOWSPOWERSHELL\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-173","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$3d","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"rundll32.exe\" trying to access non-existent file \"C:\\6C35A48CEDB38A3E2C8D001A6D79F571BF0A70DDEC99761AA4D3DE2AD15EE1CA.DLL.MANIFEST\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\6C35A48CEDB38A3E2C8D001A6D79F571BF0A70DDEC99761AA4D3DE2AD15EE1CA.DLL.123.MANIFEST\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\6C35A48CEDB38A3E2C8D001A6D79F571BF0A70DDEC99761AA4D3DE2AD15EE1CA.DLL.124.MANIFEST\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\6C35A48CEDB38A3E2C8D001A6D79F571BF0A70DDEC99761AA4D3DE2AD15EE1CA.DLL.2.MANIFEST\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\PCLOUD\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\pCloud\\LOCAL\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\LOCAL\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"rundll32.exe\" writes file \"c:\\users\\%osuser%\\.tmp\\2687540094.ps1\"\n \"rundll32.exe\" writes file \"%userprofile%\\.tmp\\2687540094.ps1\"\n \"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\__psscriptpolicytest_zfgrmh45.ser.ps1\"\n \"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\__psscriptpolicytest_m44d4u1i.fsz.psm1\"\n \"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\microsoft\\windows\\powershell\\startupprofiledata-noninteractive\"\n \"powershell.exe\" writes file \"%temp%\\__psscriptpolicytest_zfgrmh45.ser.ps1\"\n \"powershell.exe\" writes file \"%temp%\\__psscriptpolicytest_m44d4u1i.fsz.psm1\"\n \"powershell.exe\" writes file \"%localappdata%\\microsoft\\windows\\powershell\\startupprofiledata-noninteractive\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00004404.00000000.120491.A5AA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":7,"id":"string-417","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00001176.00000001.119790.00080000.00000004.mdmp\")\n Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00003964.00000001.118905.00080000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00005972-00000C2C-851926323\")\n Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00001176.00000001.119790.00080000.00000004.mdmp\")\n Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00003964.00000001.118905.00080000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"wsastartup\"; Source: \"00000000-00005972-00000C2C-851926323\")\n Found reference to API \"WSAStartup\" (Indicator: \"wsastartup\"; Source: \"00000000-00001176.00000001.119790.00080000.00000004.mdmp\")\n Found reference to API \"WSAStartup\" (Indicator: \"wsastartup\"; Source: \"00000000-00003964.00000001.118905.00080000.00000004.mdmp\")\n Found reference to API \"o enable assembly bind failure logging, set the registry value [HKLM\\Software\\Microsoft\\Fusion!EnableLog] (DWORD) to 1.\" (Indicator: \" bind \"; Source: \"00000000-00004404.00000000.120491.C1E00000.00000004.mdmp\")\n Found reference to API \"ote: There is some performance penalty associated with assembly bind failure logging.\" (Indicator: \" bind \"; Source: \"00000000-00004404.00000000.120491.DBFC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"2.5.29.37\"\n \"2.5.29.35\"\n \"192.168.0.2\"\n Potential IP \"3.0.0.0\" found in string \"ystem.Management.Automation.resources,3.0.0.0,en-US,31bf3856ad364e35\"\n Potential IP \"4.0.0.0\" found in string \"rsion=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\"\n Potential IP \"4.0.0.0\" found in string \"=4.0.0.0, Culture=neutra\"\n \"2.5.29.15\"\n \"2.5.29.19\"\n Potential IP \"2.5.29.35\" found in string \"#2.5.29.35\"\n \"2.5.29.31\"\n \"2.5.29.14\"\n \"2.5.4.5\"\n Potential IP \"3.0.0.0\" found in string \"icrosoft.PowerShell.ConsoleHost.resources,3.0.0.0,en-US,31bf3856ad364e35\"\n Potential IP \"2.5.29.37\" found in string \"%2.5.29.37\"\n \"2.5.4.7\"\n \"2.5.4.10\"\n \"2.5.4.11\"\n \"2.5.29.32\"\n \"2.5.29.17\"\n \"2.5.4.6\"\n \"2.5.4.8\"\n \"2.5.29.1\"\n \"2.5.4.3\"\n \"2.5.29.10\"\n \"2.5.29.16\"\n Potential IP \"4.0.0.0\" found in string \"ersion=4.0.0.0, Cul\"\n Potential IP \"4.0.0.0\" found in string \"n=4.0.0.0, Culture=\"\n Potential IP \"4.0.0.0\" found in string \"ion=4.0.0.0, Cultur~\"\n Potential IP \"4.0.0.0\" found in string \"sion=4.0.0.0, Cultu\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$3f","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on process \"00000000-00008172\"\n YARA signature for AES encryption matched on process \"00000000-00007452\"\n YARA signature for AES encryption matched on process \"00000000-00006060\"\n YARA signature for AES encryption matched on process \"00000000-00005972\"\n YARA signature for AES