24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 64:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4a1,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Dropper Sample c354467ec5d3… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample c354467ec5d3…. Malware family: Trojan.Dropper. Threat score 100/100. 14/28 AV engines flagged this file. 13 malicious and 31 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4","keywords":["Malicious","Trojan.Dropper","malware analysis","sandbox report","threat intelligence","c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4"],"about":{"@type":"SoftwareApplication","name":"E00499E21F9DCF77FC990400B8B3C2B5.exe","applicationCategory":["peexe","executable"],"identifier":"c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Dropper","antivirusDetections":{"malicious":14,"total":28},"behavioralIndicators":{"malicious":13,"suspicious":31},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T6a8,".exe" touched file "C:\Windows\SysWOW64\oleaccrc.dll" ".exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" ".exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" ".exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\cversions.1.db" ".exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000019.db" ".exe" touched file "C:\Windows\AppPatch\AppPatch64\sysmain.sdb" ".exe" touched file "C:\Windows\System32\wscript.exe" ".exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" ".exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\cversions.1.db" ".exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000019.db" "wscript.exe" touched file "C:\Windows\System32\en-US\wscript.exe.mui" "wscript.exe" touched file "C:\Windows\System32\wscript.exe" "wscript.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "wscript.exe" touched file "C:\Windows\System32\rsaenh.dll" "wscript.exe" touched file "C:\Windows\System32\wshom.ocx" "wscript.exe" touched file "C:\Windows\System32" "wscript.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "wscript.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\cversions.1.db" "wscript.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000019.db"26:Ta9f,".exe" wrote bytes "d055b6756473bf750000000051c1a5769498a576ee9ca57675dca776273ea7760fb3ab760000000085489675698796750f779875d9179675ead79775a9349675f8119675201496750c119675f516967554149675ff1096753214967500000000" to virtual address "0x740A1000" (part of module "SHFOLDER.DLL") ".exe" wrote bytes "711171007a3b7000ab8b02007f950200fc8c0200729602006cc805001ecd6d007d266d00" to virtual address "0x76D807E4" (part of module "USER32.DLL") "rundll32.exe" wrote bytes "c0df43771cf94277ccf842770d64447700000000c011967500000000fc3e967500000000e0139675000000009457777625e04377c6e0437700000000bc6a767600000000cf3196750000000093197776000000002c32967500000000" to virtual address "0x76A31000" (part of module "NSI.DLL") "rundll32.exe" wrote bytes "0efc467781ed4577ae864477c6e04377effd46772d164577c0fc4277da8f4d7760144777478d4477a8e243776089447700000000ad37d3768b2dd376b641d37600000000" to virtual address "0x73E31000" (part of module "WSHIP6.DLL") "rundll32.exe" wrote bytes "7d07477781ed4577ae864477c6e04377effd46772d16457760144777478d4477a8e243776089447700000000ad37d3768b2dd376b641d37600000000" to virtual address "0x73E41000" (part of module "WSHTCPIP.DLL") "rundll32.exe" wrote bytes "b4360200" to virtual address "0x74CD4D68" (part of module "SSPICLI.DLL") "rundll32.exe" wrote bytes "b4360200" to virtual address "0x74CD4EA4" (part of module "SSPICLI.DLL") "rundll32.exe" wrote bytes "b436cd74" to virtual address "0x74CE01E4" (part of module "SSPICLI.DLL") "rundll32.exe" wrote bytes "d83acd74" to virtual address "0x74CE01E0" (part of module "SSPICLI.DLL") "rundll32.exe" wrote bytes "b436cd74" to virtual address "0x74CE0200" (part of module "SSPICLI.DLL") "rundll32.exe" wrote bytes "b436cd74" to virtual address "0x74CE025C" (part of module "SSPICLI.DLL") "rundll32.exe" wrote bytes "d83acd74" to virtual address "0x74CE01FC" (part of module "SSPICLI.DLL") "rundll32.exe" wrote bytes "6012f673" to virtual address "0x73FA4028" (part of module "WEBIO.DLL") "rundll32.exe" wrote bytes "68130000" to virtual address "0x76D31680" (part of module "WS2_32.DLL") "rundll32.exe" wrote bytes "b84013f673ffe0" to virtual address "0x74CD3AD8" (part of module "SSPICLI.DLL") "rundll32.exe" wrote bytes "d83a0200" to virtual address "0x74CD4E38" (part of module "SSPICLI.DLL") "rundll32.exe" wrote bytes "d83a0200" to virtual address "0x74CD4D78" (part of module "SSPICLI.DLL") "rundll32.exe" wrote bytes "d83acd74" to virtual address "0x74CE0258" (part of module "SSPICLI.DLL") "rundll32.exe" wrote bytes "b436cd74" to virtual address "0x74CE0278" (part of module "SSPICLI.DLL") "rundll32.exe" wrote bytes "b8c015f673ffe0" to virtual address "0x74CD36B4" (part of module "SSPICLI.DLL")27:T4a4,".exe" wrote 32 bytes to a remote process "C:\Windows\System32\wscript.exe" (Handle: 28) ".exe" wrote 52 bytes to a remote process "C:\Windows\System32\wscript.exe" (Handle: 28) ".exe" wrote 4 bytes to a remote process "C:\Windows\System32\wscript.exe" (Handle: 28) ".exe" wrote 8 bytes to a remote process "C:\Windows\System32\wscript.exe" (Handle: 28) "cmd.exe" wrote 32 bytes to a remote process "C:\Windows\System32\rundll32.exe" (Handle: 96) "cmd.exe" wrote 52 bytes to a remote process "C:\Windows\System32\rundll32.exe" (Handle: 96) "cmd.exe" wrote 8 bytes to a remote process "C:\Windows\System32\rundll32.exe" (Handle: 96) "rundll32.exe" wrote 1500 bytes to a remote process "C:\Windows\SysWOW64\rundll32.exe" (Handle: 76) "rundll32.exe" wrote 8 bytes to a remote process "C:\Windows\SysWOW64\rundll32.exe" (Handle: 76) "rundll32.exe" wrote 4 bytes to a remote process "C:\Windows\SysWOW64\rundll32.exe" (Handle: 76) "rundll32.exe" wrote 32 bytes to a remote process "C:\Windows\SysWOW64\rundll32.exe" (Handle: 76) "rundll32.exe" wrote 52 bytes to a remote process "C:\Windows\SysWOW64\rundll32.exe" (Handle: 76)28:T5c3,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4") file/memory contains long string with (Indicator: "VirtualAlloc"; File: "System.dll") file/memory contains long string with (Indicator: "VirtualFree"; File: "System.dll") Found reference to API "MpFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00003332.00000000.298704.8F813000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00003332.00000000.298704.D672D000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00003332.00000000.298704.D672D000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp")29:T11af,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003332.00000000.298704.8F813000.00000002.mdmp, 00000000-00003332.00000000.298704.D672D000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003332.00000000.298704.8F813000.00000002.mdmp, 00000000-00003332.00000000.298704.D672D000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00003332.00000000.298704.D672D000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00003332.00000000.298704.D672D000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00003332.00000000.298704.D672D000.00000002.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00003332.00000000.298704.D672D000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00003332.00000000.298704.D672D000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00003332.00000000.298704.D672D000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; Source: "00000000-00003332.00000000.298704.D672D000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00003540.00000000.298973.45B09000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00003540.00000000.298973.45B09000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00003540.00000000.298973.45B09000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003540.00000000.298973.45B09000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003540.00000000.298973.45B09000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00003540.00000000.298973.45B09000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00005504.00000000.299031.002FA000.00000002.mdmp, 00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00005504.00000000.299031.002FA000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00005504.00000000.299031.002FA000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005504.00000000.299031.002FA000.00000002.mdmp, 00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005504.00000000.299031.002FA000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00005504.00000000.299031.002FA000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp")2a:T83c,Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4") file/memory contains long string with (Indicator: "FreeLibrary"; File: "System.dll") file/memory contains long string with (Indicator: "LoadLibrary"; File: "System.dll") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00003332.00000000.298704.8F813000.00000002.mdmp, 00000000-00003332.00000000.298704.D672D000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00003332.00000000.298704.8F813000.00000002.mdmp, 00000000-00003332.00000000.298704.D672D000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00003332.00000000.298704.D672D000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00003540.00000000.298973.45B09000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00003540.00000000.298973.45B09000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00005504.00000000.299031.002FA000.00000002.mdmp, 00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00005504.00000000.299031.002FA000.00000002.mdmp, 00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp")2b:T613,Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; File: "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4") Found reference to API "RegSetValueA" (Indicator: "RegSetValue"; Source: "00000000-00003332.00000000.298704.D672D000.00000002.mdmp") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; Source: "00000000-00003332.00000000.298704.D672D000.00000002.mdmp") Found reference to API "RegSetValueExW" (Indicator: "RegSetValue"; Source: "00000000-00003332.00000000.298704.D672D000.00000002.mdmp") Found reference to API "RegSetValueExW" (Indicator: "RegSetValue"; Source: "00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp") Found reference to API "RegReplaceKeyW" (Indicator: "RegReplaceKey"; Source: "00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp") Found reference to API "RegFlushKey" (Indicator: "RegFlushKey"; Source: "00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp") Found reference to API "RegRestoreKeyW" (Indicator: "RegRestoreKey"; Source: "00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp")2c:T57e,"wscript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{5E5F29CE-E0A8-49D3-AF32-7A7BDC173478}") "wscript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{5E5F29CE-E0A8-49D3-AF32-7A7BDC173478}") "wscript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{5E5F29CE-E0A8-49D3-AF32-7A7BDC173478}\INPROCSERVER32") "wscript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{5E5F29CE-E0A8-49D3-AF32-7A7BDC173478}\INPROCSERVER32") "wscript.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{5E5F29CE-E0A8-49D3-AF32-7A7BDC173478}\INPROCSERVER32") "wscript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{5E5F29CE-E0A8-49D3-AF32-7A7BDC173478}\INPROCSERVER32") "wscript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{5E5F29CE-E0A8-49D3-AF32-7A7BDC173478}\INPROCHANDLER32") "wscript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{5E5F29CE-E0A8-49D3-AF32-7A7BDC173478}\INPROCHANDLER32") "wscript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{5E5F29CE-E0A8-49D3-AF32-7A7BDC173478}\INPROCHANDLER") "wscript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{5E5F29CE-E0A8-49D3-AF32-7A7BDC173478}\INPROCHANDLER") "wscript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{5E5F29CE-E0A8-49D3-AF32-7A7BDC173478}") "wscript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{5E5F29CE-E0A8-49D3-AF32-7A7BDC173478}\TREATAS")2d:Tabc,"c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" queried SystemProcessInformation at 00000000-00003720-00000C15-3628689323 [PID: 3720] "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" queried SystemProcessInformation at 00000000-00003720-00000C15-3628695796 [PID: 3720] "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" queried SystemProcessInformation at 00000000-00003720-00000C15-3628879743 [PID: 3720] "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" queried SystemProcessInformation at 00000000-00003720-00000C15-3628885836 [PID: 3720] "wscript.exe" queried SystemProcessInformation at 00000000-00003332-00000C15-3630369390 [PID: 3332] "wscript.exe" queried SystemProcessInformation at 00000000-00003332-00000C15-3630375733 [PID: 3332] "wscript.exe" queried SystemProcessInformation at 00000000-00003332-00000C15-3631446714 [PID: 3332] "wscript.exe" queried SystemProcessInformation at 00000000-00003332-00000C15-3631453160 [PID: 3332] "cmd.exe" queried SystemProcessInformation at 00000000-00002432-00000C15-3633239133 [PID: 2432] "cmd.exe" queried SystemProcessInformation at 00000000-00002432-00000C15-3633277430 [PID: 2432] "cmd.exe" queried SystemProcessInformation at 00000000-00002432-00000C15-3633708826 [PID: 2432] "cmd.exe" queried SystemProcessInformation at 00000000-00002432-00000C15-3633715750 [PID: 2432] "rundll32.exe" queried SystemProcessInformation at 00000000-00003540-00000C15-3634347434 [PID: 3540] "rundll32.exe" queried SystemProcessInformation at 00000000-00003540-00000C15-3634353882 [PID: 3540] "rundll32.exe" queried SystemProcessInformation at 00000000-00003540-00000C15-3634711025 [PID: 3540] "rundll32.exe" queried SystemProcessInformation at 00000000-00003540-00000C15-3634717367 [PID: 3540] "rundll32.exe" queried SystemProcessInformation at 00000000-00005504-00000C15-3635361343 [PID: 5504] "rundll32.exe" queried SystemProcessInformation at 00000000-00005504-00000C15-3635367692 [PID: 5504] "rundll32.exe" queried SystemProcessInformation at 00000000-00005504-00000C15-3635636828 [PID: 5504] "rundll32.exe" queried SystemProcessInformation at 00000000-00005504-00000C15-3635643190 [PID: 5504] "rundll32.exe" queried SystemProcessInformation at 00000000-00005504-00000C15-3635811868 [PID: 5504] "rundll32.exe" queried SystemProcessInformation at 00000000-00005504-00000C15-3635818322 [PID: 5504] "rundll32.exe" queried SystemProcessInformation at 00000000-00005044-00000C15-3690380167 [PID: 5044] "rundll32.exe" queried SystemProcessInformation at 00000000-00005044-00000C15-3690398208 [PID: 5044] "rundll32.exe" queried SystemProcessInformation at 00000000-00005044-00000C15-3691309082 [PID: 5044]2e:T74c,Found api reference "CertNameToStrW" (Indicator: "CertNameToStrW"; Source: "00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp") Found api reference "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; Source: "00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp") Found api reference "CertDuplicateCertificateContext" (Indicator: "CertDuplicateCertificateContext"; Source: "00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp") Found api reference "CertCloseStore" (Indicator: "CertCloseStore"; Source: "00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp") Found api reference "CertOpenSystemStoreW" (Indicator: "CertOpenSystemStoreW"; Source: "00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp") Found api reference "CertFindChainInStore" (Indicator: "CertFindChainInStore"; Source: "00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp") Found api reference "CertFindCertificateInStore" (Indicator: "CertFindCertificateInStore"; Source: "00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp")2f:Tbfb,Found XOR loop in file "htpd.dat" at offset 5152; code bytes = 30d0 Found XOR loop in file "htpd.dat" at offset 76538; code bytes = 30d0 Found XOR loop in file "htpd.dat" at offset 77149; code bytes = 30d0 Found XOR loop in file "htpd.dat" at offset 90939; code bytes = 30d0 Found XOR loop in file "htpd.dat" at offset 93065; code bytes = 30d0 Found XOR loop in file "htpd.dat" at offset 96553; code bytes = 30d0 Found XOR loop in file "htpd.dat" at offset 122059; code bytes = 30d0 Found XOR loop in file "htpd.dat" at offset 148097; code bytes = 30d0 Found XOR loop in file "htpd.dat" at offset 178288; code bytes = 30d0 Found XOR loop in file "htpd.dat" at offset 204798; code bytes = 30d0 Found XOR loop in file "htpd.dat" at offset 345973; code bytes = 30d0 Found XOR loop in file "htpd.dat" at offset 47176; code bytes = 33c1 Found XOR loop in file "htpd.dat" at offset 55270; code bytes = 33c1 Found XOR loop in file "htpd.dat" at offset 89473; code bytes = 33c1 Found XOR loop in file "htpd.dat" at offset 89520; code bytes = 33c1 Found XOR loop in file "htpd.dat" at offset 115692; code bytes = 33c1 Found XOR loop in file "htpd.dat" at offset 145830; code bytes = 33c1 Found XOR loop in file "htpd.dat" at offset 167102; code bytes = 33c1 Found XOR loop in file "htpd.dat" at offset 281623; code bytes = 33c1 Found XOR loop in file "htpd.dat" at offset 307820; code bytes = 33c1 Found XOR loop in file "htpd.dat" at offset 343116; code bytes = 33c1 Found XOR loop in file "htpd.dat" at offset 37499; code bytes = 8030 Found XOR loop in file "htpd.dat" at offset 113115; code bytes = 8030 Found XOR loop in file "htpd.dat" at offset 127752; code bytes = 8030 Found XOR loop in file "htpd.dat" at offset 328057; code bytes = 8030 Found XOR loop in file "htpd.dat" at offset 351996; code bytes = 8030 Found XOR loop in file "htpd.dat" at offset 357623; code bytes = 8030 Found XOR loop in file "htpd.dat" at offset 379748; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 183859; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 319272; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 379460; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 394468; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 81570; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 114048; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 117534; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 137734; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 188442; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 254165; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 272132; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 45332; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 280283; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 311281; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 426964; code bytes = 803030:T41f,Found string "GetCommandLineA" (Indicator: "GetCommandLine"; File: "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00005504-00000C2C-3635917641") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00003332.00000000.298704.8F813000.00000002.mdmp, 00000000-00003332.00000000.298704.D672D000.00000002.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00003332.00000000.298704.8F813000.00000002.mdmp, 00000000-00003332.00000000.298704.D672D000.00000002.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00003540.00000000.298973.45B09000.00000002.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00005504.00000000.299031.002FA000.00000002.mdmp, 00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp")31:T434,Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00003332.00000000.298704.D672D000.00000002.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00003332.00000000.298704.D672D000.00000002.mdmp") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; Source: "00000000-00003332.00000000.298704.D672D000.00000002.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00003332.00000000.298704.D672D000.00000002.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp")32:T4d8,Found reference to API "GetDiskFreeSpaceA" (Indicator: "GetDiskFreeSpace"; File: "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4") Found reference to API "GetDiskFreeSpaceExA" (Indicator: "GetDiskFreeSpace"; File: "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4") Found reference to API "GetDiskFreeSpaceExA" (Indicator: "GetDiskFreeSpaceEx"; File: "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpaceEx"; Source: "00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp") Found reference to API "GetDiskFreeSpaceW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp")33:T56b,Found system information discovery API: "ExpandEnvironmentStringsA" in file "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4" Found system information discovery API: "RtlNtStatusToDosError" in "00000000-00003332.00000000.298704.8F813000.00000002.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00003332.00000000.298704.8F813000.00000002.mdmp" Found system information discovery API: "NtQuerySystemInformation" in "00000000-00003540.00000000.298973.45B09000.00000002.mdmp" Found system information discovery API: "RtlNtStatusToDosError" in "00000000-00003540.00000000.298973.45B09000.00000002.mdmp" Found system information discovery API: "NtQuerySystemInformation" in "00000000-00005504.00000000.299031.002FA000.00000002.mdmp" Found system information discovery API: "RtlNtStatusToDosError" in "00000000-00005504.00000000.299031.002FA000.00000002.mdmp" Found system information discovery API: "GetNativeSystemInfo" in "00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp" Found system information discovery API: "GetSystemInfo" in "00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp"34:T40f,Found reference to API "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; File: "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4") Found reference to API "GetSystemDefaultUILanguage" (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00003332.00000000.298704.D672D000.00000002.mdmp") Found reference to API "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00003332.00000000.298704.D672D000.00000002.mdmp") Found reference to API "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp") Found reference to API "GetSystemDefaultUILanguage" (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp")35:T27a3,"c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000d4f2190068208b7702000000000000007407d8b6109a65730000000014f31900201b9077ffffffff24f3190058108b773c108b778406d8b6109a6573d4456573d845657304f3190000f319000d0000000d00000090036773dc546973000000006cac6673d858697398f31900608d8e77e8e056c1feffffff30f31900900f8b779003677340f3190084d46673dc546973900367734cf31900a4d466739003677368f319001a9a657390036773528b8a77010000000100000017d46673a8f3190086ca6673000000004aca66736a527938010000000100000000000000000000000000000078f319003dba19f4e8f31900f0cc66737a8d094bfeffffff (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d0000004900140000000000000000004c00040849007b23718f65517bf50000040030dfe388b0e51900b0e8de77fd998a82feffffffc0e5190008744c0000001b7730fa0674d447db77c547db77d5517bf50000000080c3077485f6c441b4e5190044e81900b0ac1b74fffffffff4e5190072fa067444e819007ccef87372fa06740100000000000000020000007ccef87328e619000000000080c3077480fa06740000000050e819007c0b307710aa3c77f1f6c441 (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d0000001900a0187f7350fa234bfeffffff2ce21900de667d73c0e11900dce1ba38ffffffff0000000047677d7301000000000000000000000000000000000000000000000000000000000000000100000000000000ffffffffd5f2c44104e2190050e51900b0ac1b74ffffffff44e2190072fa0674b1cadb777ccef87372fa06740100000000000000020000007ccef87370e21900ace819009c22500080fa067484e2190040000000d00749000000000001f1c441 (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d58000002000000000000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d0000000000200000001e00050020000000d00749000000490053bfdb77000000002000000050564c000000000000000000000000000200000020000000c8014900000000000400000000004900120000000000000000004c0095f7c441c4e4190058e51900b0ac1b74ffffffff00e5190072fa0674120000007ccef87372fa06740100000000000000020000007ccef8732ce51900143a50000000000080fa067410000000fcffffff0000000000e51900 (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d0000004900140000000800140000004c0004084900000000000008490068d91900febadb7708001400000000000800000005000000b4d91900f0bd2d7700004c000800140014000000ec6c41dc008000000a000000050000008dcac441acd919003cdc1900b0ac1b74ffffffffecd9190072fa0674e0d919007ccef87372fa06740100000000000000020000007ccef87320da19000000000080c3077480fa0674506e5000b4e01900b6e0190058b558dcf9cac441 (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d0000000001fc1d0000f8c5510000000000000000009cd61900b0e8de778d9b8a82feffffff04d619006dfcdf770000000094fcdf77e8c5500000004c00e8c55000000000000000000000000000000000001800000008d6ba38ddc6c441fcd5190048d91900b0ac1b74ffffffff3cd6190072fa06745cd619007ccef87372fa06740100000000000000020000007ccef87368d61900a4dc19005cc4500080fa067438d6190000857f7300004c000000000009c5c441 (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d58000002000000000000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d0000000000200000000c00270020000000d00749000000490053bfdb77000000002000000030ef4e000000000000000000000000000200000020000000c8014900000000000400000000004900120000000000000000004c009dcbc441bcd8190050d91900b0ac1b74fffffffff8d8190072fa0674120000007ccef87372fa06740100000000000000020000007ccef87324d9190064c750000000000080fa067410000000fcffffff00000000f8d81900 (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d0000004900140000000800140000004c0004084900000000000008490068d91900febadb7708001400000000000800000005000000b4d91900f0bd2d7700004c000800140014000000ec6c41dc008000000a000000050000008dcac441acd919003cdc1900b0ac1b74ffffffffecd9190072fa0674e0d919007ccef87372fa06740100000000000000020000007ccef87320da19000000000080c3077480fa0674906e5000b4e01900b6e0190058b558dcf9cac441 (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d58000002000000000000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d0000000000200000000c00260020000000d00749000000490053bfdb77000000002000000030ef4e000000000000000000000000000200000020000000c8014900000000000400000000004900120000000000000000004c009dcbc441bcd8190050d91900b0ac1b74fffffffff8d8190072fa0674120000007ccef87372fa06740100000000000000020000007ccef87324d9190064c750000000000080fa067410000000fcffffff00000000f8d81900 (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "RtlGetVersion" with parameter 000000000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003720) "wscript.