24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 42:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4a9,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Ransom.Genasom.Generic Sample 6cb9afff8166… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 6cb9afff8166…. Malware family: Ransom.Genasom.Generic. Threat score 100/100. 24/25 AV engines flagged this file. 10 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306","keywords":["Malicious","Ransom.Genasom.Generic","malware analysis","sandbox report","threat intelligence","6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306"],"about":{"@type":"SoftwareApplication","name":"splwow32.bin","applicationCategory":["peexe","executable"],"identifier":"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Ransom.Genasom.Generic","antivirusDetections":{"malicious":24,"total":25},"behavioralIndicators":{"malicious":10,"suspicious":12},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T8f4,Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Active Directory Toplogy"" (UID: 00025044-00003192) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Anti-spam Update"" (UID: 00025046-00002208) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Compliance Audit"" (UID: 00025046-00001396) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Compliance Service"" (UID: 00025047-00002916) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange DAG Management"" (UID: 00025049-00003684) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Diagnostics"" (UID: 00025050-00003848) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange EdgeSync"" (UID: 00025050-00002176) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Frontend Transport"" (UID: 00025051-00002884) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Health Manager"" (UID: 00025053-00002880) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Health Manager Recovery"" (UID: 00025055-00003968) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange IMAP4"" (UID: 00025056-00002900) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange IMAP4 Backend"" (UID: 00025058-00002584) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Information Store"" (UID: 00025060-00003388) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Mailbox Assistants"" (UID: 00025064-00002960) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Mailbox Replication"" (UID: 00025067-00003772) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Mailbox Transport Delivery"" (UID: 00025068-00000688) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange POP3"" (UID: 00025069-00002604) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange POP3 Backend"" (UID: 00025070-00003548) Spawned process "sc.exe" with commandline "sc stop "SQL Server Agent (TESTINSTANCE)"" (UID: 00025085-00002564) Spawned process "sc.exe" with commandline "sc stop "SQL Server (TESTINSTANCE)"" (UID: 00025105-00002248)26:T8f4,Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Active Directory Toplogy"" (UID: 00025044-00003192) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Anti-spam Update"" (UID: 00025046-00002208) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Compliance Audit"" (UID: 00025046-00001396) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Compliance Service"" (UID: 00025047-00002916) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange DAG Management"" (UID: 00025049-00003684) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Diagnostics"" (UID: 00025050-00003848) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange EdgeSync"" (UID: 00025050-00002176) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Frontend Transport"" (UID: 00025051-00002884) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Health Manager"" (UID: 00025053-00002880) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Health Manager Recovery"" (UID: 00025055-00003968) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange IMAP4"" (UID: 00025056-00002900) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange IMAP4 Backend"" (UID: 00025058-00002584) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Information Store"" (UID: 00025060-00003388) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Mailbox Assistants"" (UID: 00025064-00002960) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Mailbox Replication"" (UID: 00025067-00003772) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Mailbox Transport Delivery"" (UID: 00025068-00000688) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange POP3"" (UID: 00025069-00002604) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange POP3 Backend"" (UID: 00025070-00003548) Spawned process "sc.exe" with commandline "sc stop "SQL Server Agent (TESTINSTANCE)"" (UID: 00025085-00002564) Spawned process "sc.exe" with commandline "sc stop "SQL Server (TESTINSTANCE)"" (UID: 00025105-00002248)27:T4a4,Found string "SystemFunction036" (Source: 6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.bin, API is part of module: CRYPTBASE.DLL) Found string "FlsSetValue" (Source: 6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.bin, API is part of module: KERNELBASE.DLL) Found string "FlsGetValue" (Source: 6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.bin, API is part of module: KERNELBASE.DLL) Found string "GetProcessWindowStation" (Source: 6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.bin, API is part of module: USER32.DLL) Found string "GetUserObjectInformationW" (Source: 6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.bin, API is part of module: USER32.DLL) Found string "GetLastActivePopup" (Source: 6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.bin, API is part of module: USER32.DLL) Found string "GetActiveWindow" (Source: 6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.bin, API is part of module: USER32.DLL) Found string "MessageBoxW" (Source: 6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.bin, API is part of module: USER32.DLL)28:T931,Spawned process "splwow32.bin.exe" (UID: 00024891-00001220) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Active Directory Toplogy"" (UID: 00025044-00003192) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Anti-spam Update"" (UID: 00025046-00002208) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Compliance Audit"" (UID: 00025046-00001396) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Compliance Service"" (UID: 00025047-00002916) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange DAG Management"" (UID: 00025049-00003684) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Diagnostics"" (UID: 00025050-00003848) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange EdgeSync"" (UID: 00025050-00002176) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Frontend Transport"" (UID: 00025051-00002884) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Health Manager"" (UID: 00025053-00002880) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Health Manager Recovery"" (UID: 00025055-00003968) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange IMAP4"" (UID: 00025056-00002900) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange IMAP4 Backend"" (UID: 00025058-00002584) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Information Store"" (UID: 00025060-00003388) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Mailbox Assistants"" (UID: 00025064-00002960) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Mailbox Replication"" (UID: 00025067-00003772) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange Mailbox Transport Delivery"" (UID: 00025068-00000688) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange POP3"" (UID: 00025069-00002604) Spawned process "sc.exe" with commandline "sc stop "Microsoft Exchange POP3 Backend"" (UID: 00025070-00003548) Spawned process "sc.exe" with commandline "sc stop "SQL Server Agent (TESTINSTANCE)"" (UID: 00025085-00002564) Spawned process "sc.exe" with commandline "sc stop "SQL Server (TESTINSTANCE)"" (UID: 00025105-00002248)29:T4ab,Found reference to API "ControlServiceEx" (Indicator: "ControlService"; Source: "00000000-00001388.00000000.196018.003A1000.00000020.mdmp") Found reference to API "ControlService" (Indicator: "ControlService"; Source: "00000000-00001388.00000000.196018.003A1000.00000020.mdmp") Found reference to API "ChangeServiceConfig2 (delayed autostart flag)" (Indicator: "ChangeServiceConfig"; Source: "00000000-00001388.00000000.196018.003A1000.00000020.mdmp") Found reference to API "ChangeServiceConfig" (Indicator: "ChangeServiceConfig"; Source: "00000000-00001388.00000000.196018.003A1000.00000020.mdmp") Found reference to API "ChangeServiceConfig2" (Indicator: "ChangeServiceConfig"; Source: "00000000-00001388.00000000.196018.003A1000.00000020.mdmp") Found reference to API "ChangeServiceConfigW" (Indicator: "ChangeServiceConfig"; Source: "00000000-00001388.00000000.196018.003A1000.00000020.mdmp") Found reference to API "ControlServiceExW" (Indicator: "ControlService"; Source: "00000000-00001388.00000000.196018.003A1000.00000020.mdmp") Found reference to API "ChangeServiceConfig2W" (Indicator: "ChangeServiceConfig"; Source: "00000000-00001388.00000000.196018.003A1000.00000020.mdmp")2a:T574,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00005048.00000000.195932.04F30000.00000004.mdmp, 00000000-00005048.00000001.197855.04F30000.00000004.mdmp, 00000000-00005048.00000002.199772.00A35000.00000002.mdmp, 00000000-00005048.00000002.199772.04F30000.00000004.mdmp, 00000000-00005048.00000002.199772.0B480000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00005048.00000000.195932.04F30000.00000004.mdmp, 00000000-00005048.00000001.197855.04F30000.00000004.mdmp, 00000000-00005048.00000002.199772.00A35000.00000002.mdmp, 00000000-00005048.00000002.199772.04F30000.00000004.mdmp, 00000000-00005048.00000002.199772.0B480000.00000004.mdmp")2b:T1542,"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" renamed original file"C:\$WINDOWS.~BT\Sources\acmigration.dll" to "C:\$WINDOWS.~BT\Sources\acmigration.dll.vhd" "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" renamed original file"C:\$WINDOWS.~BT\Sources\acres.dll" to "C:\$WINDOWS.~BT\Sources\acres.dll.vhd" "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" renamed original file"C:\$WINDOWS.~BT\Sources\aeinv.dll" to "C:\$WINDOWS.~BT\Sources\aeinv.dll.vhd" "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" renamed original file"C:\$WINDOWS.~BT\Sources\api-ms-win-core-apiquery-l1-1-0.dll" to "C:\$WINDOWS.~BT\Sources\api-ms-win-core-apiquery-l1-1-0.dll.vhd" "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" renamed original file"C:\$WINDOWS.~BT\Sources\api-ms-win-downlevel-advapi32-l1-1-0.dll" to "C:\$WINDOWS.~BT\Sources\api-ms-win-downlevel-advapi32-l1-1-0.dll.vhd" "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" renamed original file"C:\$WINDOWS.~BT\Sources\api-ms-win-downlevel-advapi32-l1-1-1.dll" to "C:\$WINDOWS.~BT\Sources\api-ms-win-downlevel-advapi32-l1-1-1.dll.vhd" "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" renamed original file"C:\$WINDOWS.~BT\Sources\api-ms-win-downlevel-advapi32-l2-1-0.dll" to "C:\$WINDOWS.~BT\Sources\api-ms-win-downlevel-advapi32-l2-1-0.dll.vhd" "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" renamed original file"C:\$WINDOWS.~BT\Sources\api-ms-win-downlevel-advapi32-l2-1-1.dll" to "C:\$WINDOWS.~BT\Sources\api-ms-win-downlevel-advapi32-l2-1-1.dll.vhd" "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" renamed original file"C:\$WINDOWS.~BT\Sources\api-ms-win-downlevel-advapi32-l3-1-0.dll" to "C:\$WINDOWS.~BT\Sources\api-ms-win-downlevel-advapi32-l3-1-0.dll.vhd" "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" renamed original file"C:\$WINDOWS.~BT\Sources\api-ms-win-downlevel-advapi32-l4-1-0.dll" to "C:\$WINDOWS.~BT\Sources\api-ms-win-downlevel-advapi32-l4-1-0.dll.vhd" "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" renamed original file"C:\$WINDOWS.~BT\Sources\api-ms-win-downlevel-kernel32-l1-1-0.dll" to "C:\$WINDOWS.~BT\Sources\api-ms-win-downlevel-kernel32-l1-1-0.dll.vhd" "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" renamed original file"C:\$WINDOWS.~BT\Sources\api-ms-win-downlevel-kernel32-l2-1-0.dll" to "C:\$WINDOWS.~BT\Sources\api-ms-win-downlevel-kernel32-l2-1-0.dll.vhd" "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" renamed original file"C:\$WINDOWS.~BT\Sources\api-ms-win-downlevel-ole32-l1-1-0.dll" to "C:\$WINDOWS.~BT\Sources\api-ms-win-downlevel-ole32-l1-1-0.dll.vhd" "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" renamed original file"C:\$WINDOWS.~BT\Sources\api-ms-win-downlevel-ole32-l1-1-1.dll" to "C:\$WINDOWS.~BT\Sources\api-ms-win-downlevel-ole32-l1-1-1.dll.vhd" "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" renamed original file"C:\$WINDOWS.~BT\Sources\api-ms-win-downlevel-shlwapi-l1-1-0.dll" to "C:\$WINDOWS.~BT\Sources\api-ms-win-downlevel-shlwapi-l1-1-0.dll.vhd" "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" renamed original file"C:\$WINDOWS.~BT\Sources\api-ms-win-downlevel-shlwapi-l1-1-1.dll" to "C:\$WINDOWS.~BT\Sources\api-ms-win-downlevel-shlwapi-l1-1-1.dll.vhd" "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" renamed original file"C:\$WINDOWS.~BT\Sources\api-ms-win-downlevel-user32-l1-1-0.dll" to "C:\$WINDOWS.~BT\Sources\api-ms-win-downlevel-user32-l1-1-0.dll.vhd" "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" renamed original file"C:\$WINDOWS.~BT\Sources\api-ms-win-downlevel-user32-l1-1-1.dll" to "C:\$WINDOWS.~BT\Sources\api-ms-win-downlevel-user32-l1-1-1.dll.vhd" "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" renamed original file"C:\$WINDOWS.~BT\Sources\api-ms-win-downlevel-version-l1-1-0.dll" to "C:\$WINDOWS.~BT\Sources\api-ms-win-downlevel-version-l1-1-0.dll.vhd" "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" renamed original file"C:\$WINDOWS.~BT\Sources\AppCompatServicing.dll" to "C:\$WINDOWS.~BT\Sources\AppCompatServicing.dll.vhd" "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" renamed original file"C:\$WINDOWS.~BT\Sources\appraiser.dll" to "C:\$WINDOWS.~BT\Sources\appraiser.dll.vhd" "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" renamed original file"C:\$WINDOWS.~BT\Sources\appraiser.sdb" to "C:\$WINDOWS.~BT\Sources\appraiser.sdb.vhd" "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" renamed original file"C:\$WINDOWS.~BT\Sources\AppraiserRes.dll" to "C:\$WINDOWS.~BT\Sources\AppraiserRes.dll.vhd" "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" renamed original file"C:\$WINDOWS.~BT\Sources\cmi2migxml.dll" to "C:\$WINDOWS.~BT\Sources\cmi2migxml.dll.vhd" "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" renamed original file"C:\$WINDOWS.~BT\Sources\compatctrl.dll" to "C:\$WINDOWS.~BT\Sources\compatctrl.dll.vhd"2c:T4bd,Found reference to API "CryptDecrypt" (Indicator: "CryptDecrypt"; Source: "00000000-00000756.00000000.196013.02BD0000.00000004.mdmp") Found reference to API "CryptDecrypt" (Indicator: "CryptDecrypt"; Source: "00000000-00001388.00000000.196018.02920000.00000004.mdmp") Found reference to API "CryptDecrypt" (Indicator: "CryptDecrypt"; Source: "00000000-00004028.00000000.196014.02C40000.00000004.mdmp") Found reference to API "CryptDecrypt" (Indicator: "CryptDecrypt"; Source: "00000000-00004292.00000000.196016.032A0000.00000004.mdmp") Found reference to API "CryptDecrypt" (Indicator: "CryptDecrypt"; Source: "00000000-00004768.00000000.196019.02E10000.00000004.mdmp") Found reference to API "CryptDecrypt" (Indicator: "CryptDecrypt"; Source: "00000000-00005520.00000000.196018.02D70000.00000004.mdmp") Found reference to API "CryptDecrypt" (Indicator: "CryptDecrypt"; Source: "00000000-00006944.00000000.196014.02700000.00000004.mdmp") Found reference to API "CryptDecrypt" (Indicator: "CryptDecrypt"; Source: "00000000-00007460.00000000.196014.02B80000.00000004.mdmp") Found reference to API "CryptDecrypt" (Indicator: "CryptDecrypt"; Source: "00000000-00007900.00000000.196022.02ED0000.00000004.mdmp")2d:T408,"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "RtlGetNtProductType" with parameter 01000000 (UID: 00000000-00005048) "sc.exe" called "RtlGetNtProductType" with parameter 01000000 (UID: 00000000-00004288) "sc.exe" called "RtlGetNtProductType" with parameter 01000000 (UID: 00000000-00004300) "sc.exe" called "RtlGetNtProductType" with parameter 01000000 (UID: 00000000-00000756) "sc.exe" called "RtlGetNtProductType" with parameter 01000000 (UID: 00000000-00004028) "sc.exe" called "RtlGetNtProductType" with parameter 01000000 (UID: 00000000-00006944) "sc.exe" called "RtlGetNtProductType" with parameter 01000000 (UID: 00000000-00005240) "sc.exe" called "RtlGetNtProductType" with parameter 01000000 (UID: 00000000-00006920) "sc.exe" called "RtlGetNtProductType" with parameter 01000000 (UID: 00000000-00004804) "sc.exe" called "RtlGetNtProductType" with parameter 01000000 (UID: 00000000-00004292) "sc.exe" called "RtlGetNtProductType" with parameter 01000000 (UID: 00000000-00007460)2e:Tfb2,"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000c0010000020000000000000000000000d007be002800000000000000310000000000be0000000000196a000000000000e0dbba003872e802e866e7021a00000000000000200000000000be00cc01be000000be00000000006808be0000000000e8e8ba005916ed762000000008001400000000000000e50200000000280000000000000050f5ec7605000000050000003801e902200000008808e902a8ffe8020b000000fce8ba005243f0764300000050e9ba0073f68c7308eaba005c0000000000000038ffff7f82f88c7300000000b8fdffff45ffffff0000000000000000000000000b00000066ecba00bb000000bb00000004010000d4ebba00 (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005048) "sc.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004288) "sc.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004300)2f:T52a,Found reference to API "OpenSCManager" (Indicator: "OpenSCManager"; Source: "00000000-00001388.00000000.196018.003A1000.00000020.mdmp") Found reference to API "EnumServicesStatusEx" (Indicator: "EnumServicesStatus"; Source: "00000000-00001388.00000000.196018.003A1000.00000020.mdmp") Found reference to API "EnumServicesStatus" (Indicator: "EnumServicesStatus"; Source: "00000000-00001388.00000000.196018.003A1000.00000020.mdmp") Found reference to API "QueryServiceStatusEx" (Indicator: "QueryServiceStatus"; Source: "00000000-00001388.00000000.196018.003A1000.00000020.mdmp") Found reference to API "EnumDependentServices" (Indicator: "EnumDependentServices"; Source: "00000000-00001388.00000000.196018.003A1000.00000020.mdmp") Found reference to API "EnumServicesStatusExW" (Indicator: "EnumServicesStatus"; Source: "00000000-00001388.00000000.196018.003A1000.00000020.mdmp") Found reference to API "EnumDependentServicesW" (Indicator: "EnumDependentServices"; Source: "00000000-00001388.00000000.196018.003A1000.00000020.mdmp") Found reference to API "OpenSCManagerW" (Indicator: "OpenSCManager"; Source: "00000000-00001388.00000000.196018.003A1000.00000020.mdmp") Found reference to API "QueryServiceStatus" (Indicator: "QueryServiceStatus"; Source: "00000000-00001388.00000000.196018.003A1000.00000020.mdmp")30:T221a,"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "LoadLibrary" with a parameter ADVAPI32.DLL (UID: 00000000-00005048) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004288) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004288) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004288) "sc.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004288) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004300) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004300) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004300) "sc.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004300) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000756) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000756) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000756) "sc.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000756) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004028) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004028) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004028) "sc.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004028) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006944) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006944) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006944) "sc.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006944) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005240) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005240) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005240) "sc.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005240) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006920) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006920) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006920) "sc.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006920) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004804) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004804) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004804) "sc.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004804) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004292) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004292) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004292) "sc.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004292) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007460) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007460) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007460) "sc.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007460) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005520) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005520) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005520) "sc.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005520) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004888) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004888) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004888) "sc.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004888) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007244) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007244) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007244) "sc.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007244) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004768) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004768) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004768) "sc.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004768) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001388) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001388) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001388) "sc.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001388) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005628) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005628) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005628) "sc.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005628) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006796) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006796) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006796) "sc.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006796) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001160) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001160) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001160) "sc.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001160) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007900) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007900) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007900) "sc.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007900) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001276) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001276) "sc.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001276) "sc.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001276)31:T170cf,"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00005048) "sc.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004288) "sc.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004288) "sc.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004288) "sc.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004288) "sc.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004288) "sc.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004288) "sc.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004288) "sc.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004288) "sc.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004288) "sc.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004288) "sc.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004288) "sc.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004288) "sc.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004288) "sc.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004288) "sc.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004288) "sc.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004288) "sc.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004288) "sc.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004288) "sc.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004288) "sc.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004288) "sc.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004288) "sc.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004288) "sc.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004288) "sc.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004288) "sc.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004288) "sc.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004288) "sc.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004288) "sc.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004288) "sc.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004288) "sc.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004288) "sc.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004288) "sc.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004288) "sc.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004288) "sc.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004288) "sc.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004288) "sc.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004288) "sc.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004288) "sc.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004288) "sc.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004288) "sc.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004288) "sc.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004288) "sc.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004288) "sc.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004288) "sc.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004288) "sc.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004288) "sc.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004300) "sc.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004300) "sc.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004300) "sc.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004300) "sc.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004300) "sc.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004300) "sc.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004300) "sc.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004300) "sc.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004300) "sc.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004300) "sc.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004300) "sc.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004300) "sc.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004300) "sc.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004300) "sc.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004300) "sc.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004300) "sc.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004300) "sc.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004300) "sc.