encryption matched on process \"00000000-00006904\"\n YARA signature for AES encryption matched on process \"00000000-00006724\"\n YARA signature for AES encryption matched on process \"00000000-00003964\"\n YARA signature for AES encryption matched on process \"00000000-00001380\"\n YARA signature for AES encryption matched on process \"00000000-00004864\"\n YARA signature for AES encryption matched on process \"00000000-00002440\"\n YARA signature for AES encryption matched on process \"00000000-00001176\"\n YARA signature for AES encryption matched on process \"00000000-00007592\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - PowerShell file content","description":"YARA signature for detecting PowerShell file matched on process \"00000000-00006060\"","origin":"YARA Signature","mitre_attack_id":"T1059.001","relevance":3,"id":"yara-36","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to perform remote desktop activity (API string)","description":"Found reference to API \"WTSSendMessageW\" (Indicator: \"WTSSendMessage\"; File: \"6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15ee1ca\")","origin":"File/Memory","mitre_attack_id":"T1021.001","relevance":1,"id":"string-436","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLEF639D7C4CD9A7D5233F35BD76CFF]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00004404.00000000.120491.C1E00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"kerberosclient\" (Indicator: \"kerberos\"; Source: \"00000000-00004404.00000000.120491.A5AA0000.00000004.mdmp\")\n Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00004404.00000000.120491.C1E00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"GetDesktopWindow\" (Indicator: \"GetDesktopWindow\"; Source: \"00000000-00001176.00000001.119790.00080000.00000004.mdmp\")\n Found reference to API \"GetDesktopWindow\" (Indicator: \"GetDesktopWindow\"; Source: \"00000000-00003964.00000001.118905.00080000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00004404.00000000.120491.1A0A2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to perform SQL operations","description":"Found string \"\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00004404.00000000.120491.DC610000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegQueryValueExW\" in \"00000000-00004404.00000000.120491.6C02A000.00000002.mdmp\"\n Found registry query API: \"RegGetValueW\" in \"00000000-00004404.00000000.120491.6C02A000.00000002.mdmp\"\n Found registry query API: \"RegOpenKeyExW\" in \"00000000-00004404.00000000.120491.6C02A000.00000002.mdmp\"\n Found registry query API: \"RegEnumKeyExW\" in \"00000000-00004404.00000000.120491.6C02A000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; File: \"6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15ee1ca\")\n Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; File: \"6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15ee1ca\")\n Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; Source: \"00000000-00003964.00000000.118869.04D4C000.00000020.mdmp\")\n Found reference to API \"GetUserObjectInformationA\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00003964.00000000.118869.04D4C000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$40","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"rundll32.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate Windows drive types","description":"\"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00004404)\n \"powershell.exe\" called \"GetDriveTypeW\" with parameter Z:\\ (UID: 00000000-00004404)","origin":"API Call","mitre_attack_id":"T1680","relevance":7,"id":"api-327","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00004404)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"powershell.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00004404)\n \"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00004404.00000000.120491.6C02A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$41","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15ee1ca\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004404.00000000.120491.1A0A2000.00000002.mdmp, 00000000-00004404.00000000.120491.6C02A000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004404.00000000.120491.1A0A2000.00000002.mdmp, 00000000-00004404.00000000.120491.6C02A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15ee1ca\")\n Found reference to API \"1.3.6.1.4.1.311.GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00001176.00000001.119790.00080000.00000004.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00003964.00000001.118905.00080000.00000004.