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003332) "wscript.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003332) "wscript.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000c938719cf97f000080000000000000000000000000000000b0ba35c7d401000010332c9ff97f000000000000000000000000559df97f0000f0bb91141100000010416e9cf97f0000609835c7d4010000b0bb911411000000000000000000000000000000000000000100000000000000b8406e9cf97f0000000000000000000001000000000000000000559df97f00003b4dc89cf97f00000000000000000000a8c09114110000000000000000000000d02a679df97f000010b3cd9df97f0000e8f86d9cf97f000010b3cd9df97f0000d02a679df97f00000d000000f97f00000d00000000000000a0f6bd9df97f0000f587629df97f0000d02a679d (UID: 00000000-00003332)36:T8c8,"wscript.exe" called "GetVersionExA" with parameter 940000000a000000000000005d58000002000000000000000000000000000000180000000000000021627ba4ff2300004bc3d3c92e5300000600000000000000000071d6f77f0000a402ee94f97f000006000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000071d6 (UID: 00000000-00003332) "wscript.exe" called "GetVersionExA" with parameter 940000000a000000000000005d5800000200000000000000000053c7d401000000100000000000008e53e19df97f000080ed9114110000007e85ca9cf97f0000020000000000000000000000000000004400000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000000000000000000033b272d6f77f000010ed9114 (UID: 00000000-00003332) "wscript.exe" called "GetVersionExA" with parameter 940000000a000000000000005d58000002000000007f00000000000000000000a0e532c7d4010000c0fb3278f97f00000001000000000000b8fb3278f97f0000000000000000000080cb349ef97f000000000000000000000001000000000000000000000000000000000000000000000100000000000000df1a3278f97f00000000000000000000b8fb3278f97f000000000000 (UID: 00000000-00003332) "wscript.exe" called "GetVersionExA" with parameter 940000000a000000000000005d58000002000000007f0000863ced76f97f0000104ced76f97f000040b3ef76f97f0000104ced76f97f000040b3ef76f97f000020b3ef76f97f00009d3ced76f97f00006026f076f97f0000d0ba55c7d4010000e0ba55c7d40100000000089ff97f00000100000000000000bddb369ef97f0000000000000000000038b3ef76f97f000000000000 (UID: 00000000-00003332) "wscript.exe" called "GetVersionExA" with parameter 940000000a000000000000005d58000002000000007f0000ba485e75f97f000060555e75f97f0000b0676075f97f000060555e75f97f0000b0676075f97f000090676075f97f0000d1485e75f97f000000000000000000004461cc9cf97f0000a8b055c7d40100000000299ff97f00000100000000000000bddb369ef97f00000100000000000000743b5e75f97f000050a335c7 (UID: 00000000-00003332) "wscript.exe" called "GetVersionExA" with parameter 940000000a000000000000005d58000002000000007f00000000000000000000a0df32c7d401000018376375f97f0000000100000000000010376375f97f0000000000000000000080cb349ef97f000000000000000000000001000000000000fef1d38bb5fa000000005e75f97f000001000000000000003f116275f97f0000000000000000000010376375f97f000000000000 (UID: 00000000-00003332)37:T583,Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00003332.00000000.298704.8F813000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00003332.00000000.298704.8F813000.00000002.mdmp, 00000000-00003332.00000000.298704.D672D000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00003540.00000000.298973.45B09000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00005504.00000000.299031.002FA000.00000002.mdmp") Found reference to API "GetSystemTimes" (Indicator: "GetSystemTime"; Source: "00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp") Found reference to API "GetLocalTimeType" (Indicator: "GetLocalTime"; Source: "00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp")38:T820,"c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "rundll32.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "rundll32.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED")39:T583,Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00003332.00000000.298704.8F813000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00003332.00000000.298704.8F813000.00000002.mdmp, 00000000-00003332.00000000.298704.D672D000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00003540.00000000.298973.45B09000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00005504.00000000.299031.002FA000.00000002.mdmp") Found reference to API "GetSystemTimes" (Indicator: "GetSystemTime"; Source: "00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp") Found reference to API "GetLocalTimeType" (Indicator: "GetLocalTime"; Source: "00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp")3a:T921,Found reference to API "GetVersion" (Indicator: "GetVersion"; File: "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00003332.00000000.298704.8F813000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00003332.00000000.298704.D672D000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00003332.00000000.298704.D672D000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00003332.00000000.298704.D672D000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00003332.00000000.298704.D672D000.00000002.mdmp") Found reference to API "1861153974,3152,3024,,RtlGetVersion,NTDLL.dll,"01:17:47.359",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00003540.00000001.300893.1B7D0000.00000004.mdmp, 00000000-00003540.00000002.302812.1B7D0000.00000004.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp")3b:T483,Found registry modification API: "RegCreateKeyExA" in file "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4" Found registry modification API: "RegCreateKeyA" in "00000000-00003332.00000000.298704.D672D000.00000002.mdmp" Found registry modification API: "RegCreateKeyExW" in "00000000-00003332.00000000.298704.D672D000.00000002.mdmp" Found registry modification API: "RegCreateKeyExA" in "00000000-00003332.00000000.298704.D672D000.00000002.mdmp" Found registry modification API: "RegConnectRegistryW" in "00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp" Found registry modification API: "RegLoadKeyW" in "00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp" Found registry modification API: "RegCreateKeyExW" in "00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp"3c:T440,"c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "CreateDirectoryA" with parameter %TEMP%\ (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "CreateDirectoryA" with parameter C:\Users (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "CreateDirectoryA" with parameter C:\Users\%OSUSER% (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "CreateDirectoryA" with parameter %USERPROFILE%\AppData (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "CreateDirectoryA" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "CreateDirectoryA" with parameter %LOCALAPPDATA%\Temp (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "CreateDirectoryA" with parameter %TEMP%\nsh239D.tmp (UID: 00000000-00003720)3d:T1c32,"c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\UXTHEME.dll (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\USERENV.dll (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SETUPAPI.dll (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\APPHELP.dll (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\PROPSYS.dll (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\DWMAPI.dll (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CRYPTBASE.dll (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\OLEACC.dll (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CLBCATQ.dll (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\VERSION.dll (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SHFOLDER.dll (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "LoadLibrary" with a parameter %TEMP%\nsh239D.tmp\System.dll (UID: 00000000-00003720) "wscript.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003332) "wscript.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003332) "wscript.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003332) "wscript.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003332) "wscript.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003332) "wscript.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00003332) "wscript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00003332) "wscript.exe" called "LoadLibrary" with a parameter WLDP.DLL (UID: 00000000-00003332) "wscript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00003332) "wscript.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MPCLIENT.DLL (UID: 00000000-00003332) "wscript.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MsMpLics.dll (UID: 00000000-00003332) "wscript.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003332) "wscript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00003332) "wscript.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00003332) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002432) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002432) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002432) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002432) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003540) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003540) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003540) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003540) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005504) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005504) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005504) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005504) "rundll32.exe" called "LoadLibrary" with a parameter KERNEL32.DLL (UID: 00000000-00005504) "rundll32.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005504) "rundll32.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00005504) "rundll32.exe" called "LoadLibrary" with a parameter netapi32.dll (UID: 00000000-00005504) "rundll32.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005504) "rundll32.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00005504) "rundll32.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005504) "rundll32.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00005504) "rundll32.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00005504) "rundll32.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00005504) "rundll32.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005504) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005044) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005044) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005044) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005044) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005332) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005332) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005332) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005332)3e:Teefd,"c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "GetProcAddress" with a parameter GetFileVersionInfoA (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "GetProcAddress" with a parameter SHGetFolderPathA (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "GetProcAddress" with a parameter Call (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "GetProcAddress" with a parameter Wow64EnableWow64FsRedirection (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00003720) "wscript.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003332) "wscript.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003332) "wscript.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003332) "wscript.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003332) "wscript.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003332) "wscript.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003332) "wscript.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003332) "wscript.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003332) "wscript.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003332) "wscript.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003332) "wscript.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003332) "wscript.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003332) "wscript.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003332) "wscript.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003332) "wscript.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003332) "wscript.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003332) "wscript.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003332) "wscript.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003332) "wscript.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003332) "wscript.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003332) "wscript.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003332) "wscript.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003332) "wscript.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003332) "wscript.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003332) "wscript.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003332) "wscript.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003332) "wscript.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003332) "wscript.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003332) "wscript.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003332) "wscript.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003332) "wscript.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003332) "wscript.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003332) "wscript.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003332) "wscript.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003332) "wscript.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003332) "wscript.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003332) "wscript.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003332) "wscript.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003332) "wscript.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003332) "wscript.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003332) "wscript.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003332) "wscript.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003332) "wscript.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003332) "wscript.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00003332) "wscript.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003332) "wscript.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00003332) "wscript.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00003332) "wscript.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00003332) "wscript.exe" called "GetProcAddress" with a parameter RtlRegisterFeatureConfigurationChangeNotification (UID: 00000000-00003332) "wscript.exe" called "GetProcAddress" with a parameter RtlDisownModuleHeapAllocation (UID: 00000000-00003332) "wscript.exe" called "GetProcAddress" with a parameter RtlQueryFeatureConfiguration (UID: 00000000-00003332) "wscript.exe" called "GetProcAddress" with a parameter RtlDllShutdownInProgress (UID: 00000000-00003332) "wscript.exe" called "GetProcAddress" with a parameter LogStagedFeatureUsage (UID: 00000000-00003332) "wscript.exe" called "GetProcAddress" with a parameter QueryProtectedPolicy (UID: 00000000-00003332) "wscript.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00003332) "wscript.exe" called "GetProcAddress" with a parameter AmsiScanString (UID: 00000000-00003332) "wscript.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00003332) "wscript.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00003332) "wscript.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00003332) "wscript.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00003332) "wscript.exe" called "GetProcAddress" with a parameter WldpIsClassInApprovedList (UID: 00000000-00003332) "wscript.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00003332) "wscript.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00003332) "wscript.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00003332) "wscript.exe" called "GetProcAddress" with a parameter MpManagerOpen (UID: 00000000-00003332) "wscript.exe" called "GetProcAddress" with a parameter MpHandleClose (UID: 00000000-00003332) "wscript.exe" called "GetProcAddress" with a parameter MpFreeMemory (UID: 00000000-00003332) "wscript.exe" called "GetProcAddress" with a parameter MpScanStart (UID: 00000000-00003332) "wscript.exe" called "GetProcAddress" with a parameter MpMemoryScanStart (UID: 00000000-00003332) "wscript.exe" called "GetProcAddress" with a parameter MpScanResult (UID: 00000000-00003332) "wscript.exe" called "GetProcAddress" with a parameter MpThreatOpen (UID: 00000000-00003332) "wscript.exe" called "GetProcAddress" with a parameter MpThreatEnumerate (UID: 00000000-00003332) "wscript.exe" called "GetProcAddress" with a parameter MpConfigOpen (UID: 00000000-00003332) "wscript.exe" called "GetProcAddress" with a parameter MpConfigGetValue (UID: 00000000-00003332) "wscript.exe" called "GetProcAddress" with a parameter MpConfigGetValueAlloc (UID: 00000000-00003332) "wscript.exe" called "GetProcAddress" with a parameter MpConfigClose (UID: 00000000-00003332) "wscript.exe" called "GetProcAddress" with a parameter MpFastMemoryScanOpen (UID: 00000000-00003332) "wscript.exe" called "GetProcAddress" with a parameter MpFastMemoryScan (UID: 00000000-00003332) "wscript.exe" called "GetProcAddress" with a parameter MpAmsiScan (UID: 00000000-00003332) "wscript.exe" called "GetProcAddress" with a parameter MpAmsiNotify (UID: 00000000-00003332) "wscript.exe" called "GetProcAddress" with a parameter MpAmsiCloseSession (UID: 00000000-00003332) "wscript.exe" called "GetProcAddress" with a parameter MpConfigRegisterForNotifications (UID: 00000000-00003332) "wscript.exe" called "GetProcAddress" with a parameter MpConfigUnregisterNotifications (UID: 00000000-00003332) "wscript.exe" called "GetProcAddress" with a parameter MpClientUtilExportFunctions (UID: 00000000-00003332) "wscript.exe" called "GetProcAddress" with a parameter MpManagerVersionQuery (UID: 00000000-00003332) "wscript.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00003332) "wscript.exe" called "GetProcAddress" with a parameter IsWow64Process2 (UID: 00000000-00003332) "wscript.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00003332) "wscript.exe" called "GetProcAddress" with a parameter ShellExecuteExW (UID: 00000000-00003332) "wscript.exe" called "GetProcAddress" with a parameter AmsiUninitialize (UID: 00000000-00003332) "wscript.exe" called "GetProcAddress" with a parameter NtQueryWnfStateData (UID: 00000000-00003332) "cmd.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002432) "cmd.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002432) "cmd.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002432) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002432) "cmd.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002432) "cmd.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002432) "cmd.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00002432) "cmd.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00002432) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00002432) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00002432) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00002432) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00002432) "cmd.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00002432) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00002432) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00002432) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00002432) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00002432) "cmd.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00002432) "cmd.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00002432) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00002432) "cmd.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00002432) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00002432) "cmd.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00002432) "cmd.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00002432) "cmd.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00002432) "cmd.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00002432) "cmd.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002432) "cmd.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00002432) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002432) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002432) "cmd.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00002432) "cmd.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002432) "cmd.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00002432) "cmd.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002432) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00002432) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00002432) "cmd.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00002432) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00002432) "cmd.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00002432) "cmd.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002432) "cmd.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002432) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002432) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002432) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00002432) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00002432) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00002432) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00002432) "rundll32.