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004300) "sc.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004300) "sc.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004300) "sc.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004300) "sc.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004300) "sc.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004300) "sc.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004300) "sc.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004300) "sc.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004300) "sc.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004300) "sc.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004300) "sc.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004300) "sc.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004300) "sc.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004300) "sc.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004300) "sc.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004300) "sc.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004300) "sc.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004300) "sc.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004300) "sc.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004300) "sc.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004300) "sc.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004300) "sc.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004300) "sc.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004300) "sc.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004300) "sc.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004300) "sc.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004300) "sc.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00000756) "sc.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00000756) "sc.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00000756) "sc.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000756) "sc.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00000756) "sc.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00000756) "sc.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00000756) "sc.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00000756) "sc.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00000756) "sc.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00000756) "sc.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00000756) "sc.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00000756) "sc.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00000756) "sc.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00000756) "sc.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00000756) "sc.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00000756) "sc.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00000756) "sc.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00000756) "sc.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00000756) "sc.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00000756) "sc.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00000756) "sc.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00000756) "sc.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00000756) "sc.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00000756) "sc.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00000756) "sc.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00000756) "sc.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00000756) "sc.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00000756) "sc.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00000756) "sc.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00000756) "sc.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00000756) "sc.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00000756) "sc.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00000756) "sc.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00000756) "sc.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00000756) "sc.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00000756) "sc.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00000756) "sc.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00000756) "sc.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00000756) "sc.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00000756) "sc.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00000756) "sc.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00000756) "sc.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00000756) "sc.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00000756) "sc.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00000756) "sc.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004028) "sc.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004028) "sc.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004028) "sc.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004028) "sc.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004028) "sc.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004028) "sc.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004028) "sc.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004028) "sc.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004028) "sc.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004028) "sc.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004028) "sc.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004028) "sc.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004028) "sc.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004028) "sc.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004028) "sc.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004028) "sc.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004028) "sc.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004028) "sc.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004028) "sc.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004028) "sc.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004028) "sc.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004028) "sc.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004028) "sc.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004028) "sc.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004028) "sc.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004028) "sc.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004028) "sc.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004028) "sc.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004028) "sc.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004028) "sc.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004028) "sc.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004028) "sc.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004028) "sc.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004028) "sc.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004028) "sc.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004028) "sc.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004028) "sc.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004028) "sc.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004028) "sc.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004028) "sc.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004028) "sc.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004028) "sc.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004028) "sc.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004028) "sc.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004028) "sc.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006944) "sc.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006944) "sc.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006944) "sc.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006944) "sc.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006944) "sc.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006944) "sc.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006944) "sc.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006944) "sc.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006944) "sc.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006944) "sc.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006944) "sc.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006944) "sc.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006944) "sc.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006944) "sc.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006944) "sc.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006944) "sc.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006944) "sc.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006944) "sc.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006944) "sc.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006944) "sc.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006944) "sc.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006944) "sc.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006944) "sc.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006944) "sc.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006944) "sc.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006944) "sc.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006944) "sc.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006944) "sc.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006944) "sc.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006944) "sc.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006944) "sc.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006944) "sc.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006944) "sc.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006944) "sc.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006944) "sc.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006944) "sc.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006944) "sc.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006944) "sc.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006944) "sc.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006944) "sc.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006944) "sc.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006944) "sc.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006944) "sc.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006944) "sc.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006944) "sc.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005240) "sc.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005240) "sc.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005240) "sc.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005240) "sc.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005240) "sc.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005240) "sc.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005240) "sc.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005240) "sc.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005240) "sc.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005240) "sc.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005240) "sc.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005240) "sc.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005240) "sc.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005240) "sc.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005240) "sc.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005240) "sc.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005240) "sc.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005240) "sc.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005240) "sc.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005240) "sc.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005240) "sc.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005240) "sc.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005240) "sc.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005240) "sc.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005240) "sc.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005240) "sc.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005240) "sc.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005240) "sc.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005240) "sc.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005240) "sc.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005240) "sc.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005240) "sc.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005240) "sc.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005240) "sc.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005240) "sc.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005240) "sc.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005240) "sc.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005240) "sc.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005240) "sc.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005240) "sc.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005240) "sc.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005240) "sc.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005240) "sc.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005240) "sc.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005240) "sc.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006920) "sc.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006920) "sc.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006920) "sc.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006920) "sc.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006920) "sc.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006920) "sc.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006920) "sc.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006920) "sc.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006920) "sc.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006920) "sc.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006920) "sc.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006920) "sc.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006920) "sc.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006920) "sc.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006920) "sc.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006920) "sc.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006920) "sc.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006920) "sc.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006920) "sc.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006920) "sc.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006920) "sc.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006920) "sc.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006920) "sc.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006920) "sc.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006920) "sc.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006920) "sc.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006920) "sc.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006920) "sc.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006920) "sc.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006920) "sc.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006920) "sc.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006920) "sc.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006920) "sc.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006920) "sc.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006920) "sc.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006920) "sc.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006920) "sc.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006920) "sc.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006920) "sc.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006920) "sc.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006920) "sc.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006920) "sc.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006920) "sc.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006920) "sc.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006920) "sc.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004804) "sc.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004804) "sc.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004804) "sc.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004804) "sc.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004804) "sc.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004804) "sc.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004804) "sc.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004804) "sc.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004804) "sc.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004804) "sc.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004804) "sc.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004804) "sc.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004804) "sc.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004804) "sc.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004804) "sc.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004804) "sc.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004804) "sc.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004804) "sc.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004804) "sc.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004804) "sc.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004804) "sc.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004804) "sc.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004804) "sc.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004804) "sc.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004804) "sc.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004804) "sc.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004804) "sc.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004804) "sc.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004804) "sc.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004804) "sc.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004804) "sc.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004804) "sc.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004804) "sc.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004804) "sc.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004804) "sc.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004804) "sc.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004804) "sc.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004804) "sc.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004804) "sc.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004804) "sc.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004804) "sc.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004804) "sc.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004804) "sc.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004804) "sc.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004804) "sc.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004292) "sc.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004292) "sc.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004292) "sc.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004292) "sc.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004292) "sc.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004292) "sc.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004292) "sc.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004292) "sc.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004292) "sc.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004292) "sc.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004292) "sc.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004292) "sc.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004292) "sc.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004292) "sc.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004292) "sc.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004292) "sc.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004292) "sc.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004292) "sc.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004292) "sc.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004292) "sc.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004292) "sc.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004292) "sc.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004292) "sc.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004292) "sc.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004292) "sc.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004292) "sc.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004292) "sc.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004292) "sc.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004292) "sc.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004292) "sc.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004292) "sc.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004292) "sc.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004292) "sc.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004292) "sc.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004292) "sc.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004292) "sc.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004292) "sc.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004292) "sc.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004292) "sc.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004292) "sc.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004292) "sc.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004292) "sc.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004292) "sc.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004292) "sc.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004292) "sc.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007460) "sc.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007460) "sc.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007460) "sc.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007460) "sc.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007460) "sc.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007460) "sc.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007460) "sc.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007460) "sc.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007460) "sc.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007460) "sc.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007460) "sc.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007460) "sc.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007460) "sc.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007460) "sc.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007460) "sc.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007460) "sc.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007460) "sc.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007460) "sc.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007460) "sc.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007460) "sc.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007460) "sc.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007460) "sc.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007460) "sc.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007460) "sc.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007460) "sc.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007460) "sc.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007460) "sc.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007460) "sc.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007460) "sc.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007460) "sc.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007460) "sc.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007460) "sc.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007460) "sc.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007460) "sc.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007460) "sc.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007460) "sc.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007460) "sc.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007460) "sc.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007460) "sc.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007460) "sc.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007460) "sc.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007460) "sc.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007460) "sc.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007460) "sc.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007460) "sc.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005520) "sc.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005520) "sc.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005520) "sc.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005520) "sc.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005520) "sc.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005520) "sc.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005520) "sc.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005520) "sc.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005520) "sc.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005520) "sc.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005520) "sc.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005520) "sc.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005520) "sc.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005520) "sc.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005520) "sc.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005520) "sc.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005520) "sc.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005520) "sc.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005520) "sc.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005520) "sc.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005520) "sc.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005520) "sc.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005520) "sc.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005520) "sc.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005520) "sc.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005520) "sc.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005520) "sc.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005520) "sc.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005520) "sc.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005520) "sc.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005520) "sc.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005520) "sc.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005520) "sc.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005520) "sc.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005520) "sc.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005520) "sc.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005520) "sc.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005520) "sc.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005520) "sc.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005520) "sc.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005520) "sc.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005520) "sc.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005520) "sc.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005520) "sc.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005520) "sc.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004888) "sc.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004888) "sc.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004888) "sc.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004888) "sc.