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00004404.00000000.120491.1A0A2000.00000002.mdmp, 00000000-00004404.00000000.120491.6C02A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$42","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"30,7508,3147,,GetComputerNameW,kernel32.dll,\"00:31:21.453\",RX=0,PX=0\" (Indicator: \"GetComputerName\"; Source: \"00000000-00004404.00000000.120491.DC610000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00001176.00000001.119790.00080000.00000004.mdmp\")\n Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00003964.00000001.118905.00080000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00004404.00000000.120491.1A0A2000.00000002.mdmp, 00000000-00004404.00000000.120491.6C02A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00004404.00000000.120491.1A0A2000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$43","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00004404.00000000.120491.A5AA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"System Security","name":"Able to access control system service controller","description":"Found string \"System.ServiceProcess.ServiceController\" (Source: \"00000000-00004404.00000000.120491.6C02A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-936","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00004404)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$44","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"System Security","name":"Contains ability to disable Windows Defender using PowerShell","description":"Found string \"DisableRealtimeMonitoring\" (Indicator: \"disablerealtimemonitoring\"; Source: \"00000000-00004404.00000000.120491.1A0A2000.00000002.mdmp\")\n Found string \"DisableIOAVProtection\" (Indicator: \"disableioavprotection\"; Source: \"00000000-00004404.00000000.120491.1A0A2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-748","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00004404.00000000.120491.1A0A2000.00000002.mdmp, 00000000-00004404.00000000.120491.6C02A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"rundll32.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\WINDOWSPOWERSHELL\\V1.0\\POWERSHELL.EXE\"; Value: \"C487334AF139DD010000000000000000000000000200000000\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$45","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"System Security","name":"References device drivers used by rootkit malware","description":"Found string \"\\Device\\HarddiskVolume2\\DosDevices\\C:\\??\\Volume{815ead30-0000-0000-0000-501f00000000}00000\" (Indicator: \"\\DosDevices\\c:\"; Source: \"00000000-00004404.00000000.120491.DBFC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1014","relevance":1,"id":"string-458","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"\"rundll32.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\WINDOWSPOWERSHELL\\V1.0\\POWERSHELL.EXE\"; Value: \"C487334AF139DD010000000000000000000000000200000000\")\n \"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\LOCAL SETTINGS\\MUICACHE\\2FD\\52C64B7E\"; Key: \"LANGUAGELIST\"; Value: \"en-US\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"StartupProfileData-NonInteractive\" - Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive]- [targetUID: 00000000-00004404]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15ee1ca\" was detected as \"VMProtect v1.70.4-> phpbb3\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15ee1ca\" has section name .vmp1 with entropy \"7.958328393115318\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"suspicious","category":"Environment Awareness","name":"Queries process mitigation policy via NtQueryInformationProcess","description":"\"C:\\Windows\\System32\\rundll32.exe\" queried ProcessMitigationPolicy","origin":"API Call","mitre_attack_id":"T1497.001","relevance":1,"id":"api-323","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"9/27 Antivirus vendors marked sample as malicious (33% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"suspicious","category":"Pattern Matching","name":"Yara Signature Match - Indicators","description":"YARA signature \"INDICATOR_EXE_Packed_VMProtect\" matched file \"sample.bin\" as \"Detects executables packed with VMProtect.