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003540) "rundll32.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003540) "rundll32.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003540) "rundll32.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003540) "rundll32.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003540) "rundll32.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003540) "rundll32.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003540) "rundll32.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003540) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003540) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003540) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003540) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003540) "rundll32.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003540) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003540) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003540) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003540) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003540) "rundll32.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003540) "rundll32.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003540) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003540) "rundll32.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003540) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003540) "rundll32.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003540) "rundll32.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003540) "rundll32.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003540) "rundll32.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003540) "rundll32.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003540) "rundll32.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003540) "rundll32.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003540) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003540) "rundll32.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003540) "rundll32.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003540) "rundll32.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003540) "rundll32.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003540) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003540) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003540) "rundll32.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003540) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003540) "rundll32.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003540) "rundll32.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003540) "rundll32.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003540) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003540) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003540) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00003540) "rundll32.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003540) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00003540) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00003540) "rundll32.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter TlsAlloc (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter TerminateThread (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter IsDebuggerPresent (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter VirtualFree (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter HeapAlloc (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter GetCPInfoExW (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter RtlUnwind (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter GetCPInfo (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter EnumSystemLocalesW (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter HeapDestroy (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter CreateProcessW (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter HeapSize (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter SetLastError (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter CreateThread (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter CompareStringW (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter CreateMutexW (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter ResetEvent (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter GetVersion (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter SwitchToThread (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter GetExitCodeThread (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter OutputDebugStringW (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter FileTimeToSystemTime (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter UnhandledExceptionFilter (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter VirtualQuery (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter VirtualQueryEx (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter GlobalFree (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter EnterCriticalSection (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter SuspendThread (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter GetTickCount (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter GetStartupInfoW (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter InitializeCriticalSection (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter GetThreadPriority (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadPriority (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter GetCommandLineW (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter LeaveCriticalSection (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter GetVersionExW (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter VerifyVersionInfoW (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter HeapCreate (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter LCMapStringW (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter VerSetConditionMask (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter GetDiskFreeSpaceW (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter TlsFree (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter lstrlenW (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter SetEndOfFile (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter HeapFree (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter MultiByteToWideChar (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter GetLocaleInfoW (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter GetLocalTime (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter ExitThread (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter DeleteCriticalSection (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter CreatePipe (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter TlsGetValue (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter GetDateFormatW (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter IsValidLocale (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter TlsSetValue (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter GetSystemDefaultUILanguage (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter EnumCalendarInfoW (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadLocale (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter GetThreadLocale (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter RegConnectRegistryW (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter RegLoadKeyW (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter RegDeleteKeyW (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter RegUnLoadKeyW (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter RegSaveKeyW (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter RegDeleteValueW (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter RegReplaceKeyW (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter RegFlushKey (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter RegRestoreKeyW (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter memcpy (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter NetWkstaGetInfo (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter NetApiBufferFree (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter CoInitialize (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter SysFreeString (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter VariantClear (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter VariantInit (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter GetErrorInfo (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter SysReAllocStringLen (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter SafeArrayCreate (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter SysAllocStringLen (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter SafeArrayPtrOfIndex (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter SafeArrayGetUBound (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter SafeArrayGetLBound (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter VariantCopy (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter VariantChangeType (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter ShellExecuteW (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter CharUpperBuffW (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter CharNextW (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter MsgWaitForMultipleObjects (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter CharLowerBuffW (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter CharUpperW (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter PeekMessageW (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter MessageBoxW (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter WinHttpGetIEProxyConfigForCurrentUser (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter WinHttpSetTimeouts (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter WinHttpConnect (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter WinHttpReceiveResponse (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter WinHttpQueryAuthSchemes (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter WinHttpGetProxyForUrl (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter WinHttpReadData (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter WinHttpCloseHandle (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter WinHttpQueryHeaders (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter WinHttpOpenRequest (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter WinHttpAddRequestHeaders (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter WinHttpOpen (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter WinHttpWriteData (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter WinHttpSetCredentials (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter WinHttpQueryDataAvailable (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter WinHttpSetOption (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter WinHttpSendRequest (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter WinHttpQueryOption (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter GetThreadUILanguage (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter GetDiskFreeSpaceExW (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter GetLogicalProcessorInformation (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter VariantChangeTypeEx (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter VarNeg (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter VarNot (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter VarAdd (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter VarSub (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter VarMul (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter VarDiv (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter VarIdiv (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter VarMod (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter VarAnd (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter VarOr (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter VarXor (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter VarCmp (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter VarI4FromStr (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter VarR4FromStr (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter VarR8FromStr (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter VarDateFromStr (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter VarCyFromStr (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter VarBoolFromStr (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter VarBstrFromCy (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter VarBstrFromDate (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter VarBstrFromBool (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter CoAddRefServerProcess (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter CoReleaseServerProcess (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter CoResumeClassObjects (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter CoSuspendClassObjects (UID: 00000000-00005504) "rundll32.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005044) "rundll32.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005044) "rundll32.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005044) "rundll32.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005044) "rundll32.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005044) "rundll32.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005044) "rundll32.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005044) "rundll32.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005044) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005044) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005044) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005044) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005044) "rundll32.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005044) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005044) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005044) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005044) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005044) "rundll32.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005044) "rundll32.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005044) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005044) "rundll32.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005044) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005044) "rundll32.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005044) "rundll32.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005044) "rundll32.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005044) "rundll32.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005044) "rundll32.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005044) "rundll32.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005044) "rundll32.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005044) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005044) "rundll32.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005044) "rundll32.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005044) "rundll32.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005044) "rundll32.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005044) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005044) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005044) "rundll32.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005044) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005044) "rundll32.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005044) "rundll32.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005044) "rundll32.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005044) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005044) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005044) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005044) "rundll32.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005044) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00005044) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00005044) "rundll32.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005332) "rundll32.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005332) "rundll32.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005332) "rundll32.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005332) "rundll32.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005332) "rundll32.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005332) "rundll32.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005332) "rundll32.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005332) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005332) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005332) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005332) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005332) "rundll32.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005332) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005332) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005332) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005332) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005332) "rundll32.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005332) "rundll32.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005332) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005332) "rundll32.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005332) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005332) "rundll32.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005332) "rundll32.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005332) "rundll32.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005332) "rundll32.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005332) "rundll32.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005332) "rundll32.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005332) "rundll32.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005332) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005332) "rundll32.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005332) "rundll32.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005332) "rundll32.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005332) "rundll32.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005332) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005332) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005332) "rundll32.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005332) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005332) "rundll32.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005332) "rundll32.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005332) "rundll32.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005332) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005332) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005332) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005332) "rundll32.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005332) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00005332) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00005332)3f:T453,Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; File: "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; Source: "00000000-00003540.00000000.298973.45B09000.00000002.mdmp") Found reference to API "1863280390,3152,3143,,CreateProcessW,kernel32.dll,"01:17:47.359",RX=0,PX=0" (Indicator: "CreateProcess"; Source: "00000000-00003540.00000001.300893.1B7D0000.00000004.mdmp, 00000000-00003540.00000002.302812.1B7D0000.00000004.mdmp") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; Source: "00000000-00005504.00000000.299031.002FA000.00000002.mdmp, 00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00005504.00000000.299031.026F0000.00000004.mdmp, 00000000-00005504.00000001.300951.026F0000.00000004.mdmp, 00000000-00005504.00000002.302872.026F0000.00000004.mdmp")40:T520,Found reference to API "CreateFileA" (Indicator: "CreateFile"; File: "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00003332.00000000.298704.8F813000.00000002.mdmp, 00000000-00003332.00000000.298704.D672D000.00000002.mdmp") Found reference to API "CreateFileMoniker" (Indicator: "CreateFile"; Source: "00000000-00003332.00000000.298704.D672D000.00000002.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00003332.00000000.298704.D672D000.00000002.mdmp") Found reference to API "CreateFileMappingA" (Indicator: "CreateFile"; Source: "00000000-00003332.00000000.298704.D672D000.00000002.mdmp") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00003332.00000000.298704.D672D000.00000002.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00003540.00000000.298973.45B09000.00000002.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00005504.00000000.299031.002FA000.00000002.mdmp, 00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp")41:T495,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00003332.00000000.298704.D672D000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00003332.00000000.298704.D672D000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp")42:T5dc,Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4") file/memory contains long string with (Indicator: "GetLastError"; File: "System.dll") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00003332.00000000.298704.8F813000.00000002.mdmp, 00000000-00003332.00000000.298704.D672D000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00003332.00000000.298704.8F813000.00000002.mdmp, 00000000-00003332.00000000.298704.D672D000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00003540.00000000.298973.45B09000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00003540.00000000.298973.45B09000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00005504.00000000.299031.002FA000.00000002.mdmp, 00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00005504.00000000.299031.002FA000.00000002.mdmp, 00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp")43:T127b,"Software\Microsoft\Windows\CurrentVersion" in Source: c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4 "Software\Microsoft\Windows Defender\Features" in Source: 00000000-00003332.00000000.298704.8F813000.00000002.mdmp "Software\Microsoft\Windows Defender\MpEngine" in Source: 00000000-00003332.00000000.298704.8F813000.00000002.mdmp "Software\Microsoft\Microsoft Antimalware\MpEngine" in Source: 00000000-00003332.00000000.298704.8F813000.00000002.