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004888) "sc.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004888) "sc.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004888) "sc.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004888) "sc.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004888) "sc.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004888) "sc.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004888) "sc.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004888) "sc.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004888) "sc.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004888) "sc.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004888) "sc.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004888) "sc.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004888) "sc.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004888) "sc.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004888) "sc.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004888) "sc.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004888) "sc.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004888) "sc.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004888) "sc.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004888) "sc.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004888) "sc.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004888) "sc.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004888) "sc.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004888) "sc.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004888) "sc.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004888) "sc.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004888) "sc.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004888) "sc.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004888) "sc.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004888) "sc.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004888) "sc.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004888) "sc.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004888) "sc.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004888) "sc.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004888) "sc.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004888) "sc.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004888) "sc.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004888) "sc.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004888) "sc.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004888) "sc.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004888) "sc.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007244) "sc.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007244) "sc.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007244) "sc.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007244) "sc.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007244) "sc.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007244) "sc.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007244) "sc.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007244) "sc.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007244) "sc.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007244) "sc.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007244) "sc.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007244) "sc.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007244) "sc.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007244) "sc.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007244) "sc.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007244) "sc.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007244) "sc.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007244) "sc.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007244) "sc.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007244) "sc.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007244) "sc.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007244) "sc.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007244) "sc.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007244) "sc.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007244) "sc.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007244) "sc.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007244) "sc.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007244) "sc.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007244) "sc.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007244) "sc.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007244) "sc.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007244) "sc.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007244) "sc.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007244) "sc.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007244) "sc.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007244) "sc.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007244) "sc.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007244) "sc.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007244) "sc.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007244) "sc.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007244) "sc.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007244) "sc.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007244) "sc.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007244) "sc.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007244) "sc.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004768) "sc.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004768) "sc.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004768) "sc.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004768) "sc.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004768) "sc.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004768) "sc.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004768) "sc.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004768) "sc.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004768) "sc.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004768) "sc.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004768) "sc.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004768) "sc.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004768) "sc.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004768) "sc.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004768) "sc.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004768) "sc.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004768) "sc.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004768) "sc.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004768) "sc.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004768) "sc.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004768) "sc.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004768) "sc.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004768) "sc.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004768) "sc.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004768) "sc.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004768) "sc.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004768) "sc.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004768) "sc.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004768) "sc.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004768) "sc.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004768) "sc.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004768) "sc.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004768) "sc.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004768) "sc.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004768) "sc.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004768) "sc.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004768) "sc.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004768) "sc.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004768) "sc.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004768) "sc.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004768) "sc.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004768) "sc.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004768) "sc.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004768) "sc.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004768) "sc.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00001388) "sc.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00001388) "sc.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00001388) "sc.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001388) "sc.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00001388) "sc.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001388) "sc.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00001388) "sc.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00001388) "sc.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00001388) "sc.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00001388) "sc.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00001388) "sc.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00001388) "sc.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00001388) "sc.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00001388) "sc.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00001388) "sc.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00001388) "sc.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00001388) "sc.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00001388) "sc.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00001388) "sc.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00001388) "sc.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00001388) "sc.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00001388) "sc.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00001388) "sc.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00001388) "sc.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00001388) "sc.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00001388) "sc.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00001388) "sc.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00001388) "sc.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001388) "sc.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001388) "sc.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00001388) "sc.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00001388) "sc.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00001388) "sc.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00001388) "sc.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00001388) "sc.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00001388) "sc.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00001388) "sc.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00001388) "sc.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00001388) "sc.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00001388) "sc.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00001388) "sc.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001388) "sc.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001388) "sc.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00001388) "sc.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00001388) "sc.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005628) "sc.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005628) "sc.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005628) "sc.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005628) "sc.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005628) "sc.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005628) "sc.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005628) "sc.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005628) "sc.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005628) "sc.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005628) "sc.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005628) "sc.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005628) "sc.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005628) "sc.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005628) "sc.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005628) "sc.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005628) "sc.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005628) "sc.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005628) "sc.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005628) "sc.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005628) "sc.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005628) "sc.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005628) "sc.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005628) "sc.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005628) "sc.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005628) "sc.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005628) "sc.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005628) "sc.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005628) "sc.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005628) "sc.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005628) "sc.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005628) "sc.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005628) "sc.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005628) "sc.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005628) "sc.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005628) "sc.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005628) "sc.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005628) "sc.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005628) "sc.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005628) "sc.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005628) "sc.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005628) "sc.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005628) "sc.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005628) "sc.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005628) "sc.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005628) "sc.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006796) "sc.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006796) "sc.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006796) "sc.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006796) "sc.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006796) "sc.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006796) "sc.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006796) "sc.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006796) "sc.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006796) "sc.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006796) "sc.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006796) "sc.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006796) "sc.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006796) "sc.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006796) "sc.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006796) "sc.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006796) "sc.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006796) "sc.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006796) "sc.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006796) "sc.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006796) "sc.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006796) "sc.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006796) "sc.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006796) "sc.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006796) "sc.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006796) "sc.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006796) "sc.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006796) "sc.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006796) "sc.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006796) "sc.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006796) "sc.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006796) "sc.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006796) "sc.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006796) "sc.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006796) "sc.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006796) "sc.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006796) "sc.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006796) "sc.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006796) "sc.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006796) "sc.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006796) "sc.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006796) "sc.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006796) "sc.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006796) "sc.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006796) "sc.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006796) "sc.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00001160) "sc.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00001160) "sc.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00001160) "sc.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001160) "sc.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00001160) "sc.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001160) "sc.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00001160) "sc.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00001160) "sc.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00001160) "sc.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00001160) "sc.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00001160) "sc.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00001160) "sc.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00001160) "sc.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00001160) "sc.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00001160) "sc.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00001160) "sc.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00001160) "sc.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00001160) "sc.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00001160) "sc.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00001160) "sc.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00001160) "sc.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00001160) "sc.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00001160) "sc.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00001160) "sc.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00001160) "sc.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00001160) "sc.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00001160) "sc.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00001160) "sc.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001160) "sc.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001160) "sc.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00001160) "sc.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00001160) "sc.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00001160) "sc.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00001160) "sc.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00001160) "sc.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00001160) "sc.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00001160) "sc.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00001160) "sc.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00001160) "sc.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00001160) "sc.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00001160) "sc.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001160) "sc.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001160) "sc.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00001160) "sc.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00001160) "sc.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007900) "sc.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007900) "sc.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007900) "sc.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007900) "sc.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007900) "sc.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007900) "sc.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007900) "sc.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007900) "sc.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007900) "sc.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007900) "sc.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007900) "sc.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007900) "sc.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007900) "sc.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007900) "sc.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007900) "sc.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007900) "sc.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007900) "sc.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007900) "sc.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007900) "sc.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007900) "sc.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007900) "sc.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007900) "sc.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007900) "sc.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007900) "sc.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007900) "sc.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007900) "sc.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007900) "sc.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007900) "sc.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007900) "sc.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007900) "sc.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007900) "sc.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007900) "sc.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007900) "sc.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007900) "sc.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007900) "sc.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007900) "sc.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007900) "sc.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007900) "sc.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007900) "sc.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007900) "sc.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007900) "sc.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007900) "sc.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007900) "sc.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007900) "sc.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007900) "sc.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00001276) "sc.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00001276) "sc.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00001276) "sc.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001276) "sc.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00001276) "sc.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001276) "sc.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00001276) "sc.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00001276) "sc.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00001276) "sc.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00001276) "sc.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00001276) "sc.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00001276) "sc.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00001276) "sc.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00001276) "sc.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00001276) "sc.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00001276) "sc.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00001276) "sc.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00001276) "sc.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00001276) "sc.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00001276) "sc.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00001276) "sc.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00001276) "sc.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00001276) "sc.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00001276) "sc.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00001276) "sc.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00001276) "sc.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00001276) "sc.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00001276) "sc.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001276) "sc.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001276) "sc.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00001276) "sc.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00001276) "sc.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00001276) "sc.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00001276) "sc.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00001276) "sc.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00001276) "sc.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00001276) "sc.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00001276) "sc.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00001276) "sc.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00001276) "sc.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00001276) "sc.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001276) "sc.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001276) "sc.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00001276) "sc.