\"","origin":"YARA Signature","relevance":9,"id":"yara-553","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Able to delete scheduled task(s)","description":"Found string \"schtasks /delete /f /tn \"ChromeUpdateTaskMachineUAC\"\" (Indicator: \"schtasks /delete\"; Source: \"00000000-00006060-00000C47-6327153372\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-629","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to find and list the Windows drive types","description":"\"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00004404)\n \"powershell.exe\" called \"GetDriveTypeW\" with parameter Z:\\ (UID: 00000000-00004404)","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-110","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"rundll32.exe\" marked \"C:\\Users\\%OSUSER%\\.tmp\\2687540094.ps1\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_zfgrmh45.ser.ps1\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_m44d4u1i.fsz.psm1\" for deletion\n \"powershell.exe\" marked \"C:\\6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15ee1ca.dll\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\.tmp\\2687540094.ps1\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"rundll32.exe\" opened \"C:\\Users\\%OSUSER%\\.tmp\\2687540094.ps1\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_zfgrmh45.ser.ps1\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_m44d4u1i.fsz.psm1\" with delete access\n \"powershell.exe\" opened \"C:\\6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15ee1ca.dll\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\.tmp\\2687540094.ps1\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$46","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15ee1ca\" has an entrypoint in section \".vmp1\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetProcAddress\n GetModuleFileNameW\n GetModuleHandleA\n Sleep\n GetVersionExW\n LoadLibraryA\n GetVersionExA","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"malicious","category":"Environment Awareness","name":"PE file is protected by VMProtect","description":"\"6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15ee1ca\" has a section named \".vmp0\"\n \"6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15ee1ca\" has a section named \".vmp1\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":7,"id":"static-74","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"malicious","category":"Installation/Persistence","name":"Loads the task scheduler COM API","description":"\"schtasks.exe\" loaded module \"%WINDIR%\\System32\\taskschd.dll\" at 2E560000","origin":"Loaded Module","mitre_attack_id":"T1559.001","relevance":5,"id":"module-4","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Tries to delete scheduled tasks","description":"Process \"schtasks.exe\" with commandline \"schtasks /delete /f /tn \"ChromeUpdateTaskMachineUAC\"\" (UID: 00000000-00004232)\n Process \"schtasks.exe\" with commandline \"schtasks /delete /f /tn \"ChromeUpdateTaskMachineUAC\"\" (UID: 00000000-00006540)","origin":"Monitored Target","mitre_attack_id":"T1562.001","relevance":7,"id":"target-177","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"level":"malicious","category":"System Security","name":"Executes powershell requesting to bypass execution policy","description":"Process \"powershell.exe\" with commandline \"-executionpolicy bypass -File \"%USERPROFILE%\\\\.tmp\\\\2687540094.ps1\"\" (UID: 00000000-00004404)","origin":"Monitored Target","mitre_attack_id":"T1059.001","relevance":5,"id":"target-29","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]}],"incidents":[{"name":"Persistence","details_count":1,"details":[{"detail":"Creates new processes"}],"sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"name":"Evasive","details_count":4,"details":[{"detail":"Marks file for deletion"},{"detail":"PE file is protected by VMProtect"},{"detail":"PE file has a section name known to be used by a packer/protector"},{"detail":"Tries to delete scheduled tasks"}],"sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]}],"intel_graph":{"map":{"File:2f9612d2d7ce1f11ddef87bc8603dfd273b33293f4b26b9410f65509ff49aa12":{"type":"File","value":"2f9612d2d7ce1f11ddef87bc8603dfd273b33293f4b26b9410f65509ff49aa12"},"File:6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15ee1ca":{"type":"File","value":"6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15ee1ca"},"File:a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf":{"type":"File","value":"a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf"}},"chains":[{"id":"sandbox_files","root":"File:6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15ee1ca","edges":[{"edge_kind":"extracted","from_key":"File:6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15ee1ca","to_key":"File:2f9612d2d7ce1f11ddef87bc8603dfd273b33293f4b26b9410f65509ff49aa12"},{"edge_kind":"extracted","from_key":"File:6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15ee1ca","to_key":"File:a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":22,"spawned_processes_count":22,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":87,"dropped_files_count":0,"extracted_files_count":2,"files_written_count":8,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["evasive"],"sample_flags":["Multi-Process","Extracted