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{5E5F29CE-E0A8-49D3-AF32-7A7BDC173," in Source: 00000000-00003332.00000000.298704.C7399000.00000004.mdmp "e\Software\C" in Source: 00000000-00003332.00000000.298704.C7399000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\WindowsRuntime" in Source: 00000000-00003332.00000000.298704.C7399000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}" in Source: 00000000-00003332.00000000.298704.C7399000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}" in Source: 00000000-00003332.00000000.298704.C7399000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" in Source: 00000000-00003332.00000000.298704.C7399000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{660B90C8-73A9-4B58-8CAE-355B7F55341B}" in Source: 00000000-00003332.00000000.298704.C7399000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{657A8842-0B5E-40E1-B8CB-9AAFACC33AAB}" in Source: 00000000-00003332.00000000.298704.C7399000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00003332.00000000.298704.C7399000.00000004.mdmp 00000000-00003332.00000000.298704.D672D000.00000002.mdmp "achine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00003332.00000000.298704.C7399000.00000004.mdmp "Software\Classes\WOW6432Node\CLSID\{00000323-0000-000p?" in Source: 00000000-00003332.00000000.298704.C7399000.00000004.mdmp "SOFTWARE\Microsoft\Windows Script\Settings\Telemetry\wscript.exe" in Source: 00000000-00003332.00000000.298704.C7550000.00000004.mdmp "Software\Microsoft\Windows Script Host\Settings" in Source: 00000000-00003332.00000000.298704.D672D000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00003332.00000000.298704.D672D000.00000002.mdmp "SOFTWARE\Classes\%s\%s" in Source: 00000000-00003332.00000000.298704.D672D000.00000002.mdmp "Registry\Machine\OSDATA\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00003540.00000001.300893.1B7D0000.00000004.mdmp 00000000-00003540.00000002.302812.1B7D0000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\SdbUpdates" in Source: 00000000-00003540.00000001.300893.1B7D0000.00000004.mdmp 00000000-00003540.00000002.302812.1B7D0000.00000004.mdmp "AL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection" in Source: 00000000-00005044.00000000.302550.97C80000.00000004.mdmp "\Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0" in Source: 00000000-00005044.00000000.302550.97C80000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\OneSettings" in Source: 00000000-00005044.00000000.302550.97F50000.00000004.mdmp "AL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection" in Source: 00000000-00005332.00000000.307756.017F0000.00000004.mdmp "\Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0" in Source: 00000000-00005332.00000000.307756.017F0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\OneSettings" in Source: 00000000-00005332.00000000.307756.01970000.00000004.mdmp "Software\Embarcadero\Locales" in Source: 00000000-00005504.00000000.299031.044D1000.00000040.mdmp 00000000-00005504.00000001.300951.044D1000.00000040.mdmp 00000000-00005504.00000002.302872.044D1000.00000040.mdmp "Software\CodeGear\Locales" in Source: 00000000-00005504.00000000.299031.044D1000.00000040.mdmp 00000000-00005504.00000001.300951.044D1000.00000040.mdmp 00000000-00005504.00000002.302872.044D1000.00000040.mdmp "Software\Borland\Locales" in Source: 00000000-00005504.00000000.299031.044D1000.00000040.mdmp 00000000-00005504.00000001.300951.044D1000.00000040.mdmp 00000000-00005504.00000002.302872.044D1000.00000040.mdmp "Software\Borland\Delphi\Locales" in Source: 00000000-00005504.00000000.299031.044D1000.00000040.mdmp 00000000-00005504.00000001.300951.044D1000.00000040.mdmp 00000000-00005504.00000002.302872.044D1000.00000040.mdmp44:T1450,"Software\Microsoft\Windows Defender\Features" in Source: 00000000-00003332.00000000.298704.8F813000.00000002.mdmp "Software\Microsoft\Windows Defender\MpEngine" in Source: 00000000-00003332.00000000.298704.8F813000.00000002.mdmp "Software\Microsoft\Microsoft Antimalware\MpEngine" in Source: 00000000-00003332.00000000.298704.8F813000.00000002.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{5E5F29CE-E0A8-49D3-AF32-7A7BDC173," in Source: 00000000-00003332.00000000.298704.C7399000.00000004.mdmp "e\Software\C" in Source: 00000000-00003332.00000000.298704.C7399000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\WindowsRuntime" in Source: 00000000-00003332.00000000.298704.C7399000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}" in Source: 00000000-00003332.00000000.298704.C7399000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}" in Source: 00000000-00003332.00000000.298704.C7399000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" in Source: 00000000-00003332.00000000.298704.C7399000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{660B90C8-73A9-4B58-8CAE-355B7F55341B}" in Source: 00000000-00003332.00000000.298704.C7399000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{657A8842-0B5E-40E1-B8CB-9AAFACC33AAB}" in Source: 00000000-00003332.00000000.298704.C7399000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00003332.00000000.298704.C7399000.00000004.mdmp "achine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00003332.00000000.298704.C7399000.00000004.mdmp "Software\Classes\WOW6432Node\CLSID\{00000323-0000-000p?" in Source: 00000000-00003332.00000000.298704.C7399000.00000004.mdmp "SOFTWARE\Microsoft\Windows Script\Settings\Telemetry\wscript.exe" in Source: 00000000-00003332.00000000.298704.C7550000.00000004.mdmp "SOFTWARE\Classes\%s\%s" in Source: 00000000-00003332.00000000.298704.D672D000.00000002.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00003332.00000000.298704.D672D000.00000002.mdmp "Software\Microsoft\Windows Script Host\Settings" in Source: 00000000-00003332.00000000.298704.D672D000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00003332.00000000.298704.D672D000.00000002.mdmp "Registry\Machine\OSDATA\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00003540.00000001.300893.1B7D0000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\SdbUpdates" in Source: 00000000-00003540.00000001.300893.1B7D0000.00000004.mdmp "Registry\Machine\OSDATA\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00003540.00000002.302812.1B7D0000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\SdbUpdates" in Source: 00000000-00003540.00000002.302812.1B7D0000.00000004.mdmp "AL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection" in Source: 00000000-00005044.00000000.302550.97C80000.00000004.mdmp "\Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0" in Source: 00000000-00005044.00000000.302550.97C80000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\OneSettings" in Source: 00000000-00005044.00000000.302550.97F50000.00000004.mdmp "AL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection" in Source: 00000000-00005332.00000000.307756.017F0000.00000004.mdmp "\Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0" in Source: 00000000-00005332.00000000.307756.017F0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\OneSettings" in Source: 00000000-00005332.00000000.307756.01970000.00000004.mdmp "Software\Embarcadero\Locales" in Source: 00000000-00005504.00000000.299031.044D1000.00000040.mdmp "Software\CodeGear\Locales" in Source: 00000000-00005504.00000000.299031.044D1000.00000040.mdmp "Software\Borland\Locales" in Source: 00000000-00005504.00000000.299031.044D1000.00000040.mdmp "Software\Borland\Delphi\Locales" in Source: 00000000-00005504.00000000.299031.044D1000.00000040.mdmp "Software\Embarcadero\Locales" in Source: 00000000-00005504.00000001.300951.044D1000.00000040.mdmp "Software\CodeGear\Locales" in Source: 00000000-00005504.00000001.300951.044D1000.00000040.mdmp "Software\Borland\Locales" in Source: 00000000-00005504.00000001.300951.044D1000.00000040.mdmp "Software\Borland\Delphi\Locales" in Source: 00000000-00005504.00000001.300951.044D1000.00000040.mdmp "Software\Embarcadero\Locales" in Source: 00000000-00005504.00000002.302872.044D1000.00000040.mdmp "Software\CodeGear\Locales" in Source: 00000000-00005504.00000002.302872.044D1000.00000040.mdmp "Software\Borland\Locales" in Source: 00000000-00005504.00000002.302872.044D1000.00000040.mdmp "Software\Borland\Delphi\Locales" in Source: 00000000-00005504.00000002.302872.044D1000.00000040.mdmp45:T23e2,"c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 771b0000 "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 771b0000 "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 771b0000 "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" loaded module "KERNEL32" at base 77020000 "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 736f0000 "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 75270000 "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" loaded module "%WINDIR%\SYSTEM32\USERENV.DLL" at base 752f0000 "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" loaded module "%WINDIR%\SYSTEM32\SETUPAPI.DLL" at base 763f0000 "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" loaded module "NTDLL.DLL" at base 77d70000 "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 751a0000 "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 74820000 "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" loaded module "%WINDIR%\SYSTEM32\DWMAPI.DLL" at base 736c0000 "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTBASE.DLL" at base 736b0000 "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" loaded module "%WINDIR%\SYSTEM32\OLEACC.DLL" at base 73650000 "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" loaded module "%WINDIR%\SYSTEM32\CLBCATQ.DLL" at base 774c0000 "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 75a60000 "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" loaded module "%WINDIR%\SYSTEM32\SHFOLDER.DLL" at base 73640000 "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" loaded module "KERNEL32.DLL" at base 77020000 "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" loaded module "%WINDIR%\SYSWOW64\WINDOWS.STORAGE.DLL" at base 73f30000 "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" loaded module "%TEMP%\NSH239D.TMP\SYSTEM.DLL" at base 73630000 "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" loaded module "KERNELBASE" at base 771b0000 "wscript.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff99cc40000 "wscript.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff99cc40000 "wscript.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff99cc40000 "wscript.exe" loaded module "KERNEL32" at base 7ff99de00000 "wscript.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff975740000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ff999cc0000 "wscript.exe" loaded module "RPCRT4.DLL" at base 7ff99ef60000 "wscript.exe" loaded module "KERNEL32.DLL" at base 7ff99de00000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\VBSCRIPT.DLL" at base 7ff9756a0000 "wscript.exe" loaded module "AMSI.DLL" at base 7ff98f860000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ff991a00000 "wscript.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.18.23090.2008-0\MPOAV.DLL" at base 7ff98f7e0000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\800DF380.DLL" at base 7ff975650000 "wscript.exe" loaded module "WLDP.DLL" at base 7ff99be80000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7ff99d1d0000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ff99b650000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\MSISIP.DLL" at base 7ff97b030000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ff99c7e0000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 7ff978320000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\SCROBJ.DLL" at base 7ff976ed0000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\WSHOM.OCX" at base 7ff975620000 "wscript.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.18.23090.2008-0\MPCLIENT.DLL" at base 7ff96f9f0000 "wscript.exe" loaded module "USER32.DLL" at base 7ff99f080000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7ff99de00000 "wscript.exe" loaded module "SHELL32.DLL" at base 7ff99d550000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 7ff99a690000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 7ff9962d0000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\\WINDOWS.STATEREPOSITORYPS.DLL" at base 7ff9873c0000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 7ff98d4f0000 "wscript.exe" loaded module "SSPICLI.DLL" at base 7ff99b930000 "wscript.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 7ff99cc40000 "wscript.exe" loaded module "VIRTDISK.DLL" at base 7ff98dda0000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\WINTYPES.DLL" at base 7ff99a550000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\APPRESOLVER.DLL" at base 7ff983400000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 7ff995740000 "wscript.exe" loaded module "NTDLL.DLL" at base 7ff99f270000 "wscript.exe" loaded module "KERNELBASE" at base 7ff99cc40000 "cmd.exe" loaded module "KERNEL32" at base 7ff99de00000 "cmd.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ff99cc40000 "cmd.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ff99cc40000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ff99cc40000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7ff99e230000 "cmd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff99cc40000 "cmd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff99cc40000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff99cc40000 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff975740000 "cmd.exe" loaded module "KERNEL32.DLL" at base 7ff99de00000 "cmd.exe" loaded module "NTDLL.DLL" at base 7ff99f270000 "cmd.exe" loaded module "KERNELBASE" at base 7ff99cc40000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7ff99e230000 "rundll32.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff99cc40000 "rundll32.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff99cc40000 "rundll32.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff99cc40000 "rundll32.exe" loaded module "KERNEL32" at base 7ff99de00000 "rundll32.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff975740000 "rundll32.exe" loaded module "NTDLL.DLL" at base 7ff99f270000 "rundll32.exe" loaded module "KERNELBASE" at base 7ff99cc40000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 7ff999b20000 "rundll32.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 771b0000 "rundll32.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 771b0000 "rundll32.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 771b0000 "rundll32.exe" loaded module "KERNEL32" at base 77020000 "rundll32.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73810000 "rundll32.exe" loaded module "KERNEL32.DLL" at base 77020000 "rundll32.exe" loaded module "ADVAPI32.DLL" at base 76370000 "rundll32.exe" loaded module "MSVCRT.DLL" at base 75e40000 "rundll32.exe" loaded module "NETAPI32.DLL" at base 737d0000 "rundll32.exe" loaded module "OLE32.DLL" at base 75b80000 "rundll32.exe" loaded module "OLEAUT32.DLL" at base 77690000 "rundll32.exe" loaded module "SHELL32.DLL" at base 76890000 "rundll32.exe" loaded module "USER32.DLL" at base 779a0000 "rundll32.exe" loaded module "VERSION.DLL" at base 75a60000 "rundll32.exe" loaded module "WINHTTP.DLL" at base 733d0000 "rundll32.exe" loaded module "%TEMP%\HTPD.DAT" at base 44d0000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 75270000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 733b0000 "rundll32.exe" loaded module "RPCRT4.DLL" at base 76030000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74600000 "rundll32.exe" loaded module "SSPICLI.DLL" at base 74760000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 73320000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\PCASVC.DLL" at base 7ff972150000 "rundll32.exe" loaded module "DIAGNOSTICDATASETTINGS" at base 7ff999de0000 "rundll32.exe" loaded module "POLICYMANAGER.DLL" at base 7ff9947e0000 "rundll32.exe" loaded module "RPCRT4.DLL" at base 7ff99ef60000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\PCASVC.DLL" at base 7ff962fc000046:T6b5,Observed system executable string:"%WINDIR%\system32\UXTHEME.dll" [Source: 00000000-00003720-00000C2B-3628756225] Observed system executable string:"%WINDIR%\system32\USERENV.dll" [Source: 00000000-00003720-00000C2B-3628793908] Observed system executable string:"%WINDIR%\system32\SETUPAPI.dll" [Source: 00000000-00003720-00000C2B-3628841614] Observed system executable string:"%WINDIR%\system32\APPHELP.dll" [Source: 00000000-00003720-00000C2B-3628945302] Observed system executable string:"%WINDIR%\system32\PROPSYS.dll" [Source: 00000000-00003720-00000C2B-3628988958] Observed system executable string:"%WINDIR%\system32\DWMAPI.dll" [Source: 00000000-00003720-00000C2B-3629027886] Observed system executable string:"%WINDIR%\system32\CRYPTBASE.dll" [Source: 00000000-00003720-00000C2B-3629064325] Observed system executable string:"%WINDIR%\system32\OLEACC.dll" [Source: 00000000-00003720-00000C2B-3629102699] Observed system executable string:"%WINDIR%\system32\CLBCATQ.dll" [Source: 00000000-00003720-00000C2B-3629141037] Observed system executable string:"%WINDIR%\system32\VERSION.dll" [Source: 00000000-00003720-00000C2B-3629177756] Observed system executable string:"%WINDIR%\system32\SHFOLDER.dll" [Source: 00000000-00003720-00000C2B-3629216377] Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00003332-00000C2B-3630851126] Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00003332-00000C2B-3631193108] Observed system executable string:"%WINDIR%\system32\kernel32.dll" [Source: 00000000-00003332-00000C2B-3631724161] Observed system executable string:"%WINDIR%\system32\PcaSvc.dll,PcaPatchSdbTask" [Source: rundll32.exe]47:T4e4,Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4") file/memory contains long string with (Indicator: "LoadLibrary"; File: "System.dll") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00003332.00000000.298704.8F813000.00000002.mdmp, 00000000-00003332.00000000.298704.D672D000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00003332.00000000.298704.D672D000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00003540.00000000.298973.45B09000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00005504.00000000.299031.002FA000.00000002.mdmp, 00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp")48:T7ff,"c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}"; Key: ""; Value: "") "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}\PROPERTIES"; Key: ""; Value: "") "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME"; Key: ""; Value: "") "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{60982E44-40A2-4367-9BC3-CA978A87EFC7}\"; Key: ""; Value: "") "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{44294F7C-6083-41C6-8176-3C202D755616}\"; Key: ""; Value: "") "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{FFA98E4B-99DB-4018-B974-2DFFBCBAF986}\"; Key: ""; Value: "") "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: ""; Value: "") "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "")49:Te80,"c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{60982E44-40A2-4367-9BC3-CA978A87EFC7}"; Key: "DATA"; Value: "") "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{60982E44-40A2-4367-9BC3-CA978A87EFC7}"; Key: "GENERATION"; Value: "") "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{44294F7C-6083-41C6-8176-3C202D755616}"; Key: "DATA"; Value: "") "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{44294F7C-6083-41C6-8176-3C202D755616}"; Key: "GENERATION"; Value: "") "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{FFA98E4B-99DB-4018-B974-2DFFBCBAF986}"; Key: "DATA"; Value: "") "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{FFA98E4B-99DB-4018-B974-2DFFBCBAF986}"; Key: "GENERATION"; Value: "") "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "ACP"; Value: "") "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "OEMCP"; Value: "") "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RAISEEXCEPTIONONPOSSIBLEDEADLOCK"; Value: "") "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "57A6ED1A-79F7-5011-B242-4784E5620CF7"; Value: "") "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "C354467EC5D323FECF94D33BC05EAB65F90A916C39137D2B751B0E637CA5A3E4.EXE"; Value: "") "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "3C74AFB9-8D82-44E3-B52C-365DBF48382A"; Value: "") "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "B749553B-D950-5E03-6282-3145A61B1002"; Value: "") "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "05F95EFE-7F75-49C7-A994-60A55CC09571"; Value: "") "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "")4a:T7b0,"c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.22621.608_none_42d541138da2ebd2\comctl32.dll" "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" trying to touch file "C:\Windows\SysWOW64\imm32.dll" "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" trying to touch file "C:\Windows\SysWOW64\oleaut32.dll" "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" trying to touch file "C:\Windows\SysWOW64\fltLib.dll" "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" trying to touch file "C:\Windows\SysWOW64\cryptsp.dll" "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" trying to touch file "C:\windows\temp\VxOle32.dll" "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" trying to touch file "C:\Windows\Temp\VxOle32.dll" "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" trying to touch file "\Global??\FltMgrMsg" "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" trying to touch file "C:\WINDOWS\system32\UXTHEME.dll" "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" trying to touch file "C:\Windows\SysWOW64\uxtheme.dll" "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" trying to touch file "C:\WINDOWS\system32\USERENV.dll" "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" trying to touch file "C:\Windows\SysWOW64\userenv.dll" "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" trying to touch file "C:\WINDOWS\system32\APPHELP.dll" "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" trying to touch file "C:\Windows\SysWOW64\apphelp.dll"4b:T4ce,"c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\reas.exe" "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsh239D.tmp\System.dll" "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" trying to access non-existent file "C:\wscript.exe" "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\wscript.exe" "wscript.exe" trying to access non-existent file "C:\Windows\System32\MsMpLics.dll" "cmd.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\rundll32.exe" "rundll32.exe" trying to access non-existent file "C:\Users\I9ivdOb\AppData\Local\Temp\netapi32.dll" "rundll32.exe" trying to access non-existent file "C:\Users\I9ivdOb\AppData\Local\Temp\version.dll" "rundll32.exe" trying to access non-existent file "C:\Users\I9ivdOb\AppData\Local\Temp\winhttp.dll"4c:T7b7,"c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\htpd.dat" "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\rds.vbs" "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\2.lnk" "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\help.bat" "wscript.exe" trying to access non-existent file "C:\Windows\System32\AppLocker\MDM" "wscript.exe" trying to access non-existent file "STORAGE#Volume#{5781f570-2b3b-11ee-88a5-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}" "wscript.exe" trying to access non-existent file "C:\Windows\System32\cmd.exe:Zone.Identifier" "cmd.exe" trying to access non-existent file "C:\Windows\System32\AppLocker\MDM" "rundll32.exe" trying to access non-existent file "C:\Users\I9ivdOb\AppData\Local\Temp\htpd.dat.manifest" "rundll32.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\htpd.dat.123.Manifest" "rundll32.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\htpd.dat.124.Manifest" "rundll32.