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00001276)32:T927f,Found reference to API (Indicator: "GetStockObject"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "GetLastError"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "HeapFree"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "GetStdHandle"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "EnterCriticalSection"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "LCMapStringW"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "ReadFile"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "SetHandleCount"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "GetModuleFileNameW"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "GetConsoleCP"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "FreeLibrary"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "HeapAlloc"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "ExitProcess"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "TlsAlloc"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "FlushFileBuffers"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "GetModuleFileNameA"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "RtlUnwind"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "WinExec"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "DeleteCriticalSection"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "GetCurrentProcess"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "GetDriveTypeW"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "MoveFileW"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "GetConsoleMode"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "GetStringTypeW"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "GetCurrentProcessId"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "WriteConsoleW"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "WideCharToMultiByte"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "TlsGetValue"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "MultiByteToWideChar"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "GetStartupInfoW"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "GetLogicalDrives"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "GetCommandLineA"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "GetProcAddress"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "HeapSize"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "SetStdHandle"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "RemoveDirectoryW"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "RaiseException"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "GetCPInfo"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "LoadLibraryW"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "TlsFree"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "SetFilePointer"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "HeapSetInformation"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "FindNextFileW"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "SetEndOfFile"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "InterlockedExchange"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "WriteFile"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "CreateMutexW"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "CloseHandle"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "GetComputerNameA"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "FindFirstFileW"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "GetACP"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "HeapReAlloc"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "DecodePointer"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "GetModuleHandleW"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "GetOEMCP"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "IsDebuggerPresent"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "TerminateProcess"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "IsValidCodePage"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "HeapCreate"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "CreateFileW"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "SetFilePointerEx"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "FindClose"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "InterlockedDecrement"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "Sleep"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "GetFileType"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "GetTickCount"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "TlsSetValue"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "EncodePointer"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "GetCurrentThreadId"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "LeaveCriticalSection"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "GetFileSize"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "SetLastError"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "InterlockedIncrement"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "SHGetSpecialFolderPathW"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "GetSystemMetrics"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "RegisterClassW"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "LoadCursorW"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "CreateWindowExW"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "ShowWindow"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "FlsFree"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "FlsSetValue"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "FlsGetValue"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "FlsAlloc"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "GetProcessWindowStation"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "GetUserObjectInformationW"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "GetLastActivePopup"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "GetActiveWindow"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "MessageBoxW"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API (Indicator: "CryptEncrypt"; Source: "00000000-00000756.00000000.196013.02BD0000.00000004.mdmp") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00000756.00000000.196013.02BD0000.00000004.mdmp") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00000756.00000000.196013.02BD0000.00000004.mdmp") Found reference to API (Indicator: "OpenService"; Source: "00000000-00001388.00000000.196018.003A1000.00000020.mdmp") Found reference to API (Indicator: "OpenSCManager"; Source: "00000000-00001388.00000000.196018.003A1000.00000020.mdmp") Found reference to API (Indicator: "EnumServicesStatusEx"; Source: "00000000-00001388.00000000.196018.003A1000.00000020.mdmp") Found reference to API (Indicator: "EnumServicesStatus"; Source: "00000000-00001388.00000000.196018.003A1000.00000020.mdmp") Found reference to API (Indicator: "QueryServiceStatusEx"; Source: "00000000-00001388.00000000.196018.003A1000.00000020.mdmp") Found reference to API (Indicator: "StartService"; Source: "00000000-00001388.00000000.196018.003A1000.00000020.mdmp") Found reference to API (Indicator: "DeleteService"; Source: "00000000-00001388.00000000.196018.003A1000.00000020.mdmp") Found reference to API (Indicator: "ControlServiceEx"; Source: "00000000-00001388.00000000.196018.003A1000.00000020.mdmp") Found reference to API (Indicator: "ControlService"; Source: "00000000-00001388.00000000.196018.003A1000.00000020.mdmp") Found reference to API (Indicator: "ChangeServiceConfig"; Source: "00000000-00001388.00000000.196018.003A1000.00000020.mdmp") Found reference to API (Indicator: "CreateService"; Source: "00000000-00001388.00000000.196018.003A1000.00000020.mdmp") Found reference to API (Indicator: "EnumDependentServices"; Source: "00000000-00001388.00000000.196018.003A1000.00000020.mdmp") Found reference to API (Indicator: "QueryServiceObjectSecurity"; Source: "00000000-00001388.00000000.196018.003A1000.00000020.mdmp") Found reference to API (Indicator: "ConvertSecurityDescriptorToStringSecurityDescriptor"; Source: "00000000-00001388.00000000.196018.003A1000.00000020.mdmp") Found reference to API (Indicator: "ConvertStringSecurityDescriptorToSecurityDescriptor"; Source: "00000000-00001388.00000000.196018.003A1000.00000020.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorControl"; Source: "00000000-00001388.00000000.196018.003A1000.00000020.mdmp, 00000000-00001388.00000000.196018.003AF000.00000002.mdmp") Found reference to API (Indicator: "SetServiceObjectSecurity"; Source: "00000000-00001388.00000000.196018.003A1000.00000020.mdmp") Found reference to API (Indicator: "QueryServiceConfig"; Source: "00000000-00001388.00000000.196018.003A1000.00000020.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00001388.00000000.196018.003A1000.00000020.mdmp, 00000000-00001388.00000000.196018.003AF000.00000002.mdmp") Found reference to API (Indicator: "RtlCreateServiceSid"; Source: "00000000-00001388.00000000.196018.003A1000.00000020.mdmp, 00000000-00001388.00000000.196018.003AF000.00000002.mdmp") Found reference to API (Indicator: "ConvertSidToStringSid"; Source: "00000000-00001388.00000000.196018.003A1000.00000020.mdmp") Found reference to API (Indicator: "CryptBinaryToStringW"; Source: "00000000-00001388.00000000.196018.003A1000.00000020.mdmp") Found reference to API (Indicator: "ConvertStringSecurityDescriptorToSecurityDescriptorW"; Source: "00000000-00001388.00000000.196018.003A1000.00000020.mdmp") Found reference to API (Indicator: "OpenServiceW"; Source: "00000000-00001388.00000000.196018.003A1000.00000020.mdmp") Found reference to API (Indicator: "ChangeServiceConfigW"; Source: "00000000-00001388.00000000.196018.003A1000.00000020.mdmp") Found reference to API (Indicator: "QueryServiceConfigW"; Source: "00000000-00001388.00000000.196018.003A1000.00000020.mdmp") Found reference to API (Indicator: "ConvertSidToStringSidW"; Source: "00000000-00001388.00000000.196018.003A1000.00000020.mdmp") Found reference to API (Indicator: "EnumServicesStatusExW"; Source: "00000000-00001388.00000000.196018.003A1000.00000020.mdmp") Found reference to API (Indicator: "StartServiceW"; Source: "00000000-00001388.00000000.196018.003A1000.00000020.mdmp") Found reference to API (Indicator: "ConvertSecurityDescriptorToStringSecurityDescriptorW"; Source: "00000000-00001388.00000000.196018.003A1000.00000020.mdmp") Found reference to API (Indicator: "OpenSCManagerW"; Source: "00000000-00001388.00000000.196018.003A1000.00000020.mdmp") Found reference to API (Indicator: "CloseServiceHandle"; Source: "00000000-00001388.00000000.196018.003A1000.00000020.mdmp") Found reference to API (Indicator: "QueryServiceStatus"; Source: "00000000-00001388.00000000.196018.003A1000.00000020.mdmp") Found reference to API (Indicator: "CreateServiceW"; Source: "00000000-00001388.00000000.196018.003A1000.00000020.mdmp") Found reference to API (Indicator: "CryptStringToBinaryW"; Source: "00000000-00001388.00000000.196018.003A1000.00000020.mdmp") Found reference to API (Indicator: "UuidFromStringW"; Source: "00000000-00001388.00000000.196018.003AF000.00000002.mdmp") Found reference to API (Indicator: "UuidEqual"; Source: "00000000-00001388.00000000.196018.003AF000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00001388.00000000.196018.003AF000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00001388.00000000.196018.003AF000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00001388.00000000.196018.003AF000.00000002.mdmp") Found reference to API (Indicator: "UuidToStringW"; Source: "00000000-00001388.00000000.196018.003AF000.00000002.mdmp") Found reference to API (Indicator: "RpcStringFreeW"; Source: "00000000-00001388.00000000.196018.003AF000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00001388.00000000.196018.003AF000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00001388.00000000.196018.003AF000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00001388.00000000.196018.003AF000.00000002.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00001388.00000000.196018.003AF000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00001388.00000000.196018.003AF000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00001388.00000000.196018.003AF000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00001388.00000000.196018.003AF000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00001388.00000000.196018.003AF000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00001388.00000000.196018.003AF000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00001388.00000000.196018.003AF000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00001388.00000000.196018.003AF000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00001388.00000000.196018.003AF000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00001388.00000000.196018.003AF000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00001388.00000000.196018.003AF000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001388.00000000.196018.003AF000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00001388.00000000.196018.003AF000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00001388.00000000.196018.003AF000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001388.00000000.196018.003AF000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00001388.00000000.196018.003AF000.00000002.mdmp") Found reference to API (Indicator: "RtlInitUnicodeString"; Source: "00000000-00001388.00000000.196018.003AF000.00000002.mdmp") Found reference to API (Indicator: "RtlAdjustPrivilege"; Source: "00000000-00001388.00000000.196018.003AF000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00001388.00000000.196018.003AF000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00001388.00000000.196018.003AF000.00000002.mdmp") Found reference to API (Indicator: "I_RpcExceptionFilter"; Source: "00000000-00001388.00000000.196018.003AF000.00000002.mdmp") Found reference to API (Indicator: "NdrClientCall4"; Source: "00000000-00001388.00000000.196018.003AF000.00000002.mdmp") Found reference to API (Indicator: "RpcBindingFree"; Source: "00000000-00001388.00000000.196018.003AF000.00000002.mdmp") Found reference to API (Indicator: "DelayLoadFailureHook"; Source: "00000000-00001388.00000000.196018.003AF000.00000002.mdmp") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00001388.00000000.196018.02920000.00000004.mdmp") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00004028.00000000.196014.02C40000.00000004.mdmp") Found reference to API (Indicator: "CryptExportKey"; Source: "00000000-00004292.00000000.196016.032A0000.00000004.mdmp") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00004292.00000000.196016.032A0000.00000004.mdmp") Found reference to API (Indicator: "CryptEncrypt"; Source: "00000000-00004292.00000000.196016.032A0000.00000004.mdmp") Found reference to API (Indicator: "CryptEncrypt"; Source: "00000000-00004300.00000000.196012.02B80000.00000004.mdmp") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00004300.00000000.196012.02B80000.00000004.mdmp") Found reference to API (Indicator: "CryptExportKey"; Source: "00000000-00004300.00000000.196012.02B80000.00000004.mdmp") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00004768.00000000.196019.02E10000.00000004.mdmp") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00004768.00000000.196019.02E10000.00000004.mdmp") Found reference to API (Indicator: "CryptEncrypt"; Source: "00000000-00004768.00000000.196019.02E10000.00000004.mdmp") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00004804.00000000.196015.03100000.00000004.mdmp") Found reference to API (Indicator: "CryptExportKey"; Source: "00000000-00004804.00000000.196015.03100000.00000004.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "GetProcessWindowStation"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "GetUserObjectInformationW"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "GetActiveWindow"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "GetComputerNameA"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexW"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeW"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "SetEndOfFile"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "GetLogicalDrives"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryW"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "WinExec"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "RegisterClassW"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "CreateWindowExW"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "LoadCursorW"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "GetStockObject"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "SHGetSpecialFolderPathW"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "MoveFileW"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "InterlockedExchange"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "InterlockedIncrement"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "InterlockedDecrement"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "HeapCreate"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "SetHandleCount"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleCP"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API (Indicator: "CryptEncrypt"; Source: "00000000-00005240.00000000.196016.03490000.00000004.mdmp") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00005520.00000000.196018.02D70000.00000004.mdmp") Found reference to API (Indicator: "CryptExportKey"; Source: "00000000-00005628.00000000.196019.030F0000.00000004.mdmp") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00005628.00000000.196019.030F0000.00000004.mdmp") Found reference to API (Indicator: "CryptExportKey"; Source: "00000000-00006920.00000000.196015.03480000.00000004.mdmp") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00006920.00000000.196015.03480000.00000004.mdmp") Found reference to API (Indicator: "CryptEncrypt"; Source: "00000000-00006920.00000000.196015.03480000.00000004.mdmp") Found reference to API (Indicator: "CryptExportKey"; Source: "00000000-00006944.00000000.196014.02700000.00000004.mdmp") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00006944.00000000.196014.02700000.00000004.mdmp") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00006944.00000000.196014.02700000.00000004.mdmp") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00007244.00000000.196018.02A80000.00000004.mdmp") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00007460.00000000.196014.02B80000.00000004.mdmp") Found reference to API (Indicator: "CryptEncrypt"; Source: "00000000-00007460.00000000.196014.02B80000.00000004.mdmp") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00007460.00000000.196014.02B80000.00000004.mdmp") Found reference to API (Indicator: "CryptExportKey"; Source: "00000000-00007460.00000000.196014.02B80000.00000004.mdmp") Found reference to API (Indicator: "CryptExportKey"; Source: "00000000-00007900.00000000.196022.02ED0000.00000004.mdmp") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00007900.00000000.196022.02ED0000.00000004.mdmp") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00007900.00000000.196022.02ED0000.00000004.mdmp")33:T6e4,"%USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: "%userprofile%\appdata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00005048.00000000.195932.02E50000.00000004.mdmp ":\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: ":\programdata\microsoft\windows\start menu\programs\startup") in Source: 00000000-00005048.00000000.195932.02E50000.00000004.mdmp 00000000-00005048.00000001.197855.02E50000.00000004.mdmp 00000000-00005048.00000002.199772.02E50000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00005048.00000000.195932.02E50000.00000004.mdmp 00000000-00005048.00000000.195932.04FA0000.00000002.mdmp 00000000-00005048.00000001.197855.02E50000.00000004.mdmp 00000000-00005048.00000002.199772.02E50000.00000004.mdmp "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini" (Indicator: "c:\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00005048.00000000.195932.02E50000.00000004.mdmp 00000000-00005048.00000000.195932.04FA0000.00000002.mdmp 00000000-00005048.00000001.197855.02E50000.00000004.mdmp 00000000-00005048.00000002.199772.02E50000.00000004.mdmp ":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00005048.00000000.195932.02E50000.00000004.mdmp 00000000-00005048.00000001.197855.02E50000.00000004.mdmp 00000000-00005048.00000002.199772.02E50000.00000004.mdmp34:T9f3,"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 737e0000 "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 737e0000 "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 737e0000 "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" loaded module "KERNEL32" at base 73ac0000 "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72440000 "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" loaded module "ADVAPI32.DLL" at base 76a00000 "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73270000 "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" loaded module "SHELL32.DLL" at base 746f0000 "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 76090000 "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 746f0000 "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" loaded module "KERNEL32.DLL" at base 73ac0000 "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" loaded module "RPCRT4.DLL" at base 73bc0000 "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 72d10000 "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" loaded module "NTDLL.DLL" at base 76e90000 "sc.exe" loaded module "KERNEL32" at base 73ac0000 "sc.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 737e0000 "sc.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 737e0000 "sc.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 737e0000 "sc.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 76e60000 "sc.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 737e0000 "sc.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 737e0000 "sc.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 737e0000 "sc.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72440000 "sc.exe" loaded module "RPCRT4.DLL" at base 73bc000035:T7ff,"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "") "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\DISABLE8AND16BITMITIGATION"; Key: ""; Value: "")36:Teaa,"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "6CB9AFFF8166976BD62BB29B12ED617784D6E74B110AFCF8955477573594F306.EX3.EXE"; Value: "") "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "")37:T6d5,"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" trying to touch file "C:\Windows\System32\WOW64LOG.DLL" "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" trying to touch file "C:\Windows\SysWOW64\apphelp.dll" "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" trying to touch file "C:\6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" trying to touch file "C:\Windows\SysWOW64\ntdll.dll" "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" trying to touch file "C:\Windows\SysWOW64\kernel32.dll" "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" trying to touch file "C:\Windows\SysWOW64\KernelBase.dll" "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" trying to touch file "C:\Windows\SysWOW64\win32u.dll" "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" trying to touch file "C:\Windows\SysWOW64\ucrtbase.dll" "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" trying to touch file "C:\Windows\SysWOW64\msvcp_win.dll" "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" trying to touch file "C:\Windows\SysWOW64\gdi32full.dll" "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" trying to touch file "C:\Windows\SysWOW64\gdi32.dll" "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" trying to touch file "C:\Windows\SysWOW64\user32.dll"38:T41b,"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" trying to access non-existent file "C:\FLTLIB.DLL" "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" trying to access non-existent file "C:\SC.EXE" "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" trying to access non-existent file "C:\sc.exe" "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" trying to access non-existent file "sc.exe"39:T509,"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" writes a file "C:\$WINDOWS.~BT\Sources\SFCN.DAT" "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" writes a file "C:\$WINDOWS.~BT\Sources\SFLCID.DAT" "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" writes a file "C:\$WINDOWS.~BT\Sources\SFLISTRS1.DAT" "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" writes a file "C:\$WINDOWS.~BT\Sources\SFLISTWT.DAT" "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" writes a file "C:\$WINDOWS.~BT\Sources\SFLISTWT.WOA.DAT" "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" writes a file "%PROGRAMFILES%\Npcap\install.log" "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" writes a file "%PROGRAMFILES%\Npcap\NPFInstall.log" "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" writes a file "%PROGRAMFILES%\mitmproxy\uninstall.dat" "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" writes a file "%PROGRAMFILES%\Crashpad\settings.dat" "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" writes a file "%PROGRAMFILES%\(x86)\AutoIt3\Au3Check.dat"3a:Tdc8,"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "FindFirstFileW" with parameter Z:\*.* (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "FindNextFileW" with parameter $MAPFAILURE (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "FindNextFileW" with parameter $OK (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "FindNextFileW" with parameter HowToDecrypt.txt (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "FindNextFileW" with parameter network_original.pcapng (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "FindFirstFileW" with parameter C:\*.* (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "FindNextFileW" with parameter $Recycle.Bin (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "FindNextFileW" with parameter $WINDOWS.~BT (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "FindNextFileW" with parameter 6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "FindNextFileW" with parameter bootmgr (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "FindNextFileW" with parameter BOOTNXT (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "FindNextFileW" with parameter bootTel.dat (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "FindNextFileW" with parameter Config.Msi (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "FindNextFileW" with parameter Czuw.pIs (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "FindNextFileW" with parameter Documents and Settings (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "FindNextFileW" with parameter found.000 (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "FindNextFileW" with parameter MSOCache (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "FindNextFileW" with parameter pagefile.sys (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "FindNextFileW" with parameter PerfLogs (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "FindNextFileW" with parameter Program Files (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "FindNextFileW" with parameter Program Files (x86) (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "FindNextFileW" with parameter ProgramData (UID: 00000000-00005048)3b:T8f3,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00005048.00000000.195932.02E50000.00000004.mdmp, 00000000-00005048.00000001.197855.02E50000.00000004.mdmp, 00000000-00005048.00000002.199772.02E50000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00005048.00000000.195932.02E50000.00000004.mdmp, 00000000-00005048.00000001.197855.02E50000.00000004.mdmp, 00000000-00005048.00000002.199772.02E50000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00005048.00000000.195932.02E50000.00000004.mdmp, 00000000-00005048.00000001.197855.02E50000.00000004.mdmp, 00000000-00005048.00000002.199772.02E50000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00005048.00000000.195932.02E50000.00000004.mdmp, 00000000-00005048.00000001.197855.02E50000.00000004.mdmp, 00000000-00005048.00000002.199772.02E50000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00005048.00000000.195932.02E50000.00000004.mdmp, 00000000-00005048.00000001.197855.02E50000.00000004.mdmp, 00000000-00005048.00000002.199772.02E50000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00005048.00000000.195932.02E50000.00000004.mdmp, 00000000-00005048.00000001.197855.02E50000.00000004.mdmp, 00000000-00005048.00000002.199772.02E50000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00005048.00000000.195932.02E50000.00000004.mdmp, 00000000-00005048.00000001.197855.02E50000.00000004.mdmp, 00000000-00005048.00000002.199772.02E50000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00005048.00000000.195932.02E50000.00000004.mdmp, 00000000-00005048.00000001.197855.02E50000.00000004.mdmp, 00000000-00005048.00000002.199772.02E50000.00000004.mdmp")3c:Tf49,Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API "10718076454,532,3117,,FindNextFileW,kernel32.dll,"00:51:00.984",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00005048.00000000.195932.02E50000.00000004.mdmp") Found reference to API "82826907468,532,3117,,FindNextFileW,kernel32.dll,"00:51:31.031",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00005048.00000001.197855.02E50000.00000004.mdmp") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API "110771898008,532,3117,,FindNextFileW,kernel32.dll,"00:51:42.671",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00005048.00000002.199772.02E50000.00000004.mdmp") Found reference to API "147828075048,532,3117,,FindNextFileW,kernel32.dll,"00:51:58.109",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00005048.00000002.199772.02E50000.00000004.mdmp") Found reference to API "147574948680,532,3117,,FindNextFileW,kernel32.dll,"00:51:58.000",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00005048.00000002.199772.02E50000.00000004.mdmp") Found reference to API "148876513092,532,3117,,FindNextFileW,kernel32.dll,"00:51:58.546",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00005048.00000002.199772.02E50000.00000004.mdmp") Found reference to API "148107346302,532,3117,,FindNextFileW,kernel32.dll,"00:51:58.218",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00005048.00000002.199772.02E50000.00000004.mdmp") Found reference to API "154669353662,532,3117,,FindNextFileW,kernel32.dll,"00:52:00.953",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00005048.00000002.199772.02E50000.00000004.mdmp") Found reference to API "152484330936,532,3117,,FindNextFileW,kernel32.dll,"00:52:00.046",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00005048.00000002.199772.02E50000.00000004.mdmp") Found reference to API "129334349194,532,3117,,FindNextFileW,kernel32.dll,"00:51:50.406",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00005048.00000002.199772.02E50000.00000004.mdmp") Found reference to API "152706531822,532,3117,,FindNextFileW,kernel32.dll,"00:52:00.140",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00005048.00000002.199772.02E50000.00000004.mdmp") Found reference to API "152889437452,532,3117,,FindNextFileW,kernel32.dll,"00:52:00.218",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00005048.00000002.199772.02E50000.00000004.mdmp") Found reference to API "142998754044,532,3117,,FindNextFileW,kernel32.dll,"00:51:56.093",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00005048.00000002.199772.02E50000.00000004.mdmp") Found reference to API "152989023464,532,3117,,FindNextFileW,kernel32.dll,"00:52:00.265",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00005048.00000002.199772.02E50000.00000004.mdmp") Found reference to API "152934286884,532,3117,,FindNextFileW,kernel32.dll,"00:52:00.234",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00005048.00000002.199772.02E50000.00000004.mdmp") Found reference to API "137885645352,532,3117,,FindNextFileW,kernel32.dll,"00:51:53.968",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00005048.00000002.199772.02E50000.00000004.mdmp") Found reference to API "141057860856,532,3117,,FindNextFileW,kernel32.dll,"00:51:55.281",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00005048.00000002.199772.02E50000.00000004.mdmp")3d:T670,Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00001388.00000000.196018.003AF000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001388.00000000.196018.003AF000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00001388.00000000.196018.003AF000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00005048.00000002.199772.00A35000.00000002.mdmp")3e:Tf82,"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" opened "C:\$WINDOWS.