Files","Sample Crashed"],"sandbox_reports":[{"id":"6a96958d56aaa026790ccb85","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"W64.Evo","submit_name":"6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15ee1ca","analysis_start_time":"2026-09-01T09:06:25+00:00","indicators_count":{"informative":175,"suspicious":26,"malicious":5},"tags":["Multi-Process","Extracted Files","Sample Crashed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}],"processes":[{"pid":7580,"ppid":0,"name":"","command_line":"","normalized_path":"","uid":"00000000-00007580"},{"pid":5972,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15ee1ca.dll\",#1","sha256":"b1e6a7a3e2597e51836277a32b2bc61aa781c8f681d44dfddea618b32e2bf2a6","normalized_path":"%WINDIR%\\System32\\rundll32.exe","uid":"00000000-00005972","icon":"$47"},{"pid":5316,"ppid":5972,"name":"WerFault.exe","command_line":"-u -p 5972 -s 392","sha256":"0476d175606aac098363c328166a33f85b7efc2d0be82c0d80ba406113affbfe","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00005972","uid":"00000000-00005316"},{"pid":4896,"ppid":5972,"name":"WerFault.exe","command_line":"-u -p 5972 -s 392","sha256":"0476d175606aac098363c328166a33f85b7efc2d0be82c0d80ba406113affbfe","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00005972","uid":"00000000-00004896"},{"pid":3500,"ppid":5972,"name":"WerFault.exe","command_line":"-u -p 5972 -s 392","sha256":"0476d175606aac098363c328166a33f85b7efc2d0be82c0d80ba406113affbfe","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00005972","uid":"00000000-00003500"},{"pid":3964,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15ee1ca.dll\",#2","sha256":"b1e6a7a3e2597e51836277a32b2bc61aa781c8f681d44dfddea618b32e2bf2a6","normalized_path":"%WINDIR%\\System32\\rundll32.exe","uid":"00000000-00003964","icon":"$48"},{"pid":8172,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15ee1ca.dll\",#4","sha256":"b1e6a7a3e2597e51836277a32b2bc61aa781c8f681d44dfddea618b32e2bf2a6","normalized_path":"%WINDIR%\\System32\\rundll32.exe","uid":"00000000-00008172","icon":"$49"},{"pid":6724,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15ee1ca.dll\",#3","sha256":"b1e6a7a3e2597e51836277a32b2bc61aa781c8f681d44dfddea618b32e2bf2a6","normalized_path":"%WINDIR%\\System32\\rundll32.exe","uid":"00000000-00006724","icon":"$4a"},{"pid":2964,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 460 -p 5972 -ip 5972","sha256":"0476d175606aac098363c328166a33f85b7efc2d0be82c0d80ba406113affbfe","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00002964","icon":"$4b"},{"pid":4864,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15ee1ca.dll\",#5","sha256":"b1e6a7a3e2597e51836277a32b2bc61aa781c8f681d44dfddea618b32e2bf2a6","normalized_path":"%WINDIR%\\System32\\rundll32.exe","uid":"00000000-00004864","icon":"$4c"},{"pid":7452,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15ee1ca.dll\",#6","sha256":"b1e6a7a3e2597e51836277a32b2bc61aa781c8f681d44dfddea618b32e2bf2a6","normalized_path":"%WINDIR%\\System32\\rundll32.exe","uid":"00000000-00007452","icon":"$4d"},{"pid":5116,"ppid":7452,"name":"WerFault.exe","command_line":"-u -p 7452 -s 536","sha256":"0476d175606aac098363c328166a33f85b7efc2d0be82c0d80ba406113affbfe","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00007452","uid":"00000000-00005116"},{"pid":2440,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15ee1ca.dll\",#7","sha256":"b1e6a7a3e2597e51836277a32b2bc61aa781c8f681d44dfddea618b32e2bf2a6","normalized_path":"%WINDIR%\\System32\\rundll32.exe","uid":"00000000-00002440","icon":"$4e"},{"pid":2104,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 460 -p 7452 -ip 7452","sha256":"0476d175606aac098363c328166a33f85b7efc2d0be82c0d80ba406113affbfe","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00002104","icon":"$4f"},{"pid":1380,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15ee1ca.dll\",#8","sha256":"b1e6a7a3e2597e51836277a32b2bc61aa781c8f681d44dfddea618b32e2bf2a6","normalized_path":"%WINDIR%\\System32\\rundll32.exe","uid":"00000000-00001380","icon":"$50"},{"pid":7592,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15ee1ca.dll\",#9","sha256":"b1e6a7a3e2597e51836277a32b2bc61aa781c8f681d44dfddea618b32e2bf2a6","normalized_path":"%WINDIR%\\System32\\rundll32.exe","uid":"00000000-00007592","icon":"$51"},{"pid":6904,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15ee1ca.dll\",#10","sha256":"b1e6a7a3e2597e51836277a32b2bc61aa781c8f681d44dfddea618b32e2bf2a6","normalized_path":"%WINDIR%\\System32\\rundll32.exe","uid":"00000000-00006904","icon":"$52"},{"pid":1176,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15ee1ca.dll\",#11","sha256":"b1e6a7a3e2597e51836277a32b2bc61aa781c8f681d44dfddea618b32e2bf2a6","normalized_path":"%WINDIR%\\System32\\rundll32.exe","uid":"00000000-00001176","icon":"$53"},{"pid":6060,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15ee1ca.dll\",#12","sha256":"b1e6a7a3e2597e51836277a32b2bc61aa781c8f681d44dfddea618b32e2bf2a6","normalized_path":"%WINDIR%\\System32\\rundll32.exe","uid":"00000000-00006060","icon":"$54"},{"pid":4232,"ppid":6060,"name":"schtasks.exe","command_line":"schtasks /delete /f /tn \"ChromeUpdateTaskMachineUAC\"","sha256":"3a0943826ebc7f6d76908e5bc6a14067265460b0742f89ae0f74b9380ef9a361","normalized_path":"%WINDIR%\\System32\\schtasks.exe","parent_uid":"00000000-00006060","uid":"00000000-00004232"},{"pid":6540,"ppid":6060,"name":"schtasks.exe","command_line":"schtasks /delete /f /tn \"ChromeUpdateTaskMachineUAC\"","sha256":"3a0943826ebc7f6d76908e5bc6a14067265460b0742f89ae0f74b9380ef9a361","normalized_path":"%WINDIR%\\System32\\schtasks.exe","parent_uid":"00000000-00006060","uid":"00000000-00006540"},{"pid":4404,"ppid":6060,"name":"powershell.exe","command_line":"-executionpolicy bypass -File \"%USERPROFILE%\\.tmp\\2687540094.ps1\"","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00006060","uid":"00000000-00004404"}],"all_imported_dlls":["wintrust.dll","Microsoft.PowerShell.Security.ni.dll","combase.dll","imm32.dll","cryptbase.dll","powrprof.dll","version.dll","Microsoft.PowerShell.ConsoleHost.ni.dll","msvcp140.dll","bcryptprimitives.dll","VxSSL64.dll","gdi32full.dll","ucrtbase_clr0400.dll","windows.storage.dll","crypt32.dll","MpClient.dll","shlwapi.dll","winmm.dll","profapi.dll","userenv.dll","aFVYhKQK.dll","System.Data.ni.dll","System.Transactions.dll","KernelBase.dll","atl.dll","System.Data.dll","slc.dll","sechost.dll","sspicli.dll","System.Core.ni.dll","System.Management.Automation.ni.dll","System.Numerics.ni.dll","System.Configuration.Install.ni.dll","user32.dll","win32u.dll","rsaenh.dll","System.Xml.ni.dll","sppc.dll","ole32.dll","System.Configuration.ni.dll","bcrypt.dll","Microsoft.Management.Infrastructure.ni.dll","vcruntime140_1.dll","kernel.appcore.dll","taskschd.dll","clr.dll","secur32.dll","wldp.dll","advapi32.dll","imagehlp.dll","vcruntime140_clr0400.dll","mscorlib.ni.dll","System.ni.dll","gpapi.dll","ws2_32.dll","wtsapi32.dll","cryptsp.dll","System.DirectoryServices.ni.dll","msvcrt.dll","vcruntime140.dll","winmmbase.dll","msctf.dll","clbcatq.dll","shell32.dll","MpOAV.dll","kernel32.dll","ucrtbase.dll","gdi32.dll","uxtheme.dll","cfgmgr32.dll","psapi.dll","6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15ee1ca.dll","rpcrt4.dll","msvcp_win.dll","dwmapi.dll","msasn1.dll","System.Management.ni.dll","ntdll.dll","fltLib.dll","mscoree.dll","mscoreei.dll","amsi.dll","clrjit.dll","System.Transactions.ni.dll","Microsoft.PowerShell.Commands.Management.ni.dll","SHCore.dll","oleaut32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"2687540094.ps1","sha256":"2f9612d2d7ce1f11ddef87bc8603dfd273b33293f4b26b9410f65509ff49aa12","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"name":"StartupProfileData-NonInteractive","sha256":"a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]}],"files_written":[{"path":"%USERPROFILE%\\.tmp\\2687540094.ps1","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"path":"%WINDIR%\\System32\\CatRoot","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"path":"%WINDIR%\\System32\\catroot2","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_zfgrmh45.ser.ps1","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_m44d4u1i.fsz.psm1","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive","sources":[{"report_type":"sandbox","report_id":"6a96958d56aaa026790ccb85"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["6a96958d56aaa026790ccb85"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Win/malicious_confidence_100% Sample 6c35a48cedb3… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 6c35a48cedb3…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 10/28 AV engines flagged this file. 6 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15ee1ca"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_100% Sample 6c35a48cedb3… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 6c35a48cedb3…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 10/28 AV engines flagged this file. 6 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/6c35a48cedb38a3e2c8d001a6d79f571bf0a70ddec99761aa4d3de2ad15ee1ca"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_100% Sample 6c35a48cedb3… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 6c35a48cedb3…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 10/28 AV engines flagged this file. 6 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L55","11",{}]]