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\htpd.dat.2.Manifest" "rundll32.exe" trying to access non-existent file "C:\Windows\SysWOW64\en-US\rundll32.exe.mui" "rundll32.exe" trying to access non-existent file "C:\Windows\SysWOW64\en-US\KERNEL32.DLL.mui" "rundll32.exe" trying to access non-existent file "C:\Windows\SysWOW64\en-US\tzres.dll.mui" "rundll32.exe" trying to access non-existent file "\DEVICE\NETBT_TCPIP_{45F5205B-FA7A-11ED-8886-806E6F6E6963}" "rundll32.exe" trying to access non-existent file "C:\Windows\SysWOW64\en-US\winnlsres.dll.mui"4d:T788,"rundll32.exe" called "WinHttpSendRequest" with parameters {"hRequest": "2724538" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "115" "dwContext": "0" "$error": "2ee7"} "rundll32.exe" called "WinHttpSendRequest" with parameters {"hRequest": "27457c8" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "115" "dwContext": "0" "$error": "2ee7"} "rundll32.exe" called "WinHttpSendRequest" with parameters {"hRequest": "274d010" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "115" "dwContext": "0" "$error": "2ee7"} "rundll32.exe" called "WinHttpSendRequest" with parameters {"hRequest": "2724400" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "115" "dwContext": "0" "$error": "2ee7"} "rundll32.exe" called "WinHttpSendRequest" with parameters {"hRequest": "2760278" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "115" "dwContext": "0" "$error": "2ee7"} "rundll32.exe" called "WinHttpSendRequest" with parameters {"hRequest": "275c6f8" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "115" "dwContext": "0" "$error": "2ee7"} "rundll32.exe" called "WinHttpSendRequest" with parameters {"hRequest": "2778ff0" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "115" "dwContext": "0" "$error": "2ee7"} "rundll32.exe" called "WinHttpSendRequest" with parameters {"hRequest": "2763948" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "115" "dwContext": "0" "$error": "2ee7"} "rundll32.exe" called "WinHttpSendRequest" with parameters {"hRequest": "2782bb0" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "115" "dwContext": "0" "$error": "2ee7"} "rundll32.exe" called "WinHttpSendRequest" with parameters {"hRequest": "2780670" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "115" "dwContext": "0" "$error": "2ee7"}4e:Td6f,Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00005504-00000C2C-3636248848") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00005504-00000C2C-3636249009") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00005504-00000C2C-3636249086") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; Source: "00000000-00005504-00000C2C-3636249124") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00005504-00000C2C-3636249124") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00005504-00000C2C-3636249124") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00005504-00000C2C-3636249209") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; Source: "00000000-00005504-00000C2C-3636249400") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00005504-00000C2C-3636249400") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; Source: "00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; Source: "00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp")4f:T13b8,Found reference to API "WinHttpGetIEProxyConfigForCurrentUser" (Indicator: "WinHttpGetIEProxyConfigForCurrentUser"; Source: "00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp") Found reference to API "WinHttpSetTimeouts" (Indicator: "WinHttpSetTimeouts"; Source: "00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp") Found reference to API "WinHttpReceiveResponse" (Indicator: "WinHttpReceiveResponse"; Source: "00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp") Found reference to API "WinHttpQueryAuthSchemes" (Indicator: "WinHttpQueryAuthSchemes"; Source: "00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp") Found reference to API "WinHttpGetProxyForUrl" (Indicator: "WinHttpGetProxyForUrl"; Source: "00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp") Found reference to API "WinHttpCloseHandle" (Indicator: "WinHttpCloseHandle"; Source: "00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp") Found reference to API "WinHttpAddRequestHeaders" (Indicator: "WinHttpAddRequestHeaders"; Source: "00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp") Found reference to API "WinHttpWriteData" (Indicator: "WinHttpWriteData"; Source: "00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp") Found reference to API "WinHttpSetCredentials" (Indicator: "WinHttpSetCredentials"; Source: "00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp") Found reference to API "WinHttpQueryDataAvailable" (Indicator: "WinHttpQueryDataAvailable"; Source: "00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp") Found reference to API "WinHttpSetOption" (Indicator: "WinHttpSetOption"; Source: "00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp") Found reference to API "WinHttpQueryOption" (Indicator: "WinHttpQueryOption"; Source: "00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp")50:Td8d,Found URL "http://www.validationtest.contoso.com/test%ld.htmlmpoav_forcedeepscan" - Source: "00000000-00003332.00000000.298704.8F813000.00000002.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportowerhnternaldefinitionupdateserver" - Source: "00000000-00003332.00000000.298704.C7300000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportecurityintelligencelocationupdateatscheduledtimeonlydesktop-8ld9t6n192.168.0.2desktop-8ld9t6n192.168.0.2indows" - Source: "00000000-00003332.00000000.298704.C7399000.00000004.mdmp") Found URL "https://vesecase.com/support/form.phpvesecase.comttps://vesecase.com:443/support/form.phpvesecase.comrpc-ece9f6c2d8ca82a507device\afd\endpointdevice\afd\endpointvesecase.comcpipvesecase.comvesecase.comvesecase.comvesecase.com32\rasadhlp.dllnumber_of_processors=8processor_level=6prbphomepath=\users\i9ivdobprocessor_revision=4f00public=c:\users\publicsessionname=consolesystemroot=c:\windowswindir=c:\windowsusername=i9ivdobydb" - Source: "00000000-00005504.00000000.299031.026F0000.00000004.mdmp") Found URL "https://vesecase.com/support/form.php" - Source: "00000000-00005504.00000000.299031.026F0000.00000004.mdmp") Found URL "http://direct:80http/1.0http/1.1http/2.0httphttpsinvalid" - Source: "00000000-00005504.00000000.299031.044D1000.00000040.mdmp") Found URL "https://vesecase.com/support/form.phpasdgdgyss455afsssdrfrm.pwrsdggsefw.pwrsdasfasaasfxfacmd.exe" - Source: "00000000-00005504.00000000.299031.044D1000.00000040.mdmp") Found URL "https://afsssdrfrm.pw/support/form.phphttps://afsssdrfrm.pw/support/form.phphttps://afsssdrfrm.pw/support/form.phphttps://afsssdrfrm.pw/support/form.phphttps://afsssdrfrm.pw/support/form.phphttps://afsssdrfrm.pw/support/form.phphyper-v" - Source: "00000000-00005504.00000001.300951.026F0000.00000004.mdmp") Found URL "https://afsssdrfrm.pw/support/form.phpflstw0;pflstw0;pw" - Source: "00000000-00005504.00000001.300951.026F0000.00000004.mdmp") Found URL "http://direct:80http/1.0http/1.1http/2.0httphttpsinvalid" - Source: "00000000-00005504.00000001.300951.044D1000.00000040.mdmp") Found URL "https://vesecase.com/support/form.phpasdgdgyss455afsssdrfrm.pwrsdggsefw.pwrsdasfasaasfxfacmd.exe" - Source: "00000000-00005504.00000001.300951.044D1000.00000040.mdmp") Found URL "https://afsssdrfrm.pw/support/form.phphttps://afsssdrfrm.pw/support/form.phphttps://afsssdrfrm.pw/support/form.phphttps://afsssdrfrm.pw/support/form.phphttps://afsssdrfrm.pw/support/form.phphttps://afsssdrfrm.pw/support/form.phphttps://afsssdrfrm.pw/support/form.phphttps://afsssdrfrm.pw/support/form.phphttps://afsssdrfrm.pw/support/form.phphyper-v" - Source: "00000000-00005504.00000002.302872.026F0000.00000004.mdmp") Found URL "https://afsssdrfrm.pw/support/form.php" - Source: "00000000-00005504.00000002.302872.026F0000.00000004.mdmp") Found URL "http://direct:80http/1.0http/1.1http/2.0httphttpsinvalid" - Source: "00000000-00005504.00000002.302872.044D1000.00000040.mdmp") Found URL "https://vesecase.com/support/form.phpasdgdgyss455afsssdrfrm.pwrsdggsefw.pwrsdasfasaasfxfacmd.exe" - Source: "00000000-00005504.00000002.302872.044D1000.00000040.mdmp") Found URL "https://afsssdrfrm.pw/afsssdrfrm.pwethernet0lmicrosoft" - Source: "00000000-00005504.00000002.302872.05090000.00000004.mdmp") Found URL "https://afsssdrfrm.pw/afsssdrfrm.pwlrpccalrpccalrpccalrpccalrpccalrpc&wan" - Source: "00000000-00005504.00000002.302872.05359000.00000004.mdmp")51:Ta61,Found registry query API: "RegEnumValueA" in file "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4" Found registry query API: "RegEnumKeyA" in file "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4" Found registry query API: "RegQueryValueExA" in file "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4" Found registry query API: "RegOpenKeyExA" in file "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4" Found registry query API: "RegQueryValueExW" in "00000000-00003332.00000000.298704.8F813000.00000002.mdmp, 00000000-00003332.00000000.298704.D672D000.00000002.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00003332.00000000.298704.8F813000.00000002.mdmp, 00000000-00003332.00000000.298704.D672D000.00000002.mdmp" Found registry query API: "RegQueryValueA" in "00000000-00003332.00000000.298704.D672D000.00000002.mdmp" Found registry query API: "RegOpenKeyA" in "00000000-00003332.00000000.298704.D672D000.00000002.mdmp" Found registry query API: "RegEnumKeyExA" in "00000000-00003332.00000000.298704.D672D000.00000002.mdmp" Found registry query API: "RegOpenKeyExA" in "00000000-00003332.00000000.298704.D672D000.00000002.mdmp" Found registry query API: "RegQueryValueExA" in "00000000-00003332.00000000.298704.D672D000.00000002.mdmp" Found registry query API: "RegEnumKeyExW" in "00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp" Found registry query API: "RegQueryInfoKeyW" in "00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp" Found registry query API: "RegSaveKeyW" in "00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp" Found registry query API: "RegEnumValueW" in "00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp"52:T48f,Found reference to API "LookupAccountNameW" (Indicator: "LookupAccountName"; Source: "00000000-00003332.00000000.298704.D672D000.00000002.mdmp") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00003332.00000000.298704.D672D000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00003540.00000000.298973.45B09000.00000002.mdmp") Found reference to API "NtQueryInformationToken" (Indicator: "NtQueryInformationToken"; Source: "00000000-00003540.00000000.298973.45B09000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00005504.00000000.299031.002FA000.00000002.mdmp") Found reference to API "NtQueryInformationToken" (Indicator: "NtQueryInformationToken"; Source: "00000000-00005504.00000000.299031.002FA000.00000002.mdmp") Found reference to API "NetWkstaGetInfo" (Indicator: "NetWkstaGetInfo"; Source: "00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp")53:T80c,"c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "FindFirstFileA" with parameter %TEMP%\htpd.dat (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "FindFirstFileA" with parameter %TEMP%\rds.vbs (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "FindFirstFileA" with parameter %TEMP%\nsh239D.tmp (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "FindFirstFileA" with parameter %LOCALAPPDATA%\Temp (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "FindFirstFileA" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "FindFirstFileA" with parameter %USERPROFILE%\AppData (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "FindFirstFileA" with parameter C:\Users\%OSUSER% (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "FindFirstFileA" with parameter C:\Users (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "FindFirstFileA" with parameter %TEMP%\nsh239D.tmp\*.* (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00003720) "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" called "FindNextFileA" with parameter System.dll (UID: 00000000-00003720) "rundll32.exe" called "FindFirstFileW" with parameter %TEMP%\htpd.en-US (UID: 00000000-00005504) "rundll32.exe" called "FindFirstFileW" with parameter %TEMP%\htpd.en (UID: 00000000-00005504) "rundll32.exe" called "FindFirstFileW" with parameter %TEMP%\htpd.ENU (UID: 00000000-00005504) "rundll32.exe" called "FindFirstFileW" with parameter %TEMP%\htpd.EN (UID: 00000000-00005504)54:T45e,Found string "ystem.OfflineFiles.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00003332.00000000.298704.C9080000.00000002.mdmp") Found string "ystem.Security.EncryptionOwners" (Indicator: ".encrypt"; Source: "00000000-00003332.00000000.298704.C9080000.00000002.mdmp") Found string "ystem.Security.EncryptionOwnersDisplay" (Indicator: ".encrypt"; Source: "00000000-00003332.00000000.298704.C9080000.00000002.mdmp") Found string "ystem.ZipFolder.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00003332.00000000.298704.C9080000.00000002.mdmp") Found string "System.Security.EncryptionOwnersDisplay" (Indicator: ".encrypt"; Source: "00000000-00003332.00000000.298704.C96B0000.00000002.mdmp") Found string "System.Security.EncryptionOwners" (Indicator: ".encrypt"; Source: "00000000-00003332.00000000.298704.C96B0000.00000002.mdmp") Found string "System.OfflineFiles.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00003332.00000000.298704.C96B0000.00000002.mdmp") Found string "System.ZipFolder.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00003332.00000000.298704.C96B0000.00000002.mdmp")55:T442,Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; File: "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; File: "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00003332.00000000.298704.8F813000.00000002.mdmp") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00003332.00000000.298704.8F813000.00000002.mdmp") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00003332.00000000.298704.D672D000.00000002.mdmp") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00003332.00000000.298704.D672D000.00000002.mdmp") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp")56:Tb7b,Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4") file/memory contains long string with (Indicator: "GetModuleHandle"; File: "System.dll") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00003332.00000000.298704.8F813000.00000002.mdmp, 00000000-00003332.00000000.298704.D672D000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00003332.00000000.298704.8F813000.00000002.mdmp, 00000000-00003332.00000000.298704.D672D000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003332.00000000.298704.8F813000.00000002.mdmp, 00000000-00003332.00000000.298704.D672D000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00003332.00000000.298704.8F813000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00003332.00000000.298704.8F813000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00003332.00000000.298704.D672D000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00003540.00000000.298973.45B09000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00003540.00000000.298973.45B09000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00003540.00000000.298973.45B09000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003540.00000000.298973.45B09000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00005504.00000000.299031.002FA000.00000002.mdmp, 00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00005504.00000000.299031.002FA000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00005504.00000000.299031.002FA000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00005504.00000000.299031.002FA000.00000002.mdmp, 00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp")57:T5bc,Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4") file/memory contains long string with (Indicator: "GetModuleHandle"; File: "System.dll") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003332.00000000.298704.8F813000.00000002.mdmp, 00000000-00003332.00000000.298704.D672D000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00003332.00000000.298704.8F813000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00003332.00000000.298704.D672D000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00003540.00000000.298973.45B09000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003540.00000000.298973.45B09000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00005504.00000000.299031.002FA000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00005504.00000000.299031.002FA000.00000002.mdmp, 00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp")58:T11b3,Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; File: "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4") Found reference to API "SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation"; File: "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; File: "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; File: "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; File: "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4") Found reference to API "wGetTempPath2W" (Indicator: "GetTempPath"; Source: "00000000-00003332.00000000.298704.8F813000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003332.00000000.298704.8F813000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00003332.00000000.298704.8F813000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003332.00000000.298704.8F813000.00000002.mdmp, 00000000-00003332.00000000.298704.D672D000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00003332.00000000.298704.8F813000.00000002.mdmp, 00000000-00003332.00000000.298704.D672D000.00000002.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003332.00000000.298704.8F813000.00000002.mdmp, 00000000-00003332.00000000.298704.D672D000.00000002.mdmp") Found reference to API "GetFileVersionInfoExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003332.00000000.298704.8F813000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00003332.00000000.298704.8F813000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00003332.00000000.298704.8F813000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00003332.00000000.298704.8F813000.00000002.mdmp, 00000000-00003332.00000000.298704.D672D000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00003332.00000000.298704.8F813000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003332.00000000.298704.D672D000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00003332.00000000.298704.D672D000.00000002.mdmp") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003332.00000000.298704.D672D000.00000002.mdmp") Found reference to API "GetTempPath2A" (Indicator: "GetTempPath"; Source: "00000000-00003332.00000000.298704.D672D000.00000002.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00003332.00000000.298704.D672D000.00000002.mdmp") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; Source: "00000000-00003332.00000000.298704.D672D000.00000002.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00003332.00000000.298704.D672D000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00003332.00000000.298704.D672D000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00003540.00000000.298973.45B09000.00000002.mdmp")59:T41e,Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; File: "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00003332.00000000.298704.8F813000.00000002.mdmp, 00000000-00003332.00000000.298704.D672D000.00000002.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00003332.00000000.298704.D672D000.00000002.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00003540.00000000.298973.45B09000.00000002.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00005504.00000000.299031.002FA000.00000002.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp")5a:T47d,Found registry deletion API: "RegDeleteValueA" in file "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4" Found registry deletion API: "RegDeleteKeyA" in file "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4" Found registry deletion API: "RegDeleteKeyExA" in file "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4" Found registry deletion API: "RegDeleteKeyA" in "00000000-00003332.00000000.298704.D672D000.00000002.mdmp" Found registry deletion API: "RegDeleteKeyExW" in "00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp" Found registry deletion API: "RegDeleteKeyW" in "00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp" Found registry deletion API: "RegDeleteValueW" in "00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp"5b:T177d,Found string "\Device\HarddiskVolume3\Windows\System32\cmd.exe" (Indicator: "\Device\"; Source: "00000000-00003332-00000BC1-3632734914") Found string "\Device\HarddiskVolume3\Windows\System32\conhost.exe" (Indicator: "\Device\"; Source: "00000000-00002432-00000BC0-3632895206") Found string "\Device\HarddiskVolume3\Windows\System32\rundll32.exe" (Indicator: "\Device\"; Source: "00000000-00002432-00000BC0-3634003031") Found string "\Device\HarddiskVolume3\Windows\SysWOW64\rundll32.exe" (Indicator: "\Device\"; Source: "00000000-00003540-00000BC0-3634889121") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00003332.00000000.298704.C7300000.00000004.mdmp, 00000000-00003332.00000000.298704.C7550000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00003332.00000000.298704.C7300000.00000004.mdmp, 00000000-00003332.00000000.298704.C7550000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverDat" (Indicator: "\drivers\"; Source: "00000000-00003332.00000000.298704.C7300000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverDat" (Indicator: "system32\drivers"; Source: "00000000-00003332.00000000.298704.C7300000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00003540.00000000.298973.1B990000.00000004.mdmp, 00000000-00003540.00000001.300893.1B7D0000.00000004.mdmp, 00000000-00003540.00000002.302812.1B7D0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00003540.00000000.298973.1B990000.00000004.mdmp, 00000000-00003540.00000001.300893.1B7D0000.00000004.mdmp, 00000000-00003540.00000002.302812.1B7D0000.00000004.mdmp") Found string "\Device\HarddiskVolume3\Windows\System32\rundll32.exe" (Indicator: "\Device\"; Source: "00000000-00003540.00000001.300893.1B7D0000.00000004.mdmp, 00000000-00003540.00000002.302812.1B7D0000.00000004.mdmp") Found string "ta=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00003540.00000001.300893.1B7D0000.00000004.mdmp, 00000000-00003540.00000002.302812.1B7D0000.00000004.mdmp") Found string "ta=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00003540.00000001.300893.1B7D0000.00000004.mdmp, 00000000-00003540.00000002.302812.1B7D0000.00000004.mdmp") Found string "\Device\HarddiskVolume3\Windows\System32\rundll32.exe" (Indicator: "\Device\"; Source: "00000000-00005044.00000000.302550.97C80000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00005044.00000000.302550.97C80000.00000004.mdmp, 00000000-00005044.00000000.302550.97F50000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00005044.00000000.302550.97C80000.00000004.mdmp, 00000000-00005044.00000000.302550.97F50000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00005044.00000000.302550.97C80000.00000004.mdmp") Found string "ndows\System32\Drivers\DriverDat" (Indicator: "\drivers\"; Source: "00000000-00005044.00000000.302550.97C80000.00000004.mdmp") Found string "ndows\System32\Drivers\DriverDat" (Indicator: "system32\drivers"; Source: "00000000-00005044.00000000.302550.97C80000.00000004.mdmp") Found string "WS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00005044.00000000.302550.97C80000.00000004.mdmp") Found string "\Microsoft\PolicyManager\current\Device\System" (Indicator: "\Device\"; Source: "00000000-00005044.00000000.302550.97F50000.00000004.mdmp") Found string "\Device\HarddiskVolume3\Windows\System32\rundll32.exe" (Indicator: "\Device\"; Source: "00000000-00005332.00000000.307756.017F0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00005332.00000000.307756.017F0000.00000004.mdmp, 00000000-00005332.00000000.307756.01970000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00005332.00000000.307756.017F0000.00000004.mdmp, 00000000-00005332.00000000.307756.01970000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00005332.00000000.307756.017F0000.00000004.mdmp") Found string "ndows\System32\Drivers\DriverDat" (Indicator: "\drivers\"; Source: "00000000-00005332.00000000.307756.017F0000.00000004.mdmp") Found string "ndows\System32\Drivers\DriverDat" (Indicator: "system32\drivers"; Source: "00000000-00005332.00000000.307756.017F0000.00000004.mdmp") Found string "WS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00005332.00000000.307756.017F0000.00000004.mdmp") Found string "\Microsoft\PolicyManager\current\Device\System" (Indicator: "\Device\"; Source: "00000000-00005332.00000000.307756.01970000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00005504.00000000.299031.026F0000.00000004.mdmp, 00000000-00005504.00000000.299031.029D0000.00000004.mdmp, 00000000-00005504.00000001.300951.026F0000.00000004.mdmp, 00000000-00005504.00000002.302872.026F0000.00000004.mdmp, 00000000-00005504.00000002.302872.029D0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00005504.00000000.299031.026F0000.00000004.mdmp, 00000000-00005504.00000000.299031.029D0000.00000004.mdmp, 00000000-00005504.00000001.300951.026F0000.00000004.mdmp, 00000000-00005504.00000002.302872.026F0000.00000004.mdmp, 00000000-00005504.00000002.302872.029D0000.00000004.mdmp")5c:T56f,Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00003332.00000000.298704.8F813000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00003332.00000000.298704.8F813000.00000002.mdmp, 00000000-00003332.00000000.298704.D672D000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00003332.00000000.298704.8F813000.00000002.mdmp, 00000000-00003332.00000000.298704.D672D000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00003540.00000000.298973.45B09000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00003540.00000000.298973.45B09000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00005504.00000000.299031.002FA000.00000002.mdmp, 00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00005504.00000000.299031.002FA000.00000002.mdmp")5d:Tbd3,"c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\WSCRIPT.EXE"; Value: "") "wscript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: "RPCCACHETIMEOUT"; Value: "") "wscript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\CMD.EXE"; Value: "") "wscript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGLEVEL"; Value: "") "wscript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGMATCHANYMASK"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\RUNDLL32.EXE"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSWOW64\RUNDLL32.EXE"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "AUTODIALDLL"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "USEDELAYEDACCEPTANCE"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "")5e:T10fd,"wscript.