~BT\Sources\acmigration.dll" with delete access "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" opened "C:\$WINDOWS.~BT\Sources\acres.dll" with delete access "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" opened "C:\$WINDOWS.~BT\Sources\aeinv.dll" with delete access "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" opened "C:\$WINDOWS.~BT\Sources\api-ms-win-core-apiquery-l1-1-0.dll" with delete access "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" opened "C:\$WINDOWS.~BT\Sources\api-ms-win-downlevel-advapi32-l1-1-0.dll" with delete access "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" opened "C:\$WINDOWS.~BT\Sources\api-ms-win-downlevel-advapi32-l1-1-1.dll" with delete access "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" opened "C:\$WINDOWS.~BT\Sources\api-ms-win-downlevel-advapi32-l2-1-0.dll" with delete access "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" opened "C:\$WINDOWS.~BT\Sources\api-ms-win-downlevel-advapi32-l2-1-1.dll" with delete access "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" opened "C:\$WINDOWS.~BT\Sources\api-ms-win-downlevel-advapi32-l3-1-0.dll" with delete access "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" opened "C:\$WINDOWS.~BT\Sources\api-ms-win-downlevel-advapi32-l4-1-0.dll" with delete access "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" opened "C:\$WINDOWS.~BT\Sources\api-ms-win-downlevel-kernel32-l1-1-0.dll" with delete access "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" opened "C:\$WINDOWS.~BT\Sources\api-ms-win-downlevel-kernel32-l2-1-0.dll" with delete access "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" opened "C:\$WINDOWS.~BT\Sources\api-ms-win-downlevel-ole32-l1-1-0.dll" with delete access "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" opened "C:\$WINDOWS.~BT\Sources\api-ms-win-downlevel-ole32-l1-1-1.dll" with delete access "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" opened "C:\$WINDOWS.~BT\Sources\api-ms-win-downlevel-shlwapi-l1-1-0.dll" with delete access "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" opened "C:\$WINDOWS.~BT\Sources\api-ms-win-downlevel-shlwapi-l1-1-1.dll" with delete access "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" opened "C:\$WINDOWS.~BT\Sources\api-ms-win-downlevel-user32-l1-1-0.dll" with delete access "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" opened "C:\$WINDOWS.~BT\Sources\api-ms-win-downlevel-user32-l1-1-1.dll" with delete access "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" opened "C:\$WINDOWS.~BT\Sources\api-ms-win-downlevel-version-l1-1-0.dll" with delete access "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" opened "C:\$WINDOWS.~BT\Sources\AppCompatServicing.dll" with delete access "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" opened "C:\$WINDOWS.~BT\Sources\appraiser.dll" with delete access "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" opened "C:\$WINDOWS.~BT\Sources\appraiser.sdb" with delete access "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" opened "C:\$WINDOWS.~BT\Sources\AppraiserRes.dll" with delete access "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" opened "C:\$WINDOWS.~BT\Sources\cmi2migxml.dll" with delete access "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" opened "C:\$WINDOWS.~BT\Sources\compatctrl.dll" with delete access3f:Tde0,"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "WinExec" with parameter sc stop "Microsoft Exchange Active Directory Toplogy" (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "WinExec" with parameter sc stop "Microsoft Exchange Anti-spam Update" (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "WinExec" with parameter sc stop "Microsoft Exchange Compliance Audit" (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "WinExec" with parameter sc stop "Microsoft Exchange Compliance Service" (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "WinExec" with parameter sc stop "Microsoft Exchange DAG Management" (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "WinExec" with parameter sc stop "Microsoft Exchange Diagnostics" (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "WinExec" with parameter sc stop "Microsoft Exchange EdgeSync" (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "WinExec" with parameter sc stop "Microsoft Exchange Frontend Transport" (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "WinExec" with parameter sc stop "Microsoft Exchange Health Manager" (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "WinExec" with parameter sc stop "Microsoft Exchange Health Manager Recovery" (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "WinExec" with parameter sc stop "Microsoft Exchange IMAP4" (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "WinExec" with parameter sc stop "Microsoft Exchange IMAP4 Backend" (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "WinExec" with parameter sc stop "Microsoft Exchange Information Store" (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "WinExec" with parameter sc stop "Microsoft Exchange Mailbox Assistants" (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "WinExec" with parameter sc stop "Microsoft Exchange Mailbox Replication" (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "WinExec" with parameter sc stop "Microsoft Exchange Mailbox Transport Delivery" (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "WinExec" with parameter sc stop "Microsoft Exchange POP3" (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "WinExec" with parameter sc stop "Microsoft Exchange POP3 Backend" (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "WinExec" with parameter sc stop "SQL Server Agent (TESTINSTANCE)" (UID: 00000000-00005048) "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe" called "WinExec" with parameter sc stop "SQL Server (TESTINSTANCE)" (UID: 00000000-00005048)40:T854,Process "sc.exe" with commandline "sc stop "Microsoft Exchange Active Directory Toplogy"" (UID: 00000000-00004288) Process "sc.exe" with commandline "sc stop "Microsoft Exchange Anti-spam Update"" (UID: 00000000-00004300) Process "sc.exe" with commandline "sc stop "Microsoft Exchange Compliance Audit"" (UID: 00000000-00000756) Process "sc.exe" with commandline "sc stop "Microsoft Exchange DAG Management"" (UID: 00000000-00004028) Process "sc.exe" with commandline "sc stop "Microsoft Exchange Compliance Service"" (UID: 00000000-00006944) Process "sc.exe" with commandline "sc stop "Microsoft Exchange EdgeSync"" (UID: 00000000-00005240) Process "sc.exe" with commandline "sc stop "Microsoft Exchange Diagnostics"" (UID: 00000000-00006920) Process "sc.exe" with commandline "sc stop "Microsoft Exchange Frontend Transport"" (UID: 00000000-00004804) Process "sc.exe" with commandline "sc stop "Microsoft Exchange Health Manager"" (UID: 00000000-00004292) Process "sc.exe" with commandline "sc stop "Microsoft Exchange Health Manager Recovery"" (UID: 00000000-00007460) Process "sc.exe" with commandline "sc stop "Microsoft Exchange IMAP4"" (UID: 00000000-00005520) Process "sc.exe" with commandline "sc stop "Microsoft Exchange IMAP4 Backend"" (UID: 00000000-00004888) Process "sc.exe" with commandline "sc stop "Microsoft Exchange Mailbox Assistants"" (UID: 00000000-00007244) Process "sc.exe" with commandline "sc stop "Microsoft Exchange Information Store"" (UID: 00000000-00004768) Process "sc.exe" with commandline "sc stop "Microsoft Exchange Mailbox Transport Delivery"" (UID: 00000000-00001388) Process "sc.exe" with commandline "sc stop "Microsoft Exchange Mailbox Replication"" (UID: 00000000-00005628) Process "sc.exe" with commandline "sc stop "Microsoft Exchange POP3"" (UID: 00000000-00006796) Process "sc.exe" with commandline "sc stop "Microsoft Exchange POP3 Backend"" (UID: 00000000-00001160) Process "sc.exe" with commandline "sc stop "SQL Server Agent (TESTINSTANCE)"" (UID: 00000000-00007900) Process "sc.exe" with commandline "sc stop "SQL Server (TESTINSTANCE)"" (UID: 00000000-00001276)41:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791242780937,"unified_at":"2026-10-05T23:26:20.937Z","metadata":{"hashes":{"sha256":"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306","sha1":"6a7296f56410d3ee007587020ad6864d5781b4bc","md5":"efd4a87e7c5dcbb64b7313a13b4b1012","sha512":"4e3e31e2f4e392c4230d6849f6ef4d6a234de388979b6e4017062f534339dbb681e68d0248bd47003353f218daff5a6d628ee786a772e9b9b3002683411cd4d7","ssdeep":"3072:fRbikPFbtOKRhjzl5h38JtLCMqqDLc5XF:fROk7PV8Jt9qqDGX","ssdeep_chunks":["3072:fRbikPF","3072:RbikPFb","3072:bikPFbt","3072:ikPFbtO","3072:kPFbtOK","3072:PFbtOKR","3072:FbtOKRh","3072:btOKRhj","3072:tOKRhjz","3072:OKRhjzl","3072:KRhjzl5","3072:Rhjzl5h","3072:hjzl5h3","3072:jzl5h38","3072:zl5h38J","3072:l5h38Jt","3072:5h38JtL","3072:h38JtLC","3072:38JtLCM","3072:8JtLCMq","3072:JtLCMqq","3072:tLCMqqD","3072:LCMqqDL","3072:CMqqDLc","3072:MqqDLc5","3072:qqDLc5X","3072:qDLc5XF","6144:fRbikPF","6144:RbikPFb","6144:bikPFbt","6144:ikPFbtO","6144:kPFbtOK","6144:PFbtOKR","6144:FbtOKRh","6144:btOKRhj","6144:tOKRhjz","6144:OKRhjzl","6144:KRhjzl5","6144:Rhjzl5h","6144:hjzl5h3","6144:jzl5h38","6144:zl5h38J","6144:l5h38Jt","6144:5h38JtL","6144:h38JtLC","6144:38JtLCM","6144:8JtLCMq","6144:JtLCMqq","6144:tLCMqqD","6144:LCMqqDL","6144:CMqqDLc","6144:MqqDLc5","6144:qqDLc5X","6144:qDLc5XF","3072:fROk7PV","3072:ROk7PV8","3072:Ok7PV8J","3072:k7PV8Jt","3072:7PV8Jt9","3072:PV8Jt9q","3072:V8Jt9qq","3072:8Jt9qqD","3072:Jt9qqDG","3072:t9qqDGX"],"imphash":"fe8dab7a04d98ed8961bf3b896857c39"},"file_info":{"file_name":"splwow32.bin","file_type":["peexe","executable"],"file_type_id":"exe","file_size":114176,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1584983318000,"last_seen":1733803024000,"last_multi_scan":1733803024000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["criminal","labyrinthchollima","ransomware","targeted","targetedcrimeware","vhdransomware","apt","shamoon"]},"stats":{"av":{"malicious_count":24,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":58},"sandbox_signatures":{"informative_count":110,"suspicious_count":12,"malicious_count":10,"total":132},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Malware/Win32.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[APT]/Win32.Lazarus","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/AD.Nekark.ajyhm","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Ransom.Genasom.2","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Malware.Agent-9377626-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"malicious","threat_name":"Ransom_Win32_Cryptor_MSR","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Ransom.Genasom.2 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/Filecoder.OBF trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Ransom/Filecoder.ci","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Riskware ( 0040eff71 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Agent.trqD","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Ransomware-GXK!EFD4A87E7C5D","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Filecoder.hgjumu","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_97","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Ransom/W32.VHD.114176","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Crypter.B.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.MulDrop11.CYGU","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TrojanRansom.Cryptor","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware_42.2","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Agent.Win32.1305132","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Ransom.Genasom.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Service Execution","attack_id":"T1035","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1035","identifiers":[{"type":"informative","value":"Opened the service control manager"}],"sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1215","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1045","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1045","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","identifiers":[{"type":"informative","value":"Queries registry keys"},{"type":"suspicious","value":"Reads the active computer name"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"}],"sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"},{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"malicious","value":"Calls an API typically used to run the specified application"},{"type":"suspicious","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Imports GetCommandLine API"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"}],"sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to modify system service (API string)"},{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to start a service (API string)"},{"type":"informative","value":"Contains ability to create a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"suspicious","value":"Contains ability to retrieve the contents of the STARTUPINFO structure"},{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"Contains reference to Windows Startup folder"}],"sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"tactic":"Persistence","technique":"DLL Search Order Hijacking","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"}],"sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Contains ability to empty the recycle bin (API string)"},{"type":"informative","value":"Imports SHEmptyRecycleBin API"}],"sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to encrypt/encode message (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"suspicious","value":"Rename many files (often indicator of ransomware infection)"},{"type":"suspicious","value":"Drops PE files with different extensions"},{"type":"informative","value":"Renames files"}],"sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"tactic":"Defense Evasion","technique":"Double File Extension","attack_id":"T1036.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/007","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"tactic":"Defense Evasion","technique":"Masquerade File Type","attack_id":"T1036.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/008","identifiers":[{"type":"malicious","value":"Drops executable file with image/text extension"}],"sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Tries to access LNK files (Windows shortcut)"}],"sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to find logical drives of the machine (API string)"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"}],"sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"malicious","value":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"tactic":"Collection","technique":"Local Email Collection","attack_id":"T1114.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1114/001","identifiers":[{"type":"informative","value":"Contains reference to Outlook data files path"}],"sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Writes log files"}],"sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"}],"sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"malicious","value":"Renames many files with double extensions (often indicator of ransomware infection)"}],"sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"malicious","value":"Stops/delete service using SC.exe"},{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"tactic":"Impact","technique":"Internal Defacement","attack_id":"T1491.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1491/001","identifiers":[{"type":"malicious","value":"The analysis extracted a known ransomware file"}],"sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 32578-818-0040B865","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"},{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\AEEAEE SET\"\n \"AEEAEE SET\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"},{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"General","name":"Opened the service control manager","description":"\"sc.exe\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)","origin":"API Call","mitre_attack_id":"T1035","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"splwow32.bin.exe\" touched \"Copy/Move/Rename/Delete/Link Object\" (Path: \"HKCU\\CLSID\\{3AD05575-8857-4850-9277-11B85BDB8E09}\")\n \"splwow32.bin.exe\" touched \"Memory Mapped Cache Mgr\" (Path: \"HKCU\\CLSID\\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\")\n \"splwow32.bin.exe\" touched \"Recycle Bin\" (Path: \"HKCU\\CLSID\\{645FF040-5081-101B-9F08-00AA002F954E}\\DEFAULTICON\")","origin":"Registry Access","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"},{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$25","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"},{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$26","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"},{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"updater.exe\" has type \"data\"\n \"libwscodecs.dll\" has type \"data\"\n \"autoexec.bat\" has type \"data\"\n \"libEGL.dll\" has type \"data\"\n \"nss3.dll\" has type \"data\"\n \"CCEnhancer-4.5.1.exe\" has type \"data\"\n \"libspandsp-2.dll\" has type \"data\"\n \"1LoWM7zNlVq8h.exe\" has type \"data\"\n \"api-ms-win-core-handle-l1-1-0.dll\" has type \"data\"\n \"rpcapd.exe\" has type \"data\"\n \"Qt5Multimedia.dll\" has type \"data\"\n \"dSTEZHvd.doc\" has type \"data\"\n \"Qt5Gui.dll\" has type \"data\"\n \"3TXw.exe\" has type \"370 sysV pure executable\"\n \"api-ms-win-core-processenvironment-l1-1-0.dll\" has type \"data\"\n \"h8fg9WRouk.doc\" has type \"data\"\n \"OCXh75SGcr7.doc\" has type \"PGP\\011Secret Sub-key -\"\n \"api-ms-win-crt-utility-l1-1-0.dll\" has type \"data\"\n \"capinfos.exe\" has type \"SysEx File - Yamaha\"\n \"api-ms-win-core-debug-l1-1-0.dll\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"},{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"splwow32.bin.exe\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"\n \"splwow32.bin.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"splwow32.bin.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db\"\n \"splwow32.bin.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001b.db\"\n \"splwow32.bin.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"splwow32.bin.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db\"\n \"splwow32.bin.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001b.db\"\n \"sc.exe\" touched file \"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui\"\n \"sc.exe\" touched file \"%WINDIR%\\System32\\en-US\\sc.exe.mui\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"},{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"splwow32.bin.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1215","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.bin\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1045","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"},{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"splwow32.bin.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"sc.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"},{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates new processes","description":"\"splwow32.bin.exe\" is creating a new process (Name: \"%WINDIR%\\System32\\conhost.exe\", Handle: 172)","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"3TXw.exe\" has type \"370 sysV pure executable\"\n \"api-ms-win-core-processthreads-l1-1-0.dll\" has type \"PDP-11 separate I&D executable not stripped - version 87\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"},{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetModuleFileNameW\n GetModuleFileNameA\n WinExec\n GetDriveTypeW\n UnhandledExceptionFilter\n GetStartupInfoW\n GetCommandLineA\n GetProcAddress\n LoadLibraryW\n FindNextFileW\n WriteFile\n GetComputerNameA\n FindFirstFileW\n GetModuleHandleW\n IsDebuggerPresent\n TerminateProcess\n CreateFileW\n Sleep\n GetTickCount\n GetFileSize","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"},{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$27","origin":"File/Memory","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"},{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"48/72 Antivirus vendors marked sample as malicious (66% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"48/72 Antivirus vendors marked sample as malicious (66% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"level":"malicious","category":"Ransomware/Banking","name":"The analysis extracted a known ransomware file","description":"Found dropped filename \"HowToDecrypt.txt\" which has been seen in the context of ransomware (Indicator: DECRYPT.txt)","origin":"Binary File","relevance":5,"id":"binary-9","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"},{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$28","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"},{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"00000000-00001388.00000000.196018.003AF000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00001388.00000000.196018.003AF000.00000002.mdmp\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"00000000-00005048.00000002.199772.00A35000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00005048.00000002.199772.00A35000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00005048.00000002.199772.00A35000.00000002.mdmp\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005048.00000002.199772.00A35000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify system service (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-192","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"EnumQueryServicesStatus:OpenService\" (Indicator: \"OpenService\"; Source: \"00000000-00001388.00000000.196018.003A1000.00000020.mdmp\")\n Found reference to API \"OpenService\" (Indicator: \"OpenService\"; Source: \"00000000-00001388.00000000.196018.003A1000.00000020.mdmp\")\n Found reference to API \"StartService: OpenService\" (Indicator: \"OpenService\"; Source: \"00000000-00001388.00000000.196018.003A1000.00000020.mdmp\")\n Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; Source: \"00000000-00001388.00000000.196018.003A1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00005048.00000000.195932.02E50000.00000004.mdmp, 00000000-00005048.00000001.197855.02E50000.00000004.mdmp, 00000000-00005048.00000002.199772.02E50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to perform Base64 encoding/decoding","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Renames files","description":"$2b","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"Assembly shows XOR instruction xor eax\n ebp in Stream UID: 46690-228-0040843B\n Assembly shows XOR instruction xor ecx\n ebp in Stream UID: 46690-228-0040843B\n Assembly shows XOR instruction xor eax\n ebp in Stream UID: 46690-68-0040DDAE\n Assembly shows XOR instruction xor ecx\n ebp in Stream UID: 46690-68-0040DDAE","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to encrypt/encode message (API string)","description":"Found reference to API \"CryptStringToBinary: Hex data string to binary conversion\" (Indicator: \"CryptStringToBinary\"; Source: \"00000000-00001388.00000000.196018.003A1000.00000020.mdmp\")\n Found reference to API \"CryptStringToBinaryW\" (Indicator: \"CryptStringToBinary\"; Source: \"00000000-00001388.00000000.196018.003A1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-213","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to import cryptographic keys (seen in ransomware)\n Matched sigs: Contains ability to encrypt/encode message (API string)\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Contains ability to perform decryption (API string)\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Found potential URLs in memory dumps","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005048.00000002.199772.00A35000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"$2d","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2e","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00001388.00000000.196018.003AF000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005048.00000002.199772.00A35000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"sc.