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") "wscript.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "0100000000") "wscript.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0100000000") "wscript.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0000000000") "wscript.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\CMD.EXE"; Value: "8DB83353B6CFDC010000000000000000000000000200000000") "wscript.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS SCRIPT\SETTINGS\TELEMETRY\WSCRIPT.EXE"; Key: "VBSCRIPTSETSCRIPTSTATESTARTED"; Value: "A3BE4C360000000000") "wscript.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC3475"; Value: "B606000000000000040004000102090000000000210000000D787900010000001C390B01010000002FD60F02010000006B507E0018000000795344020500000087DE83005C000000A19F5E0001000000F062570201000000FED37A0004000100000054000000276B69012D00000056737D00060000006B507E0006000000E6C5310002000400000001000000C49B7B0201000000EFBA830202006500000066100000E6C5310008000000F0E0B60001006800000002000000BC6EB40000") "wscript.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\SOFTWARE\MICROSOFT\TIP\AGGREGATERESULTS"; Key: "DATA"; Value: "D9A7A80101000300EC03F46F00000000270000000000000049A8A801010203005C4614A6000000000F00000000000000D1A8A8010102030064B65611000000008500000000000000D1A8A80101000400FB3B54EB000000003600000000000000C25CAB0101000200FECB062F00000000010000006D0C000023ACAD0102020400546DD0B4000000000100000050000000AFFBB9010100008055161AFB0000000001000000313600002B7ABA010202070017EB54670000000002000000070000004428C30101000080469996A2000000001F000000F60200004428C30104000100541F4AF40000000009000000000000006597C90101020080EB47F5D000000000010000007F0000009F49DD010100008045734BE10000000007000000000000004959DD0101000400F34A296B0000000002000000D10300006A44DF010100008054528C5D0000000001000000D00000009178E10101000080DF19D73200000000010000000100000081F7E10104000100C177129C000000005B0000001800000081F7E101047F02002AF214C2000000000B000000F4000000EC9BE501010000806E4C67B60000000001000000000000000C84EA010102010077F457460000000001000000240000008C5FF20101000400EA4046AF0000000003000000A10000003D4A060201000080C39240F0000000000100000012000000564A0602017F0080784A674B000000000100000041000000BFDE08020100008065B49D6B0000000009000000D30000005F37110201000080856D77FF0000000004000000E80000006D38160201020080738B74C70000000001000000B0000000A4102702017F0080260FB9F9000000001000000064000000BCF4300201000080BE9498180000000001000000E60100006C97340201000080EE1839B90000000005000000000000009A483902010001006D537548000000000100000000000000B9BE4502010000808712A98300000000010000007B00000077384602017F0500101E3EA3000000000100000003000000D60F470201000080F82C30D1000000000100000000000000FDBE49020101008003520DB60000000002000000740A0000487C4D0201000080127A123700000000640000002300000093FE59020100010098FBB9D6000000000300000001000000477F610204000100DFB5D96E0000000001000000000000009E26640201010080C0A211130000000001000000000000005792640201000080FD299895000000000100000092050000FF40890201000080252A7840000000004600000015000000FF4089020300004026CCD6550000000012000000000000004614940201000080682B516C0000000001000000D629000000") "cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\RUNDLL32.EXE"; Value: "D4E7F453B6CFDC010000000000000000000000000200000000") "rundll32.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "PATCHDBUPDATETICKCOUNT"; Value: "871648000000000000") "rundll32.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "PATCHDBUPDATETICKCOUNT"; Value: "B05249000000000000")5f:T425,Found reference to API "ReleaseMutex" (Indicator: "ReleaseMutex"; Source: "00000000-00003332.00000000.298704.D672D000.00000002.mdmp") Found reference to API "CreateMutexExW" (Indicator: "CreateMutex"; Source: "00000000-00003332.00000000.298704.D672D000.00000002.mdmp") Found reference to API "ReleaseMutex" (Indicator: "ReleaseMutex"; Source: "00000000-00003540.00000000.298973.45B09000.00000002.mdmp") Found reference to API "CreateMutexExW" (Indicator: "CreateMutex"; Source: "00000000-00003540.00000000.298973.45B09000.00000002.mdmp") Found reference to API "ReleaseMutex" (Indicator: "ReleaseMutex"; Source: "00000000-00005504.00000000.299031.002FA000.00000002.mdmp") Found reference to API "CreateMutexExW" (Indicator: "CreateMutex"; Source: "00000000-00005504.00000000.299031.002FA000.00000002.mdmp") Found reference to API "CreateMutexW" (Indicator: "CreateMutex"; Source: "00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp")60:Te1f,Found string "MulDiv" (Source: c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4, API is part of module: KERNELBASE.DLL) Found string "DeleteFileA" (Source: c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4, API is part of module: KERNELBASE.DLL) Found string "FindFirstFileA" (Source: c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4, API is part of module: KERNELBASE.DLL) Found string "FindNextFileA" (Source: c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4, API is part of module: KERNELBASE.DLL) Found string "FindClose" (Source: c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4, API is part of module: KERNELBASE.DLL) Found string "SetFilePointer" (Source: c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4, API is part of module: KERNELBASE.DLL) Found string "GetPrivateProfileStringA" (Source: c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4, API is part of module: KERNEL32.DLL) Found string "WritePrivateProfileStringA" (Source: c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4, API is part of module: KERNEL32.DLL) Found string "MultiByteToWideChar" (Source: c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4, API is part of module: KERNELBASE.DLL) Found string "FreeLibrary" (Source: c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4, API is part of module: KERNELBASE.DLL) Found string "LoadLibraryExA" (Source: c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4, API is part of module: KERNELBASE.DLL) Found string "GetModuleHandleA" (Source: c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4, API is part of module: KERNELBASE.DLL) Found string "GlobalAlloc" (Source: c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4, API is part of module: KERNELBASE.DLL) Found string "GlobalFree" (Source: c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4, API is part of module: KERNELBASE.DLL) Found string "ExpandEnvironmentStringsA" (Source: c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4, API is part of module: KERNELBASE.DLL) Found string "lstrcmpA" (Source: c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4, API is part of module: KERNELBASE.DLL) Found string "lstrcmpiA" (Source: c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4, API is part of module: KERNELBASE.DLL) Found string "CloseHandle" (Source: c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4, API is part of module: KERNELBASE.DLL) Found string "SetFileTime" (Source: c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4, API is part of module: KERNELBASE.DLL) Found string "CompareFileTime" (Source: c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4, API is part of module: KERNELBASE.DLL) Found string "SearchPathA" (Source: c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4, API is part of module: KERNELBASE.DLL) Found string "GetShortPathNameA" (Source: c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4, API is part of module: KERNEL32.DLL) Found string "GetFullPathNameA" (Source: c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4, API is part of module: KERNELBASE.DLL) Found string "MoveFileA" (Source: c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4, API is part of module: KERNEL32.DLL) Found string "SetCurrentDirectoryA" (Source: c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4, API is part of module: KERNELBASE.DLL)61:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAd3AAAAAAAAAAAAAAAAAAd4i7ugAAAAAAAAePjwAAB/j4i7qqAAAAAAAH+PgHAHh/j7uqqIAAAAAAB4+PCHB3h/iLqoiAAAAAAAf4+AeHeHh/i6iI7gAAAAAHj48Id4eHhwCo7u4AAAAAB/j4B4d4eHAADu6IAAAAAAePjwh3iI7gAAeHhwAAAAAH+PgHh47orgB4eHgAAAAAB///CHfuiu6/94eHAAAAAAf//weHeK7uv494cAAAAAAH//8IeHru67j494CIiIAAB///CIiH7ru4j48AAAiHAAf//wiIgHe7uIgAd3d4hwAH//8IiID/d3d3//////cAB3d3CIiAd3d3d3d3d3eHAAd3dwiIgAAAAAAAAAAACAB///9wiIB4iIiIiIiIiHAHd3d3dwiAf/////////hwAAAAd3dwgH8AAAAAAAD4cAAAAAd3dwB/AAAAAAAA+HAAAAAAf//wfwAADwDwAPhwAAAAAAd3dw8AAA8A8AD4cAAAAAAAAAB/AAAP//8A+HAAAAAAAAAAfwAAD///APhwAAAAAAAAAH8A//8AAAD4cAAAAAAAAAB/AA/wAAAA+HAAAAAAAAAAfwAAAAAAAPhwAAAAAAAAAH8AAAAAAAD4cAAAAAAAAAB/////////+HAAAAAAAAAAB3d3d3d3d3dwD//gf/wPgB/8BwAP/AIAB/wAAAf8AAAD/AAAA/wABgP8AAYD/AAAA/wAAAP8AAAAPAAAABwAAAAMAAAADAAAAAwAAAAMAAAACAAAABAAAAAfgAAAH8AAAB/gAAAf8AAAH/+AAB//gAAf/4AAH/+AAB//gAAf/4AAH/+AAB//wAAw==62:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAd3AAAAAAAAAAAAAAAAAAd4i7ugAAAAAAAAePjwAAB/j4i7qqAAAAAAAH+PgHAHh/j7uqqIAAAAAAB4+PCHB3h/iLqoiAAAAAAAf4+AeHeHh/i6iI7gAAAAAHj48Id4eHhwCo7u4AAAAAB/j4B4d4eHAADu6IAAAAAAePjwh3iI7gAAeHhwAAAAAH+PgHh47orgB4eHgAAAAAB///CHfuiu6/94eHAAAAAAf//weHeK7uv494cAAAAAAH//8IeHru67j494CIiIAAB///CIiH7ru4j48AAAiHAAf//wiIgHe7uIgAd3d4hwAH//8IiID/d3d3//////cAB3d3CIiAd3d3d3d3d3eHAAd3dwiIgAAAAAAAAAAACAB///9wiIB4iIiIiIiIiHAHd3d3dwiAf/////////hwAAAAd3dwgH8AAAAAAAD4cAAAAAd3dwB/AAAAAAAA+HAAAAAAf//wfwAADwDwAPhwAAAAAAd3dw8AAA8A8AD4cAAAAAAAAAB/AAAP//8A+HAAAAAAAAAAfwAAD///APhwAAAAAAAAAH8A//8AAAD4cAAAAAAAAAB/AA/wAAAA+HAAAAAAAAAAfwAAAAAAAPhwAAAAAAAAAH8AAAAAAAD4cAAAAAAAAAB/////////+HAAAAAAAAAAB3d3d3d3d3dwD//gf/wPgB/8BwAP/AIAB/wAAAf8AAAD/AAAA/wABgP8AAYD/AAAA/wAAAP8AAAAPAAAABwAAAAMAAAADAAAAAwAAAAMAAAACAAAABAAAAAfgAAAH8AAAB/gAAAf8AAAH/+AAB//gAAf/4AAH/+AAB//gAAf/4AAH/+AAB//wAAw==63:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAd3AAAAAAAAAAAAAAAAAAd4i7ugAAAAAAAAePjwAAB/j4i7qqAAAAAAAH+PgHAHh/j7uqqIAAAAAAB4+PCHB3h/iLqoiAAAAAAAf4+AeHeHh/i6iI7gAAAAAHj48Id4eHhwCo7u4AAAAAB/j4B4d4eHAADu6IAAAAAAePjwh3iI7gAAeHhwAAAAAH+PgHh47orgB4eHgAAAAAB///CHfuiu6/94eHAAAAAAf//weHeK7uv494cAAAAAAH//8IeHru67j494CIiIAAB///CIiH7ru4j48AAAiHAAf//wiIgHe7uIgAd3d4hwAH//8IiID/d3d3//////cAB3d3CIiAd3d3d3d3d3eHAAd3dwiIgAAAAAAAAAAACAB///9wiIB4iIiIiIiIiHAHd3d3dwiAf/////////hwAAAAd3dwgH8AAAAAAAD4cAAAAAd3dwB/AAAAAAAA+HAAAAAAf//wfwAADwDwAPhwAAAAAAd3dw8AAA8A8AD4cAAAAAAAAAB/AAAP//8A+HAAAAAAAAAAfwAAD///APhwAAAAAAAAAH8A//8AAAD4cAAAAAAAAAB/AA/wAAAA+HAAAAAAAAAAfwAAAAAAAPhwAAAAAAAAAH8AAAAAAAD4cAAAAAAAAAB/////////+HAAAAAAAAAAB3d3d3d3d3dwD//gf/wPgB/8BwAP/AIAB/wAAAf8AAAD/AAAA/wABgP8AAYD/AAAA/wAAAP8AAAAPAAAABwAAAAMAAAADAAAAAwAAAAMAAAACAAAABAAAAAfgAAAH8AAAB/gAAAf8AAAH/+AAB//gAAf/4AAH/+AAB//gAAf/4AAH/+AAB//wAAw==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791247921459,"unified_at":"2026-10-06T00:52:01.459Z","metadata":{"hashes":{"sha256":"c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4","sha1":"04b5be447def79e43d4329611c0e0800d784820a","md5":"e00499e21f9dcf77fc990400b8b3c2b5","sha512":"6bf368d7514aa924b56cd75ac9fb24fa8739b5106673a2229ee1ecca09b6e131e7de12008df33b218d9cd24208b1140ea3ac873603b0f4ca0f65f236b51fa49e","ssdeep":"6144:pawYQTQ3jtG7EL8iXLSDhl4vBRVoh78ofsMmw1b69UEwrijW4sW3U/32ojbOtqYs:bNTQ3jtjp2Dh2vxtFdwLEmmW4N3m3CRs","ssdeep_chunks":["6144:pawYQTQ","6144:awYQTQ3","6144:wYQTQ3j","6144:YQTQ3jt","6144:QTQ3jtG","6144:TQ3jtG7","6144:Q3jtG7E","6144:3jtG7EL","6144:jtG7EL8","6144:tG7EL8i","6144:G7EL8iX","6144:7EL8iXL","6144:EL8iXLS","6144:L8iXLSD","6144:8iXLSDh","6144:iXLSDhl","6144:XLSDhl4","6144:LSDhl4v","6144:SDhl4vB","6144:Dhl4vBR","6144:hl4vBRV","6144:l4vBRVo","6144:4vBRVoh","6144:vBRVoh7","6144:BRVoh78","6144:RVoh78o","6144:Voh78of","6144:oh78ofs","6144:h78ofsM","6144:78ofsMm","6144:8ofsMmw","6144:ofsMmw1","6144:fsMmw1b","6144:sMmw1b6","6144:Mmw1b69","6144:mw1b69U","6144:w1b69UE","6144:1b69UEw","6144:b69UEwr","6144:69UEwri","6144:9UEwrij","6144:UEwrijW","6144:EwrijW4","6144:wrijW4s","6144:rijW4sW","6144:ijW4sW3","6144:jW4sW3U","6144:W4sW3U/","6144:4sW3U/3","6144:sW3U/32","6144:W3U/32o","6144:3U/32oj","6144:U/32ojb","6144:/32ojbO","6144:32ojbOt","6144:2ojbOtq","6144:ojbOtqY","6144:jbOtqYs","12288:pawYQTQ","12288:awYQTQ3","12288:wYQTQ3j","12288:YQTQ3jt","12288:QTQ3jtG","12288:TQ3jtG7","12288:Q3jtG7E","12288:3jtG7EL","12288:jtG7EL8","12288:tG7EL8i","12288:G7EL8iX","12288:7EL8iXL","12288:EL8iXLS","12288:L8iXLSD","12288:8iXLSDh","12288:iXLSDhl","12288:XLSDhl4","12288:LSDhl4v","12288:SDhl4vB","12288:Dhl4vBR","12288:hl4vBRV","12288:l4vBRVo","12288:4vBRVoh","12288:vBRVoh7","12288:BRVoh78","12288:RVoh78o","12288:Voh78of","12288:oh78ofs","12288:h78ofsM","12288:78ofsMm","12288:8ofsMmw","12288:ofsMmw1","12288:fsMmw1b","12288:sMmw1b6","12288:Mmw1b69","12288:mw1b69U","12288:w1b69UE","12288:1b69UEw","12288:b69UEwr","12288:69UEwri","12288:9UEwrij","12288:UEwrijW","12288:EwrijW4","12288:wrijW4s","12288:rijW4sW","12288:ijW4sW3","12288:jW4sW3U","12288:W4sW3U/","12288:4sW3U/3","12288:sW3U/32","12288:W3U/32o","12288:3U/32oj","12288:U/32ojb","12288:/32ojbO","12288:32ojbOt","12288:2ojbOtq","12288:ojbOtqY","12288:jbOtqYs","6144:bNTQ3jt","6144:NTQ3jtj","6144:TQ3jtjp","6144:Q3jtjp2","6144:3jtjp2D","6144:jtjp2Dh","6144:tjp2Dh2","6144:jp2Dh2v","6144:p2Dh2vx","6144:2Dh2vxt","6144:Dh2vxtF","6144:h2vxtFd","6144:2vxtFdw","6144:vxtFdwL","6144:xtFdwLE","6144:tFdwLEm","6144:FdwLEmm","6144:dwLEmmW","6144:wLEmmW4","6144:LEmmW4N","6144:EmmW4N3","6144:mmW4N3m","6144:mW4N3m3","6144:W4N3m3C","6144:4N3m3CR","6144:N3m3CRs"],"imphash":"57e98d9a5a72c8d7ad8fb7a6a58b3daf"},"file_info":{"file_name":"E00499E21F9DCF77FC990400B8B3C2B5.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":429624,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1548612065000,"last_seen":1776548240000,"last_multi_scan":1776548240000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["criminal","flawedgrace","montyspider","servhelper","agent","modular","rat","credentialharvesting","gracefulspider"]},"stats":{"av":{"malicious_count":14,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":89},"sandbox_signatures":{"informative_count":202,"suspicious_count":31,"malicious_count":13,"total":246},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Malware/Win32.Trojanspy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.TA505","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-6","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/AD.TA505.fpvwx","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.Dropper.ZGQ","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Dropper.Delf-7551457-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.Dropper.ZGQ (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/Delf.BHC trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Riskware ( 0040eff71 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Spy-AUM","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Trojan.NEBO-9129","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Delf.Win32.111387","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Dropper","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Scripting","attack_id":"T1064","attack_id_wiki":"https://attack.mitre.org/techniques/T1064","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"}]},{"tactic":"Execution","technique":"Command-Line Interface","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Executes batch file"},{"type":"informative","value":"Runs shell commands"},{"type":"suspicious","value":"Detected suspicious script execution from temp folder"}],"sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/techniques/T1215","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"}]},{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/techniques/T1179","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Allocates virtual memory in a remote process"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"},{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1116","attack_id_wiki":"https://attack.mitre.org/techniques/T1116","identifiers":[{"type":"malicious","value":"The input sample is signed with an invalid certificate"},{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1107","attack_id_wiki":"https://attack.mitre.org/techniques/T1107","identifiers":[{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"},{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Queries for Borland Delphi related registry entry"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"suspicious","value":"Reads the active computer name"},{"type":"suspicious","value":"Reads information about supported languages"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Contains reference to Borland Delphi related registry entry"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Reads the registry for installed applications"},{"type":"suspicious","value":"Queries sensitive IE security settings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"},{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to query volume size"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Reads files"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Tries to access LNK files (Windows shortcut)"}],"sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"},{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Reads the windows installation date"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to get product type"}],"sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"suspicious","value":"Contains ability to open the clipboard"},{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"},{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"tactic":"Exfiltration","technique":"Data Compressed","attack_id":"T1002","attack_id_wiki":"https://attack.mitre.org/techniques/T1002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1120","identifiers":[{"type":"malicious","value":"Found an IP/URL artifact that was identified as malicious by a significant amount of reputation engines"}],"sources":[{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Contains ability to executes commands or batch file"}],"sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"tactic":"Execution","technique":"Visual Basic","attack_id":"T1059.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/005","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"The analysis extracted a file that was identified as malicious"},{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"tactic":"Persistence","technique":"Shortcut Modification","attack_id":"T1547.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/009","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"tactic":"Persistence","technique":"DLL","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","identifiers":[{"type":"informative","value":"Possible DLL sideloading"},{"type":"informative","value":"Potential hijacking of DLL execution flow detected"}],"sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"informative","value":"Calls an API typically used to remove a directory"}],"sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Able to manipulate a file/directory time format"}],"sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"suspicious","value":"Possibly tries to evade analysis by sleeping multiple times"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Contains reference to method used by Windows shell items (API string)"},{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains ability to disable Windows Defender using PowerShell"},{"type":"informative","value":"Contains ability to modify process attributes (API string)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"}],"sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"Dropped file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"}],"sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"suspicious","value":"Queries process mitigation policy via NtQueryInformationProcess"},{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"Triggers a burst of requests to the same API (API Hammering)"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"}],"sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Attempts to read volume data via DOS device path"}],"sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"},{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"tactic":"Defense Evasion","technique":"System Binary Proxy Execution","attack_id":"T1218","attack_id_wiki":"https://attack.mitre.org/techniques/T1218","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"tactic":"Defense Evasion","technique":"Rundll32","attack_id":"T1218.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1218/011","identifiers":[{"type":"malicious","value":"Detected Rundll32 process execution"}],"sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"informative","value":"Drops file with high entropy, indicating encryption/obfuscation"},{"type":"suspicious","value":"YARA signature match – Anomalous PE file structure"}],"sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"tactic":"Defense Evasion","technique":"Masquerade File Type","attack_id":"T1036.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/008","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","identifiers":[{"type":"suspicious","value":"Able to retrieve browser cookies using SQL"}],"sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"}],"sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"}],"sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"}],"sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","identifiers":[{"type":"informative","value":"Contains ability to retrieve SID for the specified name (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve configuration of a workstation (API string)"},{"type":"informative","value":"Contains ability to free the memory used by network management functions (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"suspicious","value":"Tries to access/write temporary files"},{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Writes log files"}],"sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"suspicious","value":"Calls an API possibly used to take screenshots"},{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Queries the display settings of system associated file extensions"},{"type":"informative","value":"Contains ability to copy files (API string)"},{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"tactic":"Collection","technique":"Data from Removable Media","attack_id":"T1025","attack_id_wiki":"https://attack.mitre.org/techniques/T1025","identifiers":[{"type":"informative","value":"Able to retrieve system driver type"}],"sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to transfer data using curl"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"informative","value":"Drops temp files"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential URLs in memory dumps"}],"sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Contains reference to Windows HTTP services (API string)"},{"type":"informative","value":"Calls an API typically used to send the specified request to the HTTP server"}],"sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"References server/domain address with port number"}],"sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"informative","value":"Contains ability to upload file/data"}],"sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \".ndata\" is zero\n Raw size of \"hut0\" is zero","origin":"Static Parser","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersion@KERNEL32.DLL at 00047269-00000748-24996-1-00403328","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceA@KERNEL32.DLL at 00047269-00000748-24996-86-00404605","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetVersion@KERNEL32.DLL directly followed by \"cmp ax, 00000006h\" and \"je 0040337Ah\" at 00047269-00000748-24996-1-00403328","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\".exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\C354467EC5D323FECF94D33BC05EAB65F90A916C39137D2B751B0E637CA5A3E4.EXE\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\C354467EC5D323FECF94D33BC05EAB65F90A916C39137D2B751B0E637CA5A3E4.EXE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"},{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"afsssdrfrm.pw\"\n \"vesecase.com\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\".exe\" created file \"%TEMP%\\nsk4DDD.tmp\"\n \".exe\" created file \"%TEMP%\\htpd.dat\"\n \".exe\" created file \"%TEMP%\\rds.vbs\"\n \".exe\" created file \"%TEMP%\\2.lnk\"\n \".exe\" created file \"%TEMP%\\nsq4FD2.tmp\\System.dll\"\n \".exe\" created file \"%TEMP%\\help.bat\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\rsdasfasaasfxfa\"\n \"Global\\rsdasfasaasfxfa\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"},{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\".exe\" touched \"Computer\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\SHELLFOLDER\")\n \".exe\" touched \"Memory Mapped Cache Mgr\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\")\n \".exe\" touched \"Shortcut\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{00021401-0000-0000-C000-000000000046}\")","origin":"Registry Access","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"},{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"cmd.exe\" (UID: 00047477-00002776) was launched with modified environment variables: \"CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles\"\n Process \"cmd.exe\" (UID: 00047477-00002776) was launched with missing environment variables: \"PROCESSOR_ARCHITEW6432\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"/c %TEMP%\\help.bat\" on 2019-9-2.08:53:23.190","origin":"Monitored Target","mitre_attack_id":"T1059","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"wscript.exe\" with commandline \"\"wscript\" \"%TEMP%\\rds.vbs\"\" (UID: 00047447-00002488)\n Spawned process \"cmd.exe\" with commandline \"/c %TEMP%\\help.bat\" (UID: 00047477-00002776)\n Spawned process \"rundll32.exe\" with commandline \"%TEMP%\\htpd.dat, bogus\" (UID: 00047482-00002568)\n Spawned process \"rundll32.exe\" with commandline \"%TEMP%\\htpd.dat, bogus\" (UID: 00047537-00002388)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"},{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"wscript.exe\" with commandline \"\"wscript\" \"%TEMP%\\rds.vbs\"\" (UID: 00047447-00002488)\n Spawned process \"cmd.exe\" with commandline \"/c %TEMP%\\help.bat\" (UID: 00047477-00002776)\n Spawned process \"rundll32.exe\" with commandline \"%TEMP%\\htpd.dat, bogus\" (UID: 00047482-00002568)\n Spawned process \"rundll32.exe\" with commandline \"%TEMP%\\htpd.dat, bogus\" (UID: 00047537-00002388)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"},{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB\" (SHA1: 26:0C:8D:47:00:3C:A3:8A:F0:54:53:F5:96:7A:8E:03:85:7F:04:88; see report for more information)\n The input sample is signed with a certificate issued by \"CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB\" (SHA1: B6:9E:75:2B:BE:88:B4:45:82:00:A7:C0:F4:F5:B3:CC:E6:F3:5B:47; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1116","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\".exe\" connecting to \"\\ThemeApiPort\"\n \"rundll32.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"rds.vbs\" has type \"ASCII text with no line terminators\"\n \"System.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"2.lnk\" has type \"MS Windows shortcut Item id list present Has Relative path Has Working directory ctime=Mon Jan 1 00:00:00 1601 mtime=Mon Jan 1 00:00:00 1601 atime=Mon Jan 1 00:00:00 1601 length=0 window=hide\"\n \"help.bat\" has type \"ASCII text with no line terminators\"\n \"nsk4DDD.tmp\" has type \"data\"\n \"htpd.dat\" has type \"PE32 executable (DLL) (console) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"},{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$25","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"},{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://nsis.sf.net/NSIS_Error\"\n Pattern match: \"https://secure.comodo.net/CPS0C\"\n Pattern match: \"crl.comodoca.com/COMODORSACodeSigningCA.crl0t\"\n Pattern match: \"crt.comodoca.com/COMODORSACodeSigningCA.crt0$\"\n Pattern match: \"http://ocsp.comodoca.com0\"\n Pattern match: \"http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q\"\n Pattern match: \"http://crt.comodoca.com/COMODORSAAddTrustCA.crt0$\"\n Heuristic match: \"afsssdrfrm.pw\"\n Heuristic match: \"vesecase.com\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"},{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"rundll32.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"},{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\".exe\" opened \"\\Device\\KsecDD\"\n \"rundll32.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1215","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"},{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"htpd.dat\" was detected as \"ACProtect v1.3x - v1.4x DLL -> Risco Software Inc.\"","origin":"Static Parser","mitre_attack_id":"T1002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":"hut1 with unusual entropies 7.99920135478","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to measure performance","description":"rdtsc at 28168-296-00583763","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-6","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to evade analysis by sleeping many times","description":"\"rundll32.exe\" (Thread ID: 1608) slept \"520\" times (threshold: 500)","origin":"API Call","relevance":10,"id":"api-47","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"rundll32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"},{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"suspicious","category":"Environment Awareness","name":"Tries to sleep for a long time (more than two minutes)","description":"\"rundll32.exe\" sleeping for \"00120000\" milliseconds","origin":"API Call","relevance":10,"id":"api-24","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"6/69 reputation engines marked \"http://afsssdrfrm.pw\" as malicious (8% detection rate)\n 7/66 reputation engines marked \"http://vesecase.com\" as malicious (10% detection rate)\n 1/71 reputation engines marked \"http://nsis.sf.net\" as malicious (1% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\".exe\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"\n \".exe\" read file \"C:\\Users\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"System.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"htpd.dat\" has type \"PE32 executable (DLL) (console) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"},{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"suspicious","category":"Network Related","name":"Contacts Random Domain Names","description":"\"afsssdrfrm.pw\" seems to be random","origin":"Network Traffic","relevance":5,"id":"network-6","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to open the clipboard","description":"OpenClipboard@USER32.DLL at 00047269-00000748-24996-96-00405339","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1115","relevance":10,"id":"stream-0","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"C:\\c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe\" marked \"%TEMP%\\nse4DBC.tmp\" for deletion\n \"C:\\c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe\" marked \"%TEMP%\\nsq4FD2.tmp\" for deletion\n \"C:\\c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe\" marked \"%TEMP%\\nsq4FD2.tmp\\System.dll\" for deletion","origin":"API Call","mitre_attack_id":"T1107","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\".exe\" opened \"%TEMP%\\nse4DBC.tmp\" with delete access\n \".exe\" opened \"%TEMP%\\nsq4FD2.tmp\" with delete access\n \".exe\" opened \"%TEMP%\\nsq4FD2.tmp\\System.dll\" with delete access\n \".exe\" opened \"%TEMP%\\nsq4FD2.tmp\\\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"},{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"wscript.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"wscript.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"},{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"System.dll\" claimed CRC 0 while the actual is CRC 486934\n \"htpd.dat\" claimed CRC 439010 while the actual is CRC 38559","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"htpd.dat\" has an entrypoint in section \"hut1\"","origin":"Static Parser","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegDeleteKeyA\n RegCloseKey\n OpenProcessToken\n RegDeleteValueA\n RegCreateKeyExA\n RegOpenKeyExA\n RegEnumKeyA\n GetFileAttributesA\n CopyFileA\n GetModuleFileNameA\n LoadLibraryExA\n GetFileSize\n CreateDirectoryA\n DeleteFileA\n GetCommandLineA\n GetProcAddress\n GetTempPathA\n CreateThread\n GetModuleHandleA\n FindFirstFileA\n WriteFile\n GetTempFileNameA\n FindNextFileA\n CreateProcessA\n Sleep\n CreateFileA\n GetTickCount\n ShellExecuteExA\n FindWindowExA\n VirtualProtect\n VirtualAlloc\n LoadLibraryA\n ShellExecuteW","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$26","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"rundll32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"},{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"49/70 Antivirus vendors marked sample as malicious (70% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"},{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"49/70 Antivirus vendors marked sample as malicious (70% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"},{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"16/56 Antivirus vendors marked dropped file \"rds.vbs\" as malicious (classified as \"Trojan.Script\" with 28% detection rate)\n 2/80 Antivirus vendors marked dropped file \"System.dll\" as malicious (classified as \"suspicious.low.ml\" with 2% detection rate)\n 53/68 Antivirus vendors marked dropped file \"htpd.dat\" as malicious (classified as \"Trojan.Delf\" with 77% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"},{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"malicious","category":"General","name":"The input sample is signed with an invalid certificate","description":"Error: A certificate was explicitly revoked by its issuer. (0x800b010c)","origin":"Certificate Data","mitre_attack_id":"T1116","relevance":10,"id":"certificate-1","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in a remote process","description":"\".exe\" allocated memory in \"%TEMP%\\nsq4FD2.tmp\"\n \"cmd.exe\" allocated memory in \"\\Device\\MountPointManager\"\n \"rundll32.exe\" allocated memory in \"%TEMP%\\htpd.dat\"","origin":"API Call","mitre_attack_id":"T1055","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"$27","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"},{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Checks for a resource fork (ADS) file","description":"\"wscript.exe\" checked file \"C:\"","origin":"API Call","relevance":5,"id":"api-35","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system","description":"ExitWindowsEx@USER32.DLL at 00047269-00000748-24996-1-00403328","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-23","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtdllDefWindowProc_A@NTDLL.DLL at 00047269-00000748-24996-75-00401000","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"rds.vbs\" as clean (type is \"ASCII text with no line terminators\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"},{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"General","name":"The input sample is signed with a valid certificate","description":"The entire certificate chain of the input sample was validated successfully.","origin":"Certificate Data","relevance":10,"id":"certificate-2","sources":[{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"}]},{"level":"suspicious","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET DNS Query to a *.pw domain - Likely Hostile\" (SID: 2016778, Rev: 4, Severity: 2) categorized as \"Potentially Bad Traffic\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-1","sources":[{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"}]},{"level":"malicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by a significant amount of reputation engines","description":"8/67 reputation engines marked \"http://vesecase.com\" as malicious (11% detection rate)","origin":"External System","mitre_attack_id":"T1120","relevance":10,"id":"avtest-7","sources":[{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; Source: \"00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"wscript.exe\" called \"FindResourceW\" with parameter \"7\" - (UID: 00000000-00003332)\n \"wscript.exe\" called \"FindResourceW\" with parameter \"63\" - (UID: 00000000-00003332)\n \"wscript.exe\" called \"FindResourceW\" with parameter \"64\" - (UID: 00000000-00003332)\n \"wscript.exe\" called \"FindResourceW\" with parameter \"8\" - (UID: 00000000-00003332)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"wscript.exe\" called \"LoadResource with parameter {'hModule': '2013388865537', 'hResInfo': '2013388873952'}\" (UID: 00000000-00003332)\n \"wscript.exe\" called \"LoadResource with parameter {'hModule': '2013388865537', 'hResInfo': '2013388873984'}\" (UID: 00000000-00003332)\n \"wscript.exe\" called \"LoadResource with parameter {'hModule': '2013388865537', 'hResInfo': '2013388874000'}\" (UID: 00000000-00003332)\n \"wscript.exe\" called \"LoadResource with parameter {'hModule': '2013388865537', 'hResInfo': '2013388873968'}\" (UID: 00000000-00003332)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to remove a directory","description":"\"c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe\" called \"RemoveDirectoryA\" with parameter %TEMP%\\nsh239D.tmp\\ (UID: 00000000-00003720)","origin":"API Call","mitre_attack_id":"T1070.004","relevance":3,"id":"api-121","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4\")\n Found reference to API \"NtOpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00003540.00000000.298973.45B09000.00000002.mdmp\")\n Found reference to API \"NtOpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00005504.00000000.299031.002FA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; Source: \"00000000-00003332.00000000.298704.8F813000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcA\" (Indicator: \"CallWindowProc\"; File: \"c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\.\\GlobalRoot\\SystemRoot\\Defender Duplication Data; Source: \"00000000-00003332.00000000.298704.C7337000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$2c","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2d","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Triggers a burst of requests to the same API (API Hammering)","description":"\"rundll32.exe\" obfuscates its traffic by mimicking legitimate API call","origin":"API Call","mitre_attack_id":"T1497","relevance":5,"id":"api-289","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.96208","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: Drops file with high entropy\n indicating encryption/obfuscation\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2f","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00003540.00000000.298973.45B09000.00000002.mdmp\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005504.00000000.299031.002FA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00003540.00000000.298973.45B09000.00000002.mdmp\")\n Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005504.00000000.299031.002FA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"$30","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Environment Awareness","name":"Able to manipulate a file/directory time format","description":"Found string \"DateLastModified\" (Indicator: \"datelastmodified\"; Source: \"00000000-00003332.00000000.298704.C7337000.00000004.mdmp\")\n Found string \"DateLastModified@\" (Indicator: \"datelastmodified\"; Source: \"00000000-00003332.00000000.298704.D6734000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-778","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system driver type","description":"Found string \"ystem.Home.DriveType\" (Indicator: \".drivetype\"; Source: \"00000000-00003332.00000000.298704.C9080000.00000002.mdmp\")\n Found string \"System.Home.DriveType\" (Indicator: \".drivetype\"; Source: \"00000000-00003332.00000000.298704.C96B0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1025","relevance":1,"id":"string-713","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"SendMessageA\" (Indicator: \"sendmessage\"; File: \"c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4\")\n Found reference to API \"FindWindowExA\" (Indicator: \"findwindow\"; File: \"c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4\")\n Found reference to API \"SendMessageTimeoutA\" (Indicator: \"sendmessage\"; File: \"c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4\")\n Found reference to API \"SendMessageA\" (Indicator: \"sendmessage\"; Source: \"00000000-00003332.00000000.298704.D672D000.00000002.mdmp\")\n Found reference to API \"PostMessageA\" (Indicator: \"postmessage\"; Source: \"00000000-00003332.00000000.298704.D672D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00003720)\n \"wscript.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00003332)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"wscript.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00003332)\n \"cmd.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00002432)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00003720)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"wscript.exe\" called \"GetForegroundWindow\" (UID: 00000000-00003332)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"wscript.exe\" called \"EnumWindows\" with parameter \"73368858144\" - (UID: 00000000-00003332)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00003720)\n \"wscript.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00003332)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$35","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$36","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"wscript.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00003332)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"wscript.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00003332)\n \"wscript.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00003332)\n \"rundll32.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00005504)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process2\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00003540.00000000.298973.45B09000.00000002.mdmp\")\n Found reference to API \"IsWow64Process2\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00005504.00000000.299031.002FA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowExA\" (Indicator: \"FindWindowExA\"; File: \"c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"$38","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve configuration of a workstation (API string)","description":"Found reference to API \"NetWkstaGetInfo\" (Indicator: \"NetWkstaGetInfo\"; Source: \"00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-451","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00003332.00000000.298704.8F813000.00000002.mdmp, 00000000-00003332.00000000.298704.D672D000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00003540.00000000.298973.45B09000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00005504.00000000.299031.002FA000.00000002.mdmp\")\n Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; Source: \"00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"$39","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformationForYear\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp\")\n Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"FindWindowExA\" (Indicator: \"FindWindow\"; File: \"c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4\")\n Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; Source: \"00000000-00003332.00000000.298704.D672D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; File: \"c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Environment Awareness","name":"Contains reference to Borland Delphi related registry entry","description":"\"Software\\Borland\\Delphi\\Locales\" (Indicator: \"\\borland\\delphi\\locales\") in Source: 00000000-00005504.00000000.299031.044D1000.00000040.mdmp\n 00000000-00005504.00000001.300951.044D1000.00000040.mdmp\n 00000000-00005504.00000002.302872.044D1000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-324","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Environment Awareness","name":"Possible DLL sideloading","description":"Possible dll side loading: %TEMP%\\NSH239D.TMP\\SYSTEM.DLL","origin":"Indicator Combinations","mitre_attack_id":"T1574.001","relevance":5,"id":"summary-47","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"\"rundll32.exe\" (Access type: \"QUERY\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\"; Key: \"\"; Value: \"\")\n \"rundll32.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\\{45F5205B-FA7A-11ED-8886-806E6F6E6963}\"; Key: \"ENABLEDHCP\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Environment Awareness","name":"Queries for Borland Delphi related registry entry","description":"\"rundll32.