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00001388.00000000.196018.003AF000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00005048.00000002.199772.00A35000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; File: \"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3\")\n Found reference to API \"RtlNtStatusToDosError\" (Indicator: \"RtlNtStatusToDosError\"; Source: \"00000000-00001388.00000000.196018.003AF000.00000002.mdmp\")\n Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00005048.00000002.199772.00A35000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00001388.00000000.196018.003AF000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005048.00000002.199772.00A35000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; File: \"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3\")\n Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; Source: \"00000000-00005048.00000002.199772.00A35000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"tlGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00001276.00000000.196022.02EA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$30","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$31","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00001388.00000000.196018.003A1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00005048.00000002.199772.00A35000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$32","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"WinExec\" (Indicator: \"WinExec\"; File: \"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3\")\n Found reference to API \"WinExec\" (Indicator: \"WinExec\"; Source: \"00000000-00005048.00000002.199772.00A35000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; File: \"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3\")\n Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; Source: \"00000000-00005048.00000002.199772.00A35000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005048.00000002.199772.00A35000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00001388.00000000.196018.003AF000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00001388.00000000.196018.003AF000.00000002.mdmp\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00005048.00000002.199772.00A35000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00005048.00000002.199772.00A35000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00005048.00000002.199772.00A35000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"Found reference to API \"StartService: OpenService\" (Indicator: \"StartService\"; Source: \"00000000-00001388.00000000.196018.003A1000.00000020.mdmp\")\n Found reference to API \"StartService\" (Indicator: \"StartService\"; Source: \"00000000-00001388.00000000.196018.003A1000.00000020.mdmp\")\n Found reference to API \"StartServiceW\" (Indicator: \"StartService\"; Source: \"00000000-00001388.00000000.196018.003A1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"General","name":"Contains reference to Windows Startup folder","description":"$33","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-265","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"STRY\\USER\\S-1-5-21-735145574-3570218355-1207367261-1001\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\" in Source: 00000000-00005048.00000000.195932.02E50000.00000004.mdmp\n 00000000-00005048.00000001.197855.02E50000.00000004.mdmp\n 00000000-00005048.00000002.199772.02E50000.00000004.mdmp\n \"REGISTRY\\USER\\S-1-5-21-735145574-3570218355-1207367261-1001\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\" in Source: 00000000-00005048.00000000.195932.02E50000.00000004.mdmp\n 00000000-00005048.00000001.197855.02E50000.00000004.mdmp\n 00000000-00005048.00000002.199772.02E50000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3\" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$34","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76C70000\n \"sc.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76C70000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 73BC0000\n \"sc.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 73BC0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"\n \"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3\" file has an entrypoint instructions - \"call\t0x40c075,jmp\t0x407da4,mov\tedi, edi,push\tebp,mov\tebp, esp,sub\tesp, 0x20,mov\teax, dword ptr [ebp + 8],push\tesi,push\tedi,push\t8,pop\tecx,mov\tesi, 0x4154b4,lea\tedi, [ebp - 0x20],rep movsd\tdword ptr es:[edi], dword ptr [esi],mov\tdword ptr [ebp - 8], eax,mov\teax, dword ptr [ebp + 0xc],pop\tedi,mov\tdword ptr [ebp - 4], eax,pop\tesi,test\teax, eax,je\t0x407f50,test\tbyte ptr [eax], 8,je\t0x407f50,mov\tdword ptr [ebp - 0xc], 0x1994000,lea\teax, [ebp - 0xc],push\teax,push\tdword ptr [ebp - 0x10],push\tdword ptr [ebp - 0x1c],push\tdword ptr [ebp - 0x20],call\tdword ptr [0x415090],leave\t,ret\t8,mov\tedi, edi,push\tebp,mov\tebp, esp,mov\teax, dword ptr [ebp + 8],mov\tdword ptr [0x41c25c], eax,pop\tebp,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"sc.exe\" (UID: 00000000-00004288) was launched with new environment variables: \"PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"sc.exe\" (UID: 00000000-00004288) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"sc.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create a service (API string)","description":"Found reference to API \"CreateService\" (Indicator: \"CreateService\"; Source: \"00000000-00001388.00000000.196018.003A1000.00000020.mdmp\")\n Found reference to API \"RtlCreateServiceSid\" (Indicator: \"CreateService\"; Source: \"00000000-00001388.00000000.196018.003A1000.00000020.mdmp, 00000000-00001388.00000000.196018.003AF000.00000002.mdmp\")\n Found reference to API \"CreateServiceW\" (Indicator: \"CreateService\"; Source: \"00000000-00001388.00000000.196018.003A1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-199","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005048.00000002.199772.00A35000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$35","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe\" queries basic process information of the \"C:\\6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe\" (UID: 5048)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$36","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe\" reads file \"c:\\czuw.pis\"\n \"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe\" reads file \"c:\\$recycle.bin\\s-1-5-21-735145574-3570218355-1207367261-1001\\desktop.ini\"\n \"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe\" reads file \"c:\\$windows.~bt\\sources\\acmigration.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$37","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access LNK files (Windows shortcut)","description":"\"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe\" trying to access LNK file \"C:\\Users\\Default\\Links\\OneDrive.lnk\"\n \"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe\" trying to access LNK file \"C:\\Users\\%OSUSER%\\Links\\Desktop.lnk\"\n \"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe\" trying to access LNK file \"C:\\Users\\%OSUSER%\\Links\\Downloads.lnk\"\n \"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe\" trying to access LNK file \"C:\\Users\\Public\\Desktop\\Adobe Reader XI.lnk\"\n \"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe\" trying to access LNK file \"C:\\Users\\Public\\Desktop\\Google Chrome.lnk\"\n \"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe\" trying to access LNK file \"C:\\Users\\Public\\Desktop\\Microsoft Edge.lnk\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-203","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$38","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe\" writes file \"c:\\users\\%osuser%\\desktop\\howtodecrypt.txt\"\n \"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe\" writes file \"c:\\howtodecrypt.txt\"\n \"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe\" writes file \"c:\\$windows.~bt\\sources\\acmigration.dll\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"$39","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"all data on your pc were encrypted with strongest encryption method.the only way to get your data back is to purchase unique key for you.* you can get cheaper price if you contact us as soon as possible. *after three days from now, it will be difficult to \"\n Heuristic match: \"icrosoft.windows.services.sc\"\n Pattern match: \"http://www.w3.org/2001/xmlschema-instance\"\n Heuristic match: \":\\program files (x86)\\microsoft.net\"\n Pattern match: \"ft.com/pki/crl/products/cspca.crl0h\"\n Pattern match: \"http://www.microsoft.com/pki/certs/cspca.crt0\"\n Pattern match: \"crl.microsoft.com/pki/crl/products/tspca.crl0h\"\n Pattern match: \"http://www.microsoft.com/pki/certs/tspca.crt0\"\n Pattern match: \"http://office.microsoft.com\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"Found URL \"http://www.w3.org/2001/xmlschema-instance\" - Source: \"00000000-00005048.00000000.195932.02E50000.00000004.mdmp\")\n Found URL \"http://www.w3.org/2001/xmlschema-instance\" - Source: \"00000000-00005048.00000001.197855.02E50000.00000004.mdmp\")\n Found URL \"http://www.microsoft.com/pki/certs/cspca.crt0jt;1_zw9gjs2r6$rofh&9ipnt8jo00p1+0)\" - Source: \"00000000-00005048.00000002.199772.00B90000.00000004.mdmp\")\n Found URL \"http://crl.microsoft.com/pki/crl/products/tspca.crl0h<0:08,http://www.microsoft.com/pki/certs/tspca.crt0>gbt\" - Source: \"00000000-00005048.00000002.199772.00B90000.00000004.mdmp\")\n Found URL \"http://office.microsoft.com\" - Source: \"00000000-00005048.00000002.199772.00B90000.00000004.mdmp\")\n Found URL \"http://crl.microso%\" - Source: \"00000000-00005048.00000002.199772.00B90000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e\n Observed JA3 fingerprint: bd0bf25947d4a37404f0424edf4db9ad","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on process \"00000000-00005048\"\n YARA signature for AES encryption matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to empty the recycle bin (API string)","description":"Found reference to API \"SHEmptyRecycleBinW\" (Indicator: \"EmptyRecycleBin\"; File: \"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3\")\n Found reference to API \"SHEmptyRecycleBinW\" (Indicator: \"EmptyRecycleBin\"; Source: \"00000000-00005048.00000002.199772.00A35000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-111","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"Ransomware/Banking","name":"Imports SHEmptyRecycleBin API","description":"Observed import api \"SHEmptyRecycleBin\" which can \"Empties the Recycle Bin on the specified drive\" [Source: 6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3]","origin":"Static Parser","mitre_attack_id":"T1070","relevance":1,"id":"static-84","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"sc.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe\" called \"GetComputerNameA\" (UID: 00000000-00005048)\n \"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe\" called \"GetComputerNameW\" (UID: 00000000-00005048)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$3a","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"P~AeS\" (Indicator: \"aes\"; File: \"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3\")\n Found string \"P~AeS\" (Indicator: \"aes\"; Source: \"00000000-00005048.00000002.199772.00A35000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to determine disk drive type (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; File: \"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00005048.00000002.199772.00A35000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to find logical drives of the machine (API string)","description":"Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; File: \"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3\")\n Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00005048.00000002.199772.00A35000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-84","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00005048.00000002.199772.00A35000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00001388.00000000.196018.003AF000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005048.00000002.199772.00A35000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00005048.00000002.199772.00A35000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; File: \"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3\")\n Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00005048.00000002.199772.00A35000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetFileSize\" (Indicator: \"GetFileSize\"; File: \"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3\")\n Found reference to API \"GetFileSize\" (Indicator: \"GetFileSize\"; Source: \"00000000-00005048.00000002.199772.00A35000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameA\" (Indicator: \"GetComputerName\"; File: \"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3\")\n Found reference to API \"GetComputerNameA\" (Indicator: \"GetComputerName\"; Source: \"00000000-00005048.00000002.199772.00A35000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00005048.00000002.199772.00A35000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00005048.00000002.199772.00A35000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00005048.00000002.199772.00A35000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00001388.00000000.196018.003AF000.00000002.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00005048.00000002.199772.00A35000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; File: \"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3\")\n Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; File: \"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3\")\n Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; Source: \"00000000-00005048.00000002.199772.00A35000.00000002.mdmp\")\n Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00005048.00000002.199772.00A35000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains reference to Outlook data files path","description":"Found string \":\\Users\\mSyiKcb\\Documents\\Outlook Files\" (Indicator: \"\\documents\\outlook files\"; Source: \"00000000-00005048.00000002.199772.0B480000.00000004.mdmp\")\n Found string \":\\Users\\HAPUBWS\\Documents\\Outlook Files\" (Indicator: \"\\documents\\outlook files\"; Source: \"00000000-00005048.00000002.199772.0B480000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1114.001","relevance":3,"id":"string-570","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"password=\" (Indicator: \"password\"; Source: \"00000000-00001388.00000000.196018.003A1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetCommandLine API","description":"Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: 6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00005048.00000000.195932.02E50000.00000004.mdmp, 00000000-00005048.00000001.197855.02E50000.00000004.mdmp, 00000000-00005048.00000002.199772.02E50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; File: \"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00005048.00000002.199772.00A35000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"GetSecurityDescriptorControl\" (Indicator: \"GetSecurityDescriptorControl\"; Source: \"00000000-00001388.00000000.196018.003A1000.00000020.mdmp, 00000000-00001388.00000000.196018.003AF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; File: \"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00001388.00000000.196018.003AF000.00000002.mdmp\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00005048.00000002.199772.00A35000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00005048.00000002.199772.00A35000.00000002.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00005048.00000002.199772.00A35000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00001388.00000000.196018.003AF000.00000002.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00005048.00000002.199772.00A35000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"\"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSWOW64\\SC.EXE\"; Value: \"\")\n \"sc.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CONHOST.EXE\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; File: \"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3\")\n Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00005048.00000002.199772.00A35000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"sc.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"section contains high entropy","description":"\"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3\" has section name .text with entropy \"6.62458580526\"\n \"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3\" has section name .rdata with entropy \"6.188269254\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure","description":"GetStartupInfoW@KERNEL32.dll at 46690-1-00407F11","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1543","relevance":5,"id":"stream-133","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe\" reads file \"C:\\$Recycle.Bin\\S-1-5-21-735145574-3570218355-1207367261-1001\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"system32\\wbem\\wmiprvse.exe\" (Indicator: \"wmiprvse.exe\"; in Source: \"00000000-00001276.00000000.196022.02EA0000.00000004.mdmp\")\n Found string \"syswow64\\wbem\\wmiprvse.exe\" (Indicator: \"wmiprvse.exe\"; in Source: \"00000000-00001388.00000000.196018.02920000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$3e","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops PE files with different extensions","description":"\"PKTC-IETF-MTA-MIB\" has type \"DOS executable (COM)\"- [targetUID: N/A]\n \"J0093905.WMF\" has type \"DOS executable (COM)\"- [targetUID: N/A]\n \"FRAMEWORK-FEEDBACK-PIB\" has type \"DOS executable (COM)\"- [targetUID: N/A]\n \"BD06200_.WMF\" has type \"DOS executable (COM)\"- [targetUID: N/A]\n \"J0152606.WMF\" has type \"DOS executable (COM)\"- [targetUID: N/A]\n \"J0198025.WMF\" has type \"DOS executable (COM)\"- [targetUID: N/A]\n \"ATM-ACCOUNTING-INFORMATION-MIB\" has type \"DOS executable (COM)\"- [targetUID: N/A]\n \"J0105502.WMF\" has type \"DOS executable (COM)\"- [targetUID: N/A]","origin":"Binary File","mitre_attack_id":"T1036","relevance":5,"id":"binary-38","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Rename many files (often indicator of ransomware infection)","description":"\"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe\" renames more than 200 files","origin":"API Call","mitre_attack_id":"T1036","relevance":10,"id":"api-164","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"malicious","category":"General","name":"Calls an API typically used to run the specified application","description":"$3f","origin":"API Call","mitre_attack_id":"T1106","relevance":10,"id":"api-120","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe\" wrote 00000004 bytes to a remote process \"C:\\Windows\\SysWOW64\\sc.exe\" (Handle: 572)\n \"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe\" wrote 00000004 bytes to a remote process \"C:\\Windows\\SysWOW64\\sc.exe\" (Handle: 884)\n \"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe\" wrote 00000004 bytes to a remote process \"C:\\Windows\\SysWOW64\\sc.exe\" (Handle: 908)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"malicious","category":"System Security","name":"Stops/delete service using SC.exe","description":"$40","origin":"Monitored Target","mitre_attack_id":"T1489","relevance":10,"id":"target-150","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Drops executable file with image/text extension","description":"\"PH02757U.BMP\" has type \"DOS executable (COM)\" and unusual extension \"bmp\"","origin":"Binary File","mitre_attack_id":"T1036.008","relevance":10,"id":"binary-28","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Renames many files with double extensions (often indicator of ransomware infection)","description":"\"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3.exe\" renames more than 100 files with extension \".exe.vhd\"","origin":"API Call","mitre_attack_id":"T1486","relevance":10,"id":"api-200","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]}],"incidents":[{"name":"Ransomware","details_count":1,"details":[{"detail":"The analysis extracted a known ransomware file"}],"sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"},{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"},{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"},{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]}]},"activity":{"stats":{"process_count":21,"spawned_processes_count":21,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":2,"imported_dlls_count":48,"dropped_files_count":0,"extracted_files_count":191,"files_written_count":365,"files_deleted_count":0,"registry_keys_created_count":4,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":4,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["criminal","labyrinthchollima","ransomware","targeted","targetedcrimeware","vhdransomware","apt","shamoon"],"sample_flags":["Extracted Files","Multi-Process"],"sandbox_reports":[{"id":"6757bc0fc7ae969a5f016802","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"submit_name":"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306.ex3","analysis_start_time":"2024-12-10T03:57:04+00:00","indicators_count":{"informative":109,"suspicious":26,"malicious":8},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true},{"id":"5e78ed153daf7f279752d305","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Graftor","submit_name":"splwow32.bin","analysis_start_time":"2020-03-23T17:08:44+00:00","indicators_count":{"informative":10,"suspicious":5,"malicious":5},"tags":["Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}],"processes":[{"pid":1220,"ppid":0,"name":"splwow32.bin.exe","command_line":"","sha256":"6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306","normalized_path":"C:\\splwow32.bin.exe","uid":"00024891-00001220","icon":"$41"},{"pid":3192,"ppid":1220,"name":"sc.exe","command_line":"sc stop \"Microsoft Exchange Active Directory Toplogy\"","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00024891-00001220","uid":"00025044-00003192"},{"pid":2208,"ppid":1220,"name":"sc.exe","command_line":"sc stop \"Microsoft Exchange Anti-spam Update\"","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00024891-00001220","uid":"00025046-00002208"},{"pid":1396,"ppid":1220,"name":"sc.exe","command_line":"sc stop \"Microsoft Exchange Compliance Audit\"","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00024891-00001220","uid":"00025046-00001396"},{"pid":2916,"ppid":1220,"name":"sc.exe","command_line":"sc stop \"Microsoft Exchange Compliance Service\"","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00024891-00001220","uid":"00025047-00002916"},{"pid":3684,"ppid":1220,"name":"sc.exe","command_line":"sc stop \"Microsoft Exchange DAG Management\"","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00024891-00001220","uid":"00025049-00003684"},{"pid":3848,"ppid":1220,"name":"sc.exe","command_line":"sc stop \"Microsoft Exchange Diagnostics\"","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00024891-00001220","uid":"00025050-00003848"},{"pid":2176,"ppid":1220,"name":"sc.exe","command_line":"sc stop \"Microsoft Exchange EdgeSync\"","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00024891-00001220","uid":"00025050-00002176"},{"pid":2884,"ppid":1220,"name":"sc.exe","command_line":"sc stop \"Microsoft Exchange Frontend Transport\"","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00024891-00001220","uid":"00025051-00002884"},{"pid":2880,"ppid":1220,"name":"sc.exe","command_line":"sc stop \"Microsoft Exchange Health Manager\"","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00024891-00001220","uid":"00025053-00002880"},{"pid":3968,"ppid":1220,"name":"sc.exe","command_line":"sc stop \"Microsoft Exchange Health Manager Recovery\"","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00024891-00001220","uid":"00025055-00003968"},{"pid":2900,"ppid":1220,"name":"sc.exe","command_line":"sc stop \"Microsoft Exchange IMAP4\"","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00024891-00001220","uid":"00025056-00002900"},{"pid":2584,"ppid":1220,"name":"sc.exe","command_line":"sc stop \"Microsoft Exchange IMAP4 Backend\"","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00024891-00001220","uid":"00025058-00002584"},{"pid":3388,"ppid":1220,"name":"sc.exe","command_line":"sc stop \"Microsoft Exchange Information Store\"","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00024891-00001220","uid":"00025060-00003388"},{"pid":2960,"ppid":1220,"name":"sc.exe","command_line":"sc stop \"Microsoft Exchange Mailbox Assistants\"","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00024891-00001220","uid":"00025064-00002960"},{"pid":3772,"ppid":1220,"name":"sc.exe","command_line":"sc stop \"Microsoft Exchange Mailbox Replication\"","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00024891-00001220","uid":"00025067-00003772"},{"pid":688,"ppid":1220,"name":"sc.exe","command_line":"sc stop \"Microsoft Exchange Mailbox Transport Delivery\"","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00024891-00001220","uid":"00025068-00000688"},{"pid":2604,"ppid":1220,"name":"sc.exe","command_line":"sc stop \"Microsoft Exchange POP3\"","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00024891-00001220","uid":"00025069-00002604"},{"pid":3548,"ppid":1220,"name":"sc.exe","command_line":"sc stop \"Microsoft Exchange POP3 Backend\"","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00024891-00001220","uid":"00025070-00003548"},{"pid":2564,"ppid":1220,"name":"sc.exe","command_line":"sc stop \"SQL Server Agent (TESTINSTANCE)\"","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00024891-00001220","uid":"00025085-00002564"},{"pid":2248,"ppid":1220,"name":"sc.exe","command_line":"sc stop \"SQL Server (TESTINSTANCE)\"","sha256":"1c2ec0bb83d2ad3f53b0706c46a2604f81f2fc2afdcf43be5914cc8f509dd48c","normalized_path":"%WINDIR%\\System32\\sc.exe","parent_uid":"00024891-00001220","uid":"00025105-00002248"}],"all_imported_dlls":["imm32.dll","oleaut32.dll","profapi.dll","shlwapi.dll","devobj.dll","apphelp.dll","ole32.dll","ntdll.dll","KernelBase.dll","uxtheme.dll","ntmarta.dll","Wldap32.dll","gdi32.dll","usp10.dll","advapi32.dll","user32.dll","msctf.dll","rpcss.dll","setupapi.dll","cryptbase.dll","kernel32.dll","rpcrt4.dll","comctl32.dll","propsys.dll","clbcatq.dll","cfgmgr32.dll","sechost.dll","lpk.dll","msvcrt.dll","shell32.dll","wow64win.dll","kernel.appcore.dll","fltLib.dll","gdi32full.dll","windows.storage.dll","VxSSL32.dll","win32u.dll","ucrtbase.dll","cryptsp.dll","bcryptprimitives.dll","wow64cpu.dll","combase.dll","ws2_32.dll","wow64.dll","msvcp_win.dll","SHCore.dll","powrprof.dll","sspicli.