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\BORLAND\\DELPHI\\LOCALES\"; Key: \"\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-138","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"cmd.exe\" queries volume information of an entire harddrive\"C:\\\" at 00000000-00002432-00000C17-3633971095","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"wscript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"wscript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00003332.00000000.298704.8F813000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileA\" (Indicator: \"MoveFileA\"; File: \"c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4\")\n Found string \"MoveFileExA\" (Indicator: \"MoveFileExA\"; File: \"c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00003332.00000000.298704.8F813000.00000002.mdmp, 00000000-00003332.00000000.298704.D672D000.00000002.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00003540.00000000.298973.45B09000.00000002.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00005504.00000000.299031.002FA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$3c","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe\" called \"CreateProcessA\" with parameter \"\"wscript\" \"%TEMP%\\rds.vbs\"\" - (UID: 00000000-00003720)\n \"wscript.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\cmd.exe\" /c %TEMP%\\help.bat\" - (UID: 00000000-00003332)\n \"cmd.exe\" called \"CreateProcessW\" with parameter \"rundll32.exe %TEMP%\\htpd.dat, bogus\" - (UID: 00000000-00002432)\n \"rundll32.exe\" called \"CreateProcessW\" with parameter \"rundll32.exe %TEMP%\\htpd.dat, bogus\" - (UID: 00000000-00003540)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$3d","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$3e","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"rundll32.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00003332.00000000.298704.8F813000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"General","name":"Contains ability to copy files (API string)","description":"Found reference to API \"CopyFile\" (Indicator: \"CopyFile\"; Source: \"00000000-00003332.00000000.298704.C7337000.00000004.mdmp, 00000000-00003332.00000000.298704.C7363000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1005","relevance":1,"id":"string-449","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; File: \"c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"$40","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00003332.00000000.298704.8F813000.00000002.mdmp, 00000000-00003332.00000000.298704.D672D000.00000002.mdmp\")\n Found reference to API \"RegUnLoadKeyW\" (Indicator: \"RegUnLoadKey\"; Source: \"00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"details too long to display","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteExA\" (Indicator: \"ShellExecute\"; File: \"c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4\")\n Found reference to API \"yncShellExecute\" (Indicator: \"ShellExecute\"; Source: \"00000000-00003332.00000000.298704.C7399000.00000004.mdmp\")\n Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"General","name":"Contains ability to executes commands or batch file","description":"Found string \"cmd.exe /C\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-174","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; Source: \"00000000-00003332.00000000.298704.8F813000.00000002.mdmp\")\n Found reference to API \"LockResource\" (Indicator: \"LockResource\"; Source: \"00000000-00003332.00000000.298704.8F813000.00000002.mdmp\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00003332.00000000.298704.8F813000.00000002.mdmp, 00000000-00003332.00000000.298704.D672D000.00000002.mdmp\")\n Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; Source: \"00000000-00003332.00000000.298704.8F813000.00000002.mdmp\")\n Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; Source: \"00000000-00003332.00000000.298704.D672D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileA\" (Indicator: \"MoveFile\"; File: \"c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4\")\n Found reference to API \"MoveFileExA\" (Indicator: \"MoveFile\"; File: \"c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4\")\n Found reference to API \"MoveFile\" (Indicator: \"MoveFile\"; Source: \"00000000-00003332.00000000.298704.C7337000.00000004.mdmp, 00000000-00003332.00000000.298704.C7363000.00000004.mdmp, 00000000-00003332.00000000.298704.D6734000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00003332.00000000.298704.8F813000.00000002.mdmp, 00000000-00003332.00000000.298704.D672D000.00000002.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00003332.00000000.298704.8F813000.00000002.mdmp, 00000000-00003332.00000000.298704.D672D000.00000002.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00003540.00000000.298973.45B09000.00000002.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005504.00000000.299031.002FA000.00000002.mdmp, 00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"$41","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"$42","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"General","name":"Contains reference to method used by Windows shell items (API string)","description":"Found reference to API \"SHFileOperationA\" (Indicator: \"SHFileOperation\"; File: \"c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-269","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$43","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"General","name":"Executes batch file","description":"Process \"cmd.exe\" with commandline \"/c %TEMP%\\\\help.bat\" (UID: 00000000-00002432)","origin":"Monitored Target","mitre_attack_id":"T1059","relevance":3,"id":"target-220","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\"rundll32.exe\" failed to load missing module \"%TEMP%\\htpd.dat\" - [base:0; Status:c000007b]","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"System.dll\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$44","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$45","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"wscript.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 8F860000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 77430000\n \"wscript.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 9CFF0000\n \"rundll32.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 9CFF0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76030000\n \"wscript.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 9EF60000\n \"cmd.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 9EF60000\n \"rundll32.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 9EF60000\n \"rundll32.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76030000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a00000000002042eb9cf97f0000@ntdll.dll\"\n \"22002300000000004042eb9cf97f0000@ntdll.dll\"\n \"110012000000000060990e8ef97f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4\" was detected as \"Nullsoft Scriptable Install System\" and name: \"Installer\"\n \"c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"System.dll\" was detected as \"Nullsoft Scriptable Install System\" and name: \"Installer\"\n \"System.dll\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"htpd.dat\" was detected as \"Nullsoft Scriptable Install System\" and name: \"Installer\"\n \"htpd.dat\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"\\Device\\HarddiskVolume3\\Windows\\System32\\cmd.exe\" [Source: 00000000-00003332-00000BC1-3632734914]\n Observed system executable string:\"%WINDIR%\\System32\\cmd.exe\" [Source: 00000000-00003332-00000C47-6438046252]\n Observed system executable string:\"\"%WINDIR%\\System32\\cmd.exe\" /c %TEMP%\\help.bat\" [Source: 00000000-00003332-00000C47-6438046252]\n Observed system executable string:\"%WINDIR%\\system32\\rundll32.exe\" [Source: 00000000-00002432-00000C47-2478003992]\n Observed system executable string:\"\\Device\\HarddiskVolume3\\Windows\\System32\\conhost.exe\" [Source: 00000000-00002432-00000BC0-3632895206]\n Observed system executable string:\"\\Device\\HarddiskVolume3\\Windows\\System32\\rundll32.exe\" [Source: 00000000-00002432-00000BC0-3634003031]\n Observed system executable string:\"%WINDIR%\\SysWOW64\\rundll32.exe\" [Source: 00000000-00003540-00000C47-1863280390]\n Observed system executable string:\"\\Device\\HarddiskVolume3\\Windows\\SysWOW64\\rundll32.exe\" [Source: 00000000-00003540-00000BC0-3634889121]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"afsssdrfrm.pw\"\n \"vesecase.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"wscript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$46","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"System.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"htpd.dat\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsr2206.tmp\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"$47","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"wscript.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"rundll32.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"\"nsr2206.tmp\" has type \"data\" - Location: [%TEMP%\\nsr2206.tmp]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$48","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Installation/Persistence","name":"Potential hijacking of DLL execution flow detected","description":"\"System.dll\" has type \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections\"- Location: [%TEMP%\\nsh239D.tmp\\System.dll]- [targetUID: 00000000-00003720]","origin":"Binary File","mitre_attack_id":"T1574.001","relevance":5,"id":"binary-91","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe\" queries basic process information of the \"C:\\c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe\" (UID: 3720)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$49","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe\" reads file \"c:\\c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)\n Matched sigs: Possibly tries to evade analysis by sleeping multiple times\n Matched sigs: Triggers a burst of requests to the same API (API Hammering)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$4a","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access LNK files (Windows shortcut)","description":"\"c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe\" trying to access LNK file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\2.lnk\"\n \"c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe\" trying to access LNK file \"%TEMP%\\2.lnk\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-203","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$4b","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$4c","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\nsr2206.tmp\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\htpd.dat\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"Found string \"/c ping localhost -n 30 > nul & del\" (Indicator: \"/c ping\"; Source: \"00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":7,"id":"string-417","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to send the specified request to the HTTP server","description":"$4d","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-190","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"WinHttpOpenRequest\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; Source: \"00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Network Related","name":"Contains ability to transfer data using curl","description":"Observed string: \"curl\" (Indicator: \"curl\") in Source: 00000000-00005504.00000000.299031.044D1000.00000040.mdmp\n 00000000-00005504.00000001.300951.044D1000.00000040.mdmp\n 00000000-00005504.00000002.302872.044D1000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-576","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Network Related","name":"Contains ability to upload file/data","description":"Found string \"Content-Disposition: form-data; name=\"\"; Source: \"00000000-00005504.00000000.299031.044D1000.00000040.mdmp\n 00000000-00005504.00000001.300951.044D1000.00000040.mdmp\n 00000000-00005504.00000002.302872.044D1000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1041","relevance":1,"id":"string-511","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows HTTP services (API string)","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-323","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"file/memory contains long string with (Indicator: \" connect \"; Source: \"00000000-00003332.00000000.298704.D6734000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"192.168.0.2\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$50","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"HTTP/1.0\" (Indicator: \"HTTP/1.0\"; Source: \"00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp\")\n Found string \"HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.05359000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://secure.comodo.net\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Network Related","name":"References server/domain address with port number","description":"Found ip/domain with port number \"http://direct:80\"","origin":"Indicator Combinations","mitre_attack_id":"T1571","id":"summary-25","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"B+ncalrpc:[OLE97C73E66D38A836D3702DC886E59]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00003332.00000000.298704.C7300000.00000004.mdmp\")\n Found string \"9ncalrpc:[epmapper,Security=Impersonation Dynamic False]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00003332.00000000.298704.C7399000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE97C73E66D38A836D3702DC886E59]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00003332.00000000.298704.C7399000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"icrosoft Kerberos V1.0\" (Indicator: \"kerberos\"; Source: \"00000000-00005504.00000000.299031.026F0000.00000004.mdmp, 00000000-00005504.00000001.300951.026F0000.00000004.mdmp, 00000000-00005504.00000002.302872.026F0000.00000004.mdmp\")\n Found string \":\\WINDOWS\\SysWOW64\\Kerberos.DLL\" (Indicator: \"kerberos\"; Source: \"00000000-00005504.00000000.299031.026F0000.00000004.mdmp, 00000000-00005504.00000001.300951.026F0000.00000004.mdmp, 00000000-00005504.00000002.302872.026F0000.00000004.mdmp\")\n Found string \"Microsoft Kerberos V1.0\" (Indicator: \"kerberos\"; Source: \"00000000-00005504.00000000.299031.026F0000.00000004.mdmp, 00000000-00005504.00000001.300951.026F0000.00000004.mdmp, 00000000-00005504.00000002.302872.026F0000.00000004.mdmp\")\n Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00005504.00000000.299031.026F0000.00000004.mdmp, 00000000-00005504.00000001.300951.026F0000.00000004.mdmp, 00000000-00005504.00000002.302872.026F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"GetDC\" (Indicator: \"GetDC\"; File: \"c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00003332.00000000.298704.8F813000.00000002.mdmp\")\n Found reference to API \"1861153974,3152,3024,,RtlGetVersion,NTDLL.dll,\"01:17:47.359\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00003540.00000001.300893.1B7D0000.00000004.mdmp, 00000000-00003540.00000002.302812.1B7D0000.00000004.mdmp\")\n Found reference to API \"5094059046,5840,3025,,RtlGetNtProductType,NTDLL.dll,\"01:18:44.609\",RX=0,PX=0\" (Indicator: \"RtlGetNtProductType\"; Source: \"00000000-00005044.00000000.302550.97C80000.00000004.mdmp\")\n Found reference to API \"3545031200,1908,3025,,RtlGetNtProductType,NTDLL.dll,\"01:20:05.437\",RX=0,PX=0\" (Indicator: \"RtlGetNtProductType\"; Source: \"00000000-00005332.00000000.307756.017F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"$51","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"$52","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to read volume data via DOS device path","description":"\"c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe\" tries to directly access volume data \"Z:\"","origin":"API Call","mitre_attack_id":"T1006","relevance":1,"id":"api-306","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$53","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"wscript.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"cmd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"rundll32.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"rundll32.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$54","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; File: \"c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"$55","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$56","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00003540.00000000.298973.45B09000.00000002.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00005504.00000000.299031.002FA000.00000002.mdmp, 00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve SID for the specified name (API string)","description":"Found reference to API \"LookupAccountNameW\" (Indicator: \"LookupAccountName\"; Source: \"00000000-00003332.00000000.298704.D672D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1087","relevance":1,"id":"string-452","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"$57","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4\")\n file/memory contains long string with (Indicator: \"GetProcAddress\"; File: \"System.dll\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00003332.00000000.298704.8F813000.00000002.mdmp, 00000000-00003332.00000000.298704.D672D000.00000002.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00003540.00000000.298973.45B09000.00000002.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00005504.00000000.299031.002FA000.00000002.mdmp, 00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$58","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"$59","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00003332.00000000.298704.D672D000.00000002.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00003540.00000000.298973.45B09000.00000002.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00005504.00000000.299031.002FA000.00000002.mdmp, 00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00003332.00000000.298704.8F813000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"Scheme \"%s\" is not registered#Credential without user or password+Platform-dependant function not implemented)Scheme-dependant function not implemented\" (Indicator: \"password\"; Source: \"00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"/c ping localhost -n 30 > nul & del\" (Indicator: \"ping\"; Source: \"00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"$5a","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$5b","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"ImpersonateLoggedOnUser\" (Indicator: \"ImpersonateLoggedOnUser\"; Source: \"00000000-00003332.00000000.298704.D672D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; File: \"c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4\")\n Found reference to API \"RemoveDirectoryA\" (Indicator: \"RemoveDirectory\"; File: \"c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4\")\n Found reference to API \"DeleteFileWW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00003332.00000000.298704.C7337000.00000004.mdmp, 00000000-00003332.00000000.298704.C7363000.00000004.mdmp\")\n Found reference to API \"DeleteFileWWL\" (Indicator: \"DeleteFile\"; Source: \"00000000-00003332.00000000.298704.D6734000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"System Security","name":"Contains ability to disable Windows Defender using PowerShell","description":"Found string \"DisableRealtimeMonitoring\" (Indicator: \"disablerealtimemonitoring\"; Source: \"00000000-00003332.00000000.298704.8F813000.00000002.mdmp\")\n Found string \"DisableIOAVProtection\" (Indicator: \"disableioavprotection\"; Source: \"00000000-00003332.00000000.298704.8F813000.00000002.mdmp\")\n Found string \"DisableScriptScanning\" (Indicator: \"disablescriptscanning\"; Source: \"00000000-00003332.00000000.298704.8F813000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-748","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; File: \"c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4\")\n Found reference to API \"LookupPrivilegeValueA\" (Indicator: \"LookupPrivilegeValue\"; File: \"c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4\")\n Found reference to API \"SeShutdownPrivilege\" (Indicator: \"SeShutdownPrivilege\"; File: \"c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesA\" (Indicator: \"SetFileAttributes\"; File: \"c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify process attributes (API string)","description":"Found reference to API \"InitializeProcThreadAttributeList\" (Indicator: \"InitializeProcThreadAttributeList\"; Source: \"00000000-00003540.00000000.298973.45B09000.00000002.mdmp\")\n Found reference to API \"UpdateProcThreadAttribute\" (Indicator: \"UpdateProcThreadAttribute\"; Source: \"00000000-00003540.00000000.298973.45B09000.00000002.mdmp\")\n Found reference to API \"InitializeProcThreadAttributeList\" (Indicator: \"InitializeProcThreadAttributeList\"; Source: \"00000000-00005504.00000000.299031.002FA000.00000002.mdmp\")\n Found reference to API \"SetProcessMitigationPolicy\" (Indicator: \"SetProcessMitigationPolicy\"; Source: \"00000000-00005504.00000000.299031.002FA000.00000002.mdmp\")\n Found reference to API \"UpdateProcThreadAttribute\" (Indicator: \"UpdateProcThreadAttribute\"; Source: \"00000000-00005504.00000000.299031.002FA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-402","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; File: \"c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"ImpersonateLoggedOnUser\" (Indicator: \"ImpersonateLoggedOnUser\"; Source: \"00000000-00003332.00000000.298704.D672D000.00000002.mdmp\")\n Found reference to API \"InitializeSecurityDescriptor\" (Indicator: \"InitializeSecurityDescriptor\"; Source: \"00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp\")\n Found reference to API \"SetSecurityDescriptorDacl\" (Indicator: \"SetSecurityDescriptorDacl\"; Source: \"00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"$5c","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00003332.00000000.298704.8F813000.00000002.mdmp, 00000000-00003332.00000000.298704.D672D000.00000002.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$5d","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$5e","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to free the memory used by network management functions (API string)","description":"Found reference to API \"NetApiBufferFree\" (Indicator: \"NetApiBufferFree\"; Source: \"00000000-00005504.00000000.299031.044D1000.00000040.mdmp, 00000000-00005504.00000001.300951.044D1000.00000040.mdmp, 00000000-00005504.00000002.302872.044D1000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-223","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; File: \"c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4\")\n Found reference to API \"InitiateShutdownA\" (Indicator: \"InitiateShutdown\"; File: \"c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4\")","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"$5f","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"System.dll\" has type \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections\"- Location: [%TEMP%\\nsh239D.tmp\\System.dll]- [targetUID: 00000000-00003720]\n \"htpd.dat\" has type \"PE32 executable for MS Windows 5.00 (DLL) Intel i386 3 sections\"- Location: [%TEMP%\\htpd.dat]- [targetUID: 00000000-00005504]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops file with high entropy, indicating encryption/obfuscation","description":"\"nsr2206.tmp has high entropy\"","origin":"Binary File","mitre_attack_id":"T1027.013","relevance":3,"id":"binary-90","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$60","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"rundll32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Dropped file has high entropy (likely encrypted/compressed content)","description":"Dropped file \"%TEMP%\\nsr2206.tmp\" has high entropy 7.95657\n Dropped file \"%TEMP%\\htpd.dat\" has