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"kmsauto.ini","sha256":"29e39909f47b683ba5c64ad1fce2413302c20897b34321f192414581e91b39df","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"Hx.hxn","sha256":"1ad509f446a3335376c57eeb24567aa4eaecb5bbec467319d3faaa3e950659cd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"Hx_1033_MKWD_K.HxW","sha256":"4224237016ed6634916770e6535c66fc4079c388270437950a5e8a9b422a6e9d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"Hx_1033_MKWD_NamedURL.HxW","sha256":"45d739262594940207479b7fc60b7eeb16612a2368228d7ffff9afe59940f06c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"Hx_1033_MTOC_Hx.HxH","sha256":"2962aa678f3207fb11b208fa28ae4ad6b25af928aa0143f303d3dfa5c4f32959","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"Hx_1033_MValidator.HxD","sha256":"e17105d55237ca8adc51cac5861b757c5a8aac6156caebfcdf28d55477effdfe","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"Hx_1033_MValidator.Lck","sha256":"403c84f4c940dc13d96fd58486a3e311deaca7a9b731259719b034b58ec90171","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"MS.EXCEL.14.1033.hxn","sha256":"551a2ca1259444a72ef13ef0861b2ecb0477ef13098364022ef82e2432abd494","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"MS.EXCEL.DEV.14.1033.hxn","sha256":"e0e79b72c7c3e529d0537d1f1a00bf8fb75dc53be6b2bb9ef192d9b4adde7852","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"MS.GRAPH.14.1033.hxn","sha256":"8c508badc1d5a3cb8857fa2900b5642bc4d7852170e90c6bd0894ff128e15159","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"MS.MSOUC.14.1033.hxn","sha256":"7c1c606e9f990caccca6d08213028865759b241274118f4fb4d0ba6e51e6d711","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"MS.MSPUB.14.1033.hxn","sha256":"6673193e8699320c5be1694bb8df6eb18fe0666e3a78c6e8ec0c844d00b2f457","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"MS.MSPUB.DEV.14.1033.hxn","sha256":"1e5b51eadd7c7c35ff2d1f35b1c56152134bc54c609e1f2ac4a386febed73172","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"MS.MSTORE.14.1033.hxn","sha256":"064e45844bcdfce4d448d23019ebe718902d905f5512a130d5d27412a897d13a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"MS.OIS.14.1033.hxn","sha256":"42ee62df850c69291a377ad28396d71ab8d33a3361c968da766f2312326febe9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"MS.ONENOTE.14.1033.hxn","sha256":"39eaa330853820912854c26f4e0501fa400038ad1440ea4d92d4fb56ccf6bba5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"MS.OUTLOOK.14.1033.hxn","sha256":"13c26c89e6d2a11b2eed6955c071eda9e961135c99605f66c77b112016f4a411","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"MS.OUTLOOK.DEV.14.1033.hxn","sha256":"18d7cc33ff3d6519c2ef154928cb02ba75191224eedfd73e219041ae46ab5129","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"MS.POWERPNT.14.1033.hxn","sha256":"d21d124ed4b3b6c00ccbbe9f1bebf07a5b48b127cca8c56932ddadf7fa9257df","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"MS.POWERPNT.DEV.14.1033.hxn","sha256":"8eb6fd06b56d6c39cdf9db0b717bbaff6d302dafb5955bfadb863f85fc48cdeb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"7-zip.chm","sha256":"331f8741fb56ffdaa35f6d86158c740f184ddcca4fded1ccd82dfeef76f83435","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"7z.dll","sha256":"106538407ea53feb4378760e8ca8d3db02a917ddf31fa864d96ace5c6c80fec3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"7z.exe","sha256":"f2d2762ad5845e607d4a3f80a59be35fd629da70ffb7f829bb9c912e0dbf73d0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"7zFM.exe","sha256":"e0e1dd939dea2b56814fa405d7b55f0899352e92d924bdbb13054a155674c2f0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"7zG.exe","sha256":"709082b5e56a35491d56ca562f4cce9383aa24fc19fb113381e68865d8e65946","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"Uninstall.exe","sha256":"4950726e28f53c1702723ec1c0a701fd628d19fcc53b88b74842cec4a176159e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"Au3Check.exe","sha256":"8405380a4e2beaef1b1ed8e601bbe29dd30f6d67ba991a5cadbf15938dc4d90e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"Au3Info.exe","sha256":"9c1ab935b39e1c1140be0a36223315178e02f135df72e3563120c04e99e29ad4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"Au3Info_x64.exe","sha256":"49f0f3a3ae095183ad79358a415cfaffb0934d12dccddfe6a9bbdda6ba68e4d2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"AutoIt3Help.exe","sha256":"653eb3ddcc1bffd3938ecdbe220e59c5c892ab2193d1258cb84661c81d0b2b28","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"AutoIt3_x64.exe","sha256":"3609e76d5e2b74c72701751b995e1734dbe52f5fe74be7e07467dd38e5ea1a8e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"CCEnhancer-4.5.1.exe","sha256":"f3535cf7862a3c4ed474c437f9cfab39f80bb4ed033e06e0b9318ac4eeb33144","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"sllauncher.exe","sha256":"4bff647cf604e605c7de1be04931959b38130641be2859be8cd8b6057397fa4a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"xapauthenticodesip.dll","sha256":"3171d805dbd12fa772c66140de480664e6d43b841ab44e366529b744e3973b6a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"AccessibleHandler.dll","sha256":"779bcfa9f95a869e8463f86e700d654ef5fff90fc18b0c7ee60ec97c6e5f321e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"AccessibleMarshal.dll","sha256":"d32b21637e19d10f3bfbf3750a029d7675e888530f579cb81484cafdb625a0bd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"IA2Marshal.dll","sha256":"de03545fd1477282afb654b3974a0acfaaee30aa273d4257aa4694915e9fd2e7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"api-ms-win-core-console-l1-1-0.dll","sha256":"5affacd9fcc6c76a90df57b95134770b9cc2f020aa5e99dca7bccef6fd0153db","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"api-ms-win-core-datetime-l1-1-0.dll","sha256":"ac4084034e82288f33701728b13513525ab35f83d4358bdaf2627681e1306edc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"api-ms-win-core-debug-l1-1-0.dll","sha256":"f4d7baba8d76bca1d722d82083b9652a36b04cb1ceafed39d5e1360d9895a0bd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"api-ms-win-core-errorhandling-l1-1-0.dll","sha256":"f61471b73d4db019a0f40dd291a2838b0502c04c2fb387448ce7f6f43c269681","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"api-ms-win-core-file-l1-1-0.dll","sha256":"62f8faeec60741fe6cb0d1018511bf788b582e286efa737506f430dab0e526aa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"api-ms-win-core-file-l1-2-0.dll","sha256":"ba64a416cad54bb3f77844a32effd498e1f36e2b1f7b6a2401ac0505cbd84b62","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"api-ms-win-core-file-l2-1-0.dll","sha256":"416cbb43339ae66a00e8475289d3e01d644722a34c0333f436a6e0567d62fcf4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"api-ms-win-core-handle-l1-1-0.dll","sha256":"aa6dc46002bf02e71f732406fb9d323d4fb52427a0891978da76ee9659c3c732","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"api-ms-win-core-heap-l1-1-0.dll","sha256":"e74d63ab42f72d4925c44c329d71163d8ff118c36d0a07e555bdefc1bf55c887","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"api-ms-win-core-interlocked-l1-1-0.dll","sha256":"a3b9c914ddc81779efbd06bdd00da2628753e25df3b0fb1cddfb23b1876699d1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"api-ms-win-core-libraryloader-l1-1-0.dll","sha256":"80c31a566a6c7f45ea7a99bd03b17bf2850bad26ed0590a28c6f0eacb37484e7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"api-ms-win-core-localization-l1-2-0.dll","sha256":"e4bd49c0c04731bf02bafa702a9eb7f75fcc1331f3a9aaf647fb4818c9079320","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"api-ms-win-core-memory-l1-1-0.dll","sha256":"19770db89de22be643328dead587f9de3c63d35d1391305cffc883dba9543a13","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"api-ms-win-core-namedpipe-l1-1-0.dll","sha256":"2bb2e0c1d152f4bbceb08f155a457e209a579788191e34ee031ecd51af431b35","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"api-ms-win-core-processenvironment-l1-1-0.dll","sha256":"79673a5d43a9eedb8e2de2eaa12ef682667e1d929735c03e7f1bb2ae07b8a09e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"api-ms-win-core-processthreads-l1-1-0.dll","sha256":"5646f583eac8c8926d4481ba63f5ad8c9240a5e43739b19dfe1f875603f1225c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"api-ms-win-core-processthreads-l1-1-1.dll","sha256":"f175a9f5d677fb8fc12837010b52cd00069b10eda50bdfa9d6744e15a0753749","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"api-ms-win-core-profile-l1-1-0.dll","sha256":"7f5d6e0258fa069635d865f2661e21bb3262f3eb2a5b5c5b66ca16f8a6d1ee19","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"api-ms-win-core-rtlsupport-l1-1-0.dll","sha256":"a624c240960e71e1fa493ee593af55e40fe5d0ba1df0d45221bf360ff6b9ff5a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"api-ms-win-core-string-l1-1-0.dll","sha256":"1c8545521b3ea8bdabc0eb393c14e8a9781ffa93fdea9d2585c29be91d346072","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"api-ms-win-core-synch-l1-1-0.dll","sha256":"fa1c142b305452b1139bfef7c3684a8540b2a2c8a0326660f8d7dc34bc185291","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"api-ms-win-core-synch-l1-2-0.dll","sha256":"8d7ad3bc02a43f0d9b952cfcc7f7c1aa0f1ab440e5a64286bd9bade3a3824902","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"api-ms-win-core-sysinfo-l1-1-0.dll","sha256":"80c9c8d14395d137283bed170e4d7e706203f52142a4ad9439d22958639f12ca","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"api-ms-win-core-timezone-l1-1-0.dll","sha256":"7b2096dd6e2aa5f12fe53a1d47127eee44c11228f0284fadd74375ce3537f58e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"api-ms-win-core-util-l1-1-0.dll","sha256":"2da83ea6b60c784664c643873dac6ec2d6c36434d129ce71ede3af7926646302","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"api-ms-win-crt-conio-l1-1-0.dll","sha256":"f006bf7e39effec89339d8ddfb7b3a39edccc30f1b55872762fc45c58a510777","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"api-ms-win-crt-convert-l1-1-0.dll","sha256":"0dfa93609b5b1adf2a40a048df7b7a4af6f8b9c482f30e1dea12df8e81993ee1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"api-ms-win-crt-environment-l1-1-0.dll","sha256":"12e5e836b1ad0ddce83d9b2aac765324b833e94c289694a9a79fdda22823972d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"api-ms-win-crt-filesystem-l1-1-0.dll","sha256":"fdd51c0b7822c353c6b252b827aa8d27868749d173a0f67b84a39f412aeceb81","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"api-ms-win-crt-heap-l1-1-0.dll","sha256":"1b8ff3223ad9b9c35c341bd46bcf3219065dbfe90269b45e1285d8f4b9a75211","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"api-ms-win-crt-locale-l1-1-0.dll","sha256":"37b426ced9fa56a83ed3cc5a2ed5597f57252224caae5ed91456c65bdf314852","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"api-ms-win-crt-math-l1-1-0.dll","sha256":"46f1f957a1ea290c4660b8a21666af9ffbbd061157f985ad0e9f0d0bf58ad1dc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"api-ms-win-crt-multibyte-l1-1-0.dll","sha256":"aa016798c2df4ceba6742d500e82ed7b0dd89a55edac620d00179f4159223d75","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"api-ms-win-crt-private-l1-1-0.dll","sha256":"973df0ac440c62c31a89b20e241a4a7570ac242b0c635aa40f35152973acc204","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"api-ms-win-crt-process-l1-1-0.dll","sha256":"e4ed61b4940541c87341721dd821c7530e0552f5f2a0c5ae75eca9cdaa25d156","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"api-ms-win-crt-runtime-l1-1-0.dll","sha256":"d23f0d2c4e54960e9c2713e372bbacd8a3fdeee7b157a6d000a3fb5b1aeca86c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"api-ms-win-crt-stdio-l1-1-0.dll","sha256":"ac770117a7a4e4c0318056577bfb50e0180addbca55f02a14f5771d92e3715c7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"api-ms-win-crt-string-l1-1-0.dll","sha256":"5961f61174c4080a0efa71e26dfc159ca93ddb18a05b75f7626e174b740ace6e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"api-ms-win-crt-time-l1-1-0.dll","sha256":"bd594b21fc0205e75efc1ab595c8c930400746c3983d4c963313f257201d236d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"api-ms-win-crt-utility-l1-1-0.dll","sha256":"18fa71a500d7c73272d7b84c0f69b40841bacc142eaf46a49831a70e6b3b26cf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"breakpadinjector.dll","sha256":"001ab113f76c3349a43156419b00a5a1644e6ede24cfdbace409d8ee94c0eb93","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"crashreporter.exe","sha256":"1ef7cd1823642ea8aa11e45fabd18a89ba58b8d365b2eba02956bf84f80984b2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"d3dcompiler_47.dll","sha256":"78b9329a8f391fba2a7791e912e94340da6ea8b1f4c8b828a49dee0b0e36a64f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"firefox.exe","sha256":"257ee4256db64718192810222f932893152c55eabe540e6b12f165bd211c1bb7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"freebl3.dll","sha256":"d6d2822c82a8c44d74e2e376e9ac35703a8fe05b450fa73ed8df85e7984da38f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"lgpllibs.dll","sha256":"90528e3e4acf1cab5b40da1d50f5c728e722d52b71f4d037b6c8226f985458f1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"libEGL.dll","sha256":"bf89e7c7e08b7bc8ea41c85a54a903731e341cf593c3d137c137533948fb38f9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"libGLESv2.dll","sha256":"f742898acccc941bd510f8684135ade74ee27c7a783499a815b8c7468a859602","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"maintenanceservice.exe","sha256":"f3b00e6023662f7dbea3fdd62254a72358c84eed05501cd30dea075821adfa50","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"maintenanceservice_installer.exe","sha256":"2b887c9d08fece37a1ba585d149ee3788c8d2dbd5ae919db8a567465f32996c2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"minidump-analyzer.exe","sha256":"18a4f7f2b2a82b3310f91970491cf0f94f2f83afe9500b3f05357d96af95c02c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"mozavcodec.dll","sha256":"e0654156dc81337702d7ca4507080ccdc2847a8212aeb9c849ec256c4839d906","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"mozavutil.dll","sha256":"389de2d8930f43f014e26434d4de948e777c033a6ca99669dcb7d6241abec798","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"mozglue.dll","sha256":"9ac591912f5ace78e8e92cf9ab7f18b27a13c99f15e2033b88bd68427827c7a5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"msvcp140.dll","sha256":"6679311bb10a93575522f6dbb9fe372e93d630310c5be7b4c32e8f1aaeef09d3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"nss3.dll","sha256":"3c04df293dbfceab1a1c626f3df59dea1c9c30503f1f8edf97b2dcd26538f2d8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"nssckbi.dll","sha256":"448940ab2112606ad5974265ad1ab17f5b02e5a2b7b2a8b8c50947e197664e7b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"nssdbm3.dll","sha256":"19923275655d9706b1df38a0f854a79e034c0f4e1e50e95d8ee353106e32c12f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"pingsender.exe","sha256":"91fe4a2a41438db36fa8ea0e0a02d96908e22c755d6a0a11e33b69c6f9d1340a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"plugin-container.exe","sha256":"0abb8a053d59934e247bfab90d30c60a4484b9dd96e1ca01a24cdf91b64133cc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"plugin-hang-ui.exe","sha256":"3ac7969a26b2f2140091362a189dbdf162d70699206650ba1bf0b4fb2c7d3082","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"qipcap.dll","sha256":"6f21e66f7246d56cf8ee7ffbb13ce91d801e41ea65a08e339e4f91dff0d2aba5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"softokn3.dll","sha256":"6457744ecaeed33e211c743afb9b36af7c1b1484829b25d502e93ce90109a3cc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"ucrtbase.dll","sha256":"4e4105a6766c9aa175f2c5a2ccaeb2334e093e08e058548a5735ca1dfc14591e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"updater.exe","sha256":"f446e1d83fea020af4a8908211a208fa0d9d653fef6f56f54eba0a79ab846967","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"vcruntime140.dll","sha256":"7785123926e40722ae1499e8f97746a64dfbbe9478418be95c4a66d2aab78ffc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"rpcapd.exe","sha256":"df6e6ddda614ce0af0bae6e7a85cb5f9c70e51014fed13b255a6a0654e139eac","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"Qt5Core.dll","sha256":"26735d62eb1e1ad712222b31ae722c87bd7b1f3f8c04b28d13c04e7d16a4c72d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"Qt5Gui.dll","sha256":"95312a83ff0ac91cb828c5027af7ee58e79fa2dfbbeb4a1dd806ce7a096f1c42","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"Qt5Multimedia.dll","sha256":"63b170f0f6d50e751f0bd857e23be10465ccb05f5e0cfdcefefdf435c9abaa58","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"Qt5Network.dll","sha256":"98f36c092ad05176ca1506f1a0c534b94713903ea23c4ff15fc4d328cc359257","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"Qt5PrintSupport.dll","sha256":"8310f483f984d2d21c0e5ad026c723d7879537d670a9511b6ad196093567727a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"Qt5Svg.dll","sha256":"df5f409422e9d0b4e94138c495343b713e449980e18e3374fa1c8a2ce8fc8766","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"Qt5Widgets.dll","sha256":"b70740cebc32cec54e1fa59db219fd235179959d4b3f000fd777dc6fcb6fa6b6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"Qt5WinExtras.dll","sha256":"3d02c25be6f23a336d165bdc679195112c40bd37aa207695672c90386d3d9622","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"WinPcap_4_1_3.exe","sha256":"49a26aeffec02efdd11a49be3a2b837c9406dd2de9b61f4d1ebf6a71b11ea4f2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"WinSparkle.dll","sha256":"4315db1564c7f54484a793d8d6d37762d5cc3449d59e4ebe4552cadf0e27502e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"capinfos.exe","sha256":"2fe023995b141e96f42d15dc708a459cf7ab5ba7431b650cc70827f8c36d9a4f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"editcap.exe","sha256":"81c38e2995586f99e5c23e1958adb574975423f9f4aa7412cb6cde974c6d1131","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"libGLESV2.dll","sha256":"0d766c8fe89426943a475f18d9219fc128bdc3988c3c315385e6d993f0343fa8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"libgio-2.0-0.dll","sha256":"09f21b00ff1bfaf1ae68673ea572577ded9e414f201319262dd295e287af5b18","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"libgobject-2.0-0.dll","sha256":"08e851a1819fbb7c6139b13c801f2e2d988ce0cc93fd7b7d2fdb1cbf43f2ec02","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"libsbc-1.dll","sha256":"55af6cbda3d53035096d1a1e60ece9c29ff5dcb8a487a8ee6cd75dc9bc0708b6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"libspandsp-2.dll","sha256":"3a2e38e5991e57ca21ec6521365fe107f842ec7453d1ade6745b6adc85484a94","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"libssh.dll","sha256":"35a91a80732818e34252795908d5c4352d830d286687c1acca80442df4794790","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"libwscodecs.dll","sha256":"2787cdfe6625e2f7b0d3407761f91cbf34aac193917d0a5390c5109f9cc99a20","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"mergecap.exe","sha256":"2544644c5a93f442d587f3fd1baafb04991c68b6a4d75e3a23ec31d342b4c391","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"rawshark.exe","sha256":"54f8c42803f74744bcccbbaa28a1db302d0620599e0825a1f47d20d23c27f6ed","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"reordercap.exe","sha256":"a530c5f3ad6fe5e98e008bcb7cdfe08b1ec6e99202bce559d34e4517cc02add8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"text2pcap.exe","sha256":"3b7640f7fff699542be3a39e6ef85d5f17e653298a30ca5f964d117939d464f2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"uninstall.exe","sha256":"ebda55aa65926167047ed4c855fa6a57bf61b1f6feee97b7b845659e9465583a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"0YdED8h4YnKljVf.doc","sha256":"9e1573ad51ea19af8208d3096b6cba4dbea02737170e40c62110233a6b92a9da","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"1LoWM7zNlVq8h.exe","sha256":"0aa8ff7425e35d3d226529ea8d52ea393d00054273a1834f6142796c304c6cee","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"3TXw.exe","sha256":"87f4ec6d6b3e999bd04cba5af224e6b5888b186d8295b9a7b0629eb9bb7e67cd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"3VBXaPVG.exe","sha256":"229703f37337eb92c388ae67afbb3ddbd5e053f9f87900455ddee279b476dd44","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"3kNG.exe","sha256":"5ce17fe80a18fcb112d146b4e9dcf279407241d0bda353678241d61b61f51d36","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"6JQvD1.exe","sha256":"ef11bc608905bda2b2d31be17a58dc80087a82edbefc2bd19252902a2e9c4df0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"7GXTVgCwg.exe","sha256":"0aeb6ce9cc52300cc82be3f94dbbdeea04a1c7a1c42a969597fbf5ccc288e94b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"A6a4k093.exe","sha256":"1c6bd1216220f684f1b40f4d64bc4985fdafe09719b39013f317766e723fb55e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"AMrt2OL.exe","sha256":"ab48756c82abb46bdbd48b339edb5315b62cdd4318a2405be4064acc5d838405","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"Byf3DiB7aX.doc","sha256":"59fe75c27ac4261280baf36eed8362d9c7afee14cb2b577257216d29dff4c335","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"CJ8ZksCqfYdg3Ha.exe","sha256":"76726664c5f78d69b83a250d584dfd76c8f0bf142ab3194411ca7a4f4967113c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"CspyTJgM.exe","sha256":"8e5a562f087dfc7a3977fb4ff68942d621f58dd6c17d764b22734593806b687c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"D1JACuX.exe","sha256":"76bc74cf13774499271f12aa8c54ba2e14945a8b36c1bfd5b84704072f4e7e3b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"DP001GCJ.doc","sha256":"80a7ac9e949e9ac716f695778cc424dbad0b62f951a561cfdc584263127677cb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"DcNNjRAkEraNbP.doc","sha256":"e0d7e8ca79fcf23089b1dac211013693ca34a5de4710935fa33013319ec28377","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"E68SD0Ky01dhTr.exe","sha256":"dcfa61e646034f0c3531e892f890c8050ee57e35d6821fe016ac9948244d18d3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"EW9C2p.exe","sha256":"f9da4fdebc8a9a9a38267abfd4d4a14a4e66a003fe81366d5f2f8d173a589d79","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"EatIg.exe","sha256":"529a356722487349192b0f0e0d497ec0e9efa4e5bd984b439fdf692fe574bbb4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"F3ECcNeSSZh2HHk.doc","sha256":"96de99083d54c1a81da8890c24385392cfb6c17b7a5ce917b539cf0800cb384b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"FjTsWkpkM.exe","sha256":"6f1a043d7f4e54c1656aca09da0d4863f8a0d4716ddf5c75bc9be723861bf835","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"GuVY23qj2s4Td.doc","sha256":"f558b7359ded5025ff54c4e2691c54bd4a38384c8c6be21b4eb244edf09d5d87","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"H5uM4HShGf.doc","sha256":"af22a150fedc7bbb960ab612147bd96fdd220a3b4671d5303eca2770c14266e5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"Ho7euGVfWh.doc","sha256":"76807114081d95cbe03d8450e0fb3d1d686509af0789230326cf1f4638a80a50","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"HyhkV7STqOqjMtk.exe","sha256":"0285215a9518dee5177352ec185e0242832136dfce0a71aae0a66366bb2ff401","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"IOR7TqkslejAq91.doc","sha256":"9ba88ed7232e3accaeb3686e1ba72764fa7f1d8dfa129eab7a785f75174c5656","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"KQNwhwsYVN.doc","sha256":"f75e9aede36124f20fd53679b24d9ef2f154855d5a38bb2e193bb1e2b530a45d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"Kty1hE.doc","sha256":"6f8b4943aa4631be4eae5de24a26e831b4ce884412c973144905877de832afb3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"L8yloyiM6okRPgbd.doc","sha256":"dc0d04793e08f018ba9cc85ccf0122703c0ad29c4b559af8eafcd6253d19ef12","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"MCLvMmDoz8.doc","sha256":"7fb44333be1c03cd04cc33ed2541d4141856cab08a7947ca64a68e9675098b9a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"OCXh75SGcr7.doc","sha256":"8ed70114360bdb05231d692a93fef88bf621b843befdf027d6c15224d3ac7b30","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"ara0UGGW3VRU.exe","sha256":"a28bce913215bf883ec4c1c1a97fc75d682bc7717c4f0eea1b742e591a50f2d2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"cUJpjDsZO.doc","sha256":"8abd77643f78b445d2bad128efafae55c5ec144de77d58f5965836dea9d2ab44","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"dSTEZHvd.doc","sha256":"cde52abfc3bfca1973cc44109201b53534be7435f6e84172d783b012afb9a2f0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"dsYny5bq4UJV.doc","sha256":"d5d7f7a7353590ea2ca765deeec1c21bcf84d2b13b3dcb991bbeac6eb627b73a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"fxlTZfcB.exe","sha256":"905626dc4b409c3eab6d1c37831dcd63b5eec345271f81091a2aecf816171bf1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"g5pB3.exe","sha256":"79202c5da29d1745e37f8acc28a3118d0eeac441bdd05946b3c73256df470e05","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"gBiUJ4TRATi57.doc","sha256":"090e7fb7bc67d3112c5bc5b311f4df71dbe0f6fc3836ac6b8c09762c7f0fc31c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"giDj6Q.doc","sha256":"c141cdd4f83bf49d3d6374994bac09e35eb12aa8addb88de915c2d312dfcf9a5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"gmSsIkVXD.exe","sha256":"4800fe0044ba9e4dfd16b1ccd7f2f00a9374885e18a2499018557a491f18ebe5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"h8fg9WRouk.doc","sha256":"39a12ed286a12fff243bc5f4dce15966a0b9815c66ba2012654caea727c76bc6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"hgUOm8vUl.doc","sha256":"bb440ab650f551e25d7cf17065ab65bf75ea03fdcd151be4bb813eb926f8c532","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"jLgQj5MNMjfkAYq.exe","sha256":"3530d5e6c55c283cc61e00daa339f61b37ff236d79b606b837a14b68c6365527","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"jR4UhePpkWKtU.exe","sha256":"624d67330198f6d2e3ffddb6c15cb8308fee1e778b95bb1e64ac65ea8e6307ef","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"kM4aPm1y.exe","sha256":"472e1947f873c962b11293d885638ede55bcf7dd27fc0eda5b48aacdbdc154d9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"lKxIrwOivZM.doc","sha256":"a3dabfff82305f8745c0a167e4948345b883323a2f4f839c34d2f336978ae162","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"mgF1qbnPMDZnVB.exe","sha256":"e2f96454011300eb56ed392d8331591c48f973c224412a0eb9988887cf876ef8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"oBqqx89Mp9N.doc","sha256":"cd0db692370dada8b2f068b22e1c9007520bd0d86ec8b1b52c788afe7d9903e0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"Desktop.lnk","sha256":"7100c31ac145fa895a5806917134a7f1df385a1d8249aebcdb06e977b4b3b2af","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"Downloads.lnk","sha256":"c1a17a81616828c5cb2e427d9d952c42a5f4faa13851ee3aa83f5228ac58b8ca","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"OneDrive.lnk","sha256":"34c53bb04b330953a72fb40546bd4ffcc17903c47812c3064b3cd2b39a1c0526","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"RecentPlaces.lnk","sha256":"80761fc9191a2d7d509856510afc884845006268296da739798028bbc8bdbc53","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"autoexec.bat","sha256":"26df919beb5c002c8a217879c24cb3a79d1bcc4429a61daacd2a4f614ccbba13","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"OneNoteSyncPC.dll","sha256":"acf6720434fbf518fb6489c6af4b5f84527dac83251e5369f7055f777da8ca08","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"name":"HowToDecrypt.txt","sha256":"ed4a844fb66f28fad2b2dbe85077527efbfcd76183e3591d82032e42ce82a264","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"name":"PH02757U.BMP","sha256":"9a68b7a88ab0154e2476e4da0ba6f3de6666db5e7a285e98a95310cc851e5ebe","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"name":"PKTC-IETF-MTA-MIB","sha256":"c9f0dffeeec4c9a9d9503c2120b9ef7232ffa36f3380bc64655972e173eef37a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"name":"J0093905.WMF","sha256":"9dd03b119160c6104afd7327eb6a2ffa0f2f2077b40a1f5cb27acc3ed9fc3cbd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"name":"FRAMEWORK-FEEDBACK-PIB","sha256":"591c70105d006212f8c7f867c5e8f2d58e3b5491961d755781aead690afea72a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"name":"BD06200_.WMF","sha256":"ea2ce0247a912033b92145a02bce66b319801cd3ed903da47776ab5e4469d6f8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"name":"J0152606.WMF","sha256":"5dc0db743728096a2c1a9500667de72cb29d88b7875c3c5f8490982f8068cd2b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"name":"J0198025.WMF","sha256":"b9d611f14129003f5a05f64ace9d35794f4c621ee991ccc9c67ec0a89d5a049a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"name":"ATM-ACCOUNTING-INFORMATION-MIB","sha256":"c2546d46597c851dfc89eb1665ac08260fc72e33296b5163c39c3b4e8f5db580","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"name":"J0105502.WMF","sha256":"abd34ee3e218bb93a15ef432ae9e098c30169cc955e0ee273f87d8385bfb82c3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]}],"files_written":[{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"},{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001b.db","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"C:\\$Recycle.Bin\\S-1-5-21-2092356043-4041700817-663127204-1001\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%USERPROFILE%\\Desktop\\HowToDecrypt.txt","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"},{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\HowToDecrypt.txt","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"},{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\share\\HowToDecrypt.txt","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"},{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\share\\splwow32.bin.exe","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"C:\\splwow32.bin.exe","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Wireshark\\comerr32.dll","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Wireshark\\dumpcap.exe","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"C:\\Czuw.pIs","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"},{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Wireshark\\libglib-2.0-0.dll","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Wireshark\\libgmodule-2.0-0.dll","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Wireshark\\libgmp-10.dll","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Wireshark\\libgnutls-30.dll","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Wireshark\\libgpg-error-0.dll","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Wireshark\\libhogweed-4-2.dll","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Wireshark\\libintl-8.dll","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Wireshark\\liblz4.dll","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Wireshark\\libnettle-6-2.dll","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Wireshark\\libnghttp2-14.dll","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Wireshark\\libp11-kit-0.dll","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Wireshark\\libsmi-2.dll","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Wireshark\\libsnappy-1.dll","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Wireshark\\libtasn1-6.dll","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Wireshark\\libwinpthread-1.dll","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Wireshark\\libwireshark.dll","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Wireshark\\libwiretap.dll","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Wireshark\\libwsutil.dll","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Wireshark\\libxml2-2.dll","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Wireshark\\lua52.dll","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%WINDIR%\\System32\\en-US\\sc.exe.mui","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Wireshark\\k5sprt32.dll","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Wireshark\\krb5_32.dll","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Wireshark\\libcares-2.dll","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Wireshark\\libffi-6.dll","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Wireshark\\libgcc_s_sjlj-1.dll","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Wireshark\\libgcrypt-20.dll","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Wireshark\\libGeoIP-1.dll","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Wireshark\\tshark.exe","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Wireshark\\zlib1.dll","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Windows Sidebar\\sbdrop.dll","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Windows Sidebar\\sidebar.exe","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Windows Sidebar\\wlsrvc.dll","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Windows Portable Devices\\sqmapi.dll","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Windows Photo Viewer\\ImagingDevices.exe","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Windows Photo Viewer\\ImagingEngine.dll","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Windows Photo Viewer\\PhotoAcq.dll","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Windows Photo Viewer\\PhotoBase.dll","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Windows Photo Viewer\\PhotoViewer.dll","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Windows Media Player\\mpvis.DLL","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Windows Media Player\\setup_wm.exe","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Windows Media Player\\wmlaunch.exe","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Windows Media Player\\wmpconfig.exe","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Windows Media Player\\WMPDMC.exe","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Windows Media Player\\WMPDMCCore.dll","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Windows Media Player\\wmpenc.exe","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Windows Media Player\\wmplayer.exe","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Windows Media Player\\WMPMediaSharing.dll","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Windows Media Player\\wmpnetwk.exe","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Windows Media Player\\wmpnscfg.exe","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Windows Media Player\\wmpnssci.dll","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Windows Media Player\\WMPNSSUI.dll","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Windows Media Player\\wmprph.exe","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Windows Media Player\\wmpshare.exe","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Windows Media Player\\WMPSideShowGadget.exe","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Windows Media Player\\wmssetup.ceb","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Windows Media Player\\wmssetup.dll","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Windows Mail\\msoe.dll","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Windows Mail\\MSOERES.dll","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Windows Mail\\oeimport.dll","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Windows Mail\\wab.exe","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Windows Mail\\wabfind.dll","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Windows Mail\\wabimp.dll","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Windows Mail\\wabmig.exe","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Windows Defender\\MpAsDesc.dll","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Windows Defender\\MpClient.dll","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Windows Defender\\MpCmdRun.exe","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Windows Defender\\MpCommu.dll","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Windows Defender\\MpEvMsg.dll","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Windows Defender\\MpOAV.dll","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Windows Defender\\MpRTP.dll","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Windows Defender\\MpSvc.dll","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Windows Defender\\MSASCui.exe","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Windows Defender\\MsMpCom.dll","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Windows Defender\\MsMpLics.dll","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Windows Defender\\MsMpRes.dll","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\D3DCompiler_47.dll","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\DiagnosticsHub.DataWarehouse.dll","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\DiagnosticsHub.ScriptedSandboxPlugin.dll","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\DiagnosticsHub_is.dll","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\DiagnosticsTap.dll","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\ExtExport.exe","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\F12.dll","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\F12Resources.dll","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\F12Tools.dll","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\ie9props.propdesc","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\iediagcmd.exe","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\iedvtool.dll","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\ieinstal.exe","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\ielowutil.exe","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\ieproxy.dll","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\IEShims.dll","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\iessetup.ceb","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\iessetup.dll","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\jsdbgui.dll","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\jsdebuggeride.dll","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\JSProfilerCore.dll","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\jsprofilerui.dll","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\MemoryAnalyzer.dll","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\msdbg2.dll","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\networkinspection.dll","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\pdm.dll","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\pdmproxy100.dll","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\perfcore.dll","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\perf_nt.dll","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\sqmapi.dll","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\Timeline.cpu.xml","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\Timeline.dll","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\Timeline_is.dll","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\DVD Maker\\audiodepthconverter.ax","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\DVD Maker\\bod_r.TTF","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\DVD Maker\\directshowtap.ax","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\DVD Maker\\DVDMaker.exe","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\DVD Maker\\Eurosti.TTF","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\DVD Maker\\fieldswitch.ax","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\DVD Maker\\offset.ax","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\DVD Maker\\OmdBase.dll","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\DVD Maker\\OmdProject.dll","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\DVD Maker\\Pipeline.dll","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\DVD Maker\\PipeTran.dll","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\DVD Maker\\rtstreamsink.ax","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\DVD Maker\\rtstreamsource.ax","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\DVD Maker\\SecretST.TTF","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\DVD Maker\\soniccolorconverter.ax","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\DVD Maker\\sonicsptransform.ax","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\DVD Maker\\WMM2CLIP.dll","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\AutoIt3\\AutoIt3.exe","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%PROGRAMFILES%\\7-Zip\\7-zip.dll","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%USERPROFILE%\\Searches\\Indexed Locations.search-ms","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"%USERPROFILE%\\Downloads\\Of0iIqSzzrTMYx5R.rar","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\acmigration.dll","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\acres.dll","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\aeinv.dll","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\api-ms-win-core-apiquery-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\api-ms-win-downlevel-advapi32-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\api-ms-win-downlevel-advapi32-l1-1-1.dll","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\api-ms-win-downlevel-advapi32-l2-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\api-ms-win-downlevel-advapi32-l2-1-1.dll","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\api-ms-win-downlevel-advapi32-l3-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\api-ms-win-downlevel-advapi32-l4-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\api-ms-win-downlevel-kernel32-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\api-ms-win-downlevel-kernel32-l2-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\api-ms-win-downlevel-ole32-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\api-ms-win-downlevel-ole32-l1-1-1.dll","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\api-ms-win-downlevel-shlwapi-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\api-ms-win-downlevel-shlwapi-l1-1-1.dll","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\api-ms-win-downlevel-user32-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\api-ms-win-downlevel-user32-l1-1-1.dll","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\api-ms-win-downlevel-version-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\AppCompatServicing.dll","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\appraiser.dll","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\appraiser.sdb","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\AppraiserRes.dll","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\cmi2migxml.dll","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\compatctrl.dll","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\compatprovider.dll","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\compatResources.dll","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\csiagent.dll","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\devinv.dll","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\Diager.dll","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\diagtrack.dll","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\DiagTrackRunner.exe","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\dismapi.dll","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\dismcore.dll","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\dismcoreps.dll","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\dismprov.dll","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\DU.dll","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\ext-ms-win-advapi32-encryptedfile-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\folderprovider.dll","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\GatherOsState.exe","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\generaltel.dll","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\hwcompat.txt","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\hwexclude.txt","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\imagingprovider.dll","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\logprovider.dll","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\mediasetupuimgr.dll","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\migcore.dll","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\mighost.exe","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\migres.dll","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\migstore.dll","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\Mitigation.dll","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\nxquery.inf","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\NXQuery.sys","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\reagent.admx","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\reagent.dll","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\reagent.xml","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\reportgen.dll","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\setupcompat.dll","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\setupcore.dll","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\SetupHost.exe","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\setupmgr.dll","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\setupplatform.cfg","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\setupplatform.dll","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\setupplatform.exe","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\SetupPlatform.ini","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\setupprep.exe","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\SFCN.DAT","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\SFLCID.DAT","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\SFLISTRS1.DAT","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\SFLISTWT.DAT","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\SFLISTWT.WOA.DAT","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\SFPAT.INF","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\SFPATRS1.INF","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\SFPATWT.INF","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\unattend.dll","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\unbcl.dll","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\uninstall.xml","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\UpdateSetupUIMgr.dll","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\upgrade_bulk.xml","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\vhdprovider.dll","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\wdsclientapi.dll","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\wdscore.dll","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\wdscsl.dll","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\wdsimage.dll","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\wdstptc.dll","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\wdsutil.dll","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\wimprovider.dll","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\windlp.dll","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\winsetup.dll","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\wpx.dll","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\found.000\\dir0010.chk\\bootmgfw.efi.mui","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\found.000\\dir0010.chk\\bootmgr.efi.mui","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\found.000\\dir0008.chk\\rc_btradiooff.ps1","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\found.000\\dir0008.chk\\rc_checkbt.ps1","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\found.000\\dir0007.chk\\rc_bitsdll.ps1","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\found.000\\dir0007.chk\\ts_main.ps1","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\found.000\\dir0006.chk\\cl_invocation.ps1","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"C:\\found.000\\dir0006.chk\\cl_loadassembly.ps1","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Wireshark\\Acknowledgements.md","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Wireshark\\AUTHORS-SHORT","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Wireshark\\capinfos.exe","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Wireshark\\capinfos.html","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Wireshark\\captype.exe","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Wireshark\\captype.html","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Wireshark\\cfilters","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Wireshark\\charset-1.dll","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Wireshark\\colorfilters","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Wireshark\\console.lua","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Wireshark\\COPYING.txt","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Wireshark\\d3dcompiler_47.dll","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Wireshark\\dfilters","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Wireshark\\dftest.exe","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Wireshark\\dftest.html","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Wireshark\\dtd_gen.lua","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Wireshark\\dumpcap.html","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Wireshark\\editcap.exe","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Wireshark\\editcap.html","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Wireshark\\enterprises.tsv","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Wireshark\\extcap.html","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Wireshark\\faq.html","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Wireshark\\gpl-2.0-standalone.html","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Wireshark\\gthread-2.0-0.dll","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Wireshark\\init.lua","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Wireshark\\ipmap.html","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Wireshark\\libbcg729.dll","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Wireshark\\libilbc.dll","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Wireshark\\libsbc-1.dll","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Wireshark\\libspandsp-2.dll","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Wireshark\\manuf","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Wireshark\\mergecap.exe","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Wireshark\\mergecap.html","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Wireshark\\mmdbresolve.exe","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Wireshark\\mmdbresolve.html","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Wireshark\\NEWS.txt","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Wireshark\\npcap-1.71.exe","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Wireshark\\opengl32sw.dll","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Wireshark\\opus.dll","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Wireshark\\pdml2html.xsl","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Wireshark\\pthreadVC3.dll","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Wireshark\\Qt6Core.dll","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Wireshark\\Qt6Core5Compat.dll","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Wireshark\\Qt6Gui.dll","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Wireshark\\Qt6Multimedia.dll","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Wireshark\\Qt6Network.dll","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Wireshark\\Qt6PrintSupport.dll","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Wireshark\\Qt6Svg.dll","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Wireshark\\Qt6Widgets.dll","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Wireshark\\rawshark.exe","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Wireshark\\rawshark.html","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Wireshark\\README.txt","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Wireshark\\README.windows.txt","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Wireshark\\reordercap.exe","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Wireshark\\reordercap.html","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Wireshark\\services","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Wireshark\\smi_modules","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Wireshark\\ssh.dll","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Wireshark\\text2pcap.exe","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Wireshark\\text2pcap.html","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Wireshark\\tshark.html","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Wireshark\\uninstall-wireshark.exe","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Wireshark\\WinSparkle.dll","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Wireshark\\wireshark-filter.html","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Wireshark\\Wireshark.exe","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Wireshark\\wireshark.html","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Wireshark\\wka","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Wireshark\\ws.css","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\rempl\\CTAC.json","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\rempl\\disktoast.exe","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\rempl\\osrrb.exe","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\rempl\\rempl.xml","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\rempl\\sedlauncher.exe","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\rempl\\sedplugins.dll","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\rempl\\ServiceStackHardening.Inf","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\rempl\\strgsnsaddons.dll","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\rempl\\toastlogo.png","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Npcap\\CheckStatus.bat","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Npcap\\DiagReport.bat","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Npcap\\DiagReport.ps1","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Npcap\\FixInstall.bat","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Npcap\\install.log","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Npcap\\LICENSE","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Npcap\\npcap.cat","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Npcap\\npcap.inf","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Npcap\\npcap.sys","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Npcap\\npcap_wfp.inf","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Npcap\\NPFInstall.exe","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Npcap\\NPFInstall.log","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Npcap\\Uninstall.exe","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\mitmproxy\\logo.ico","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\mitmproxy\\uninstall.dat","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\mitmproxy\\uninstall.exe","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Icon.033F861B.4BF0.431A.8E7C.58F53D588960.exe","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Icon.05529995.0C4B.4B5C.8A34.4C8FB6C493E2.exe","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Icon.1CAF0566.1385.42CB.A31F.580978CFEED1.exe","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Icon.40BB677D.0A7A.4D43.9F72.5AE6F0E97EE2.exe","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Icon.4DC581BB.4DF6.4376.8C18.AC7690CBEE7B.exe","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Icon.57D52F1E.F0D3.4F58.8F76.E727437CB7A9.exe","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Icon.6AFF5016.E571.4E7C.AE8E.B1EB13D36EE2.exe","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Icon.7E3E9021.9723.4BFF.BACD.087B95A4CC01.exe","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Icon.7F73F864.FB56.49F2.8A13.7D9952C3AAED.exe","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Icon.8D34AD9F.DDB0.4D70.9623.57654F34F816.exe","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Icon.90768852.08A2.494E.BF63.2D2AF2998F37.exe","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Icon.9EE5A229.931B.4BB5.B8A7.79EF229F3D68.exe","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Icon.A5AEEF5F.4B00.496A.BD92.039B20A17EDA.exe","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Icon.B9FB7347.CAE7.494C.A15D.5C1DB5D01BEC.exe","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Icon.D9679595.74DB.4A19.BF75.158941B688AB.exe","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\KMSpico\\Service_KMS.exe","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\Crashpad\\settings.dat","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\(x86)\\MSBuild\\Microsoft.Office.InfoPath.targets","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft OneDrive\\OneDriveSetup.exe","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\(x86)\\AutoIt3\\Au3Check.dat","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\(x86)\\AutoIt3\\Au3Check.exe","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\(x86)\\AutoIt3\\Au3Info.exe","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\(x86)\\AutoIt3\\Au3Info_x64.exe","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\(x86)\\AutoIt3\\AutoIt v3 Website.url","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\(x86)\\AutoIt3\\AutoIt.chm","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\(x86)\\AutoIt3\\AutoIt3.exe","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\(x86)\\AutoIt3\\AutoIt3Help.exe","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"path":"%PROGRAMFILES%\\(x86)\\AutoIt3\\Uninstall.exe","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\BITBUCKET\\VOLUME\\{DCBFAAC4-D863-11E7-B9FF-806E6F6E6963}\\","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\BITBUCKET\\VOLUME\\{815EAD30-0000-0000-0000-501F00000000}\\","sources":[{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\AEEAEE SET","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"}]},{"name":"AEEAEE SET","sources":[{"report_type":"sandbox","report_id":"5e78ed153daf7f279752d305"},{"report_type":"sandbox","report_id":"6757bc0fc7ae969a5f016802"}]}]}},"report_ids":{"sandbox_job_ids":["5e78ed153daf7f279752d305","6757bc0fc7ae969a5f016802"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Ransom.Genasom.Generic Sample 6cb9afff8166… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 6cb9afff8166…. Malware family: Ransom.Genasom.Generic. Threat score 100/100. 24/25 AV engines flagged this file. 10 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306"}],["$","meta","4",{"property":"og:title","content":"Malicious Ransom.Genasom.Generic Sample 6cb9afff8166… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 6cb9afff8166…. Malware family: Ransom.Genasom.Generic. Threat score 100/100. 24/25 AV engines flagged this file. 10 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Ransom.Genasom.Generic Sample 6cb9afff8166… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 6cb9afff8166…. Malware family: Ransom.Genasom.Generic. Threat score 100/100. 24/25 AV engines flagged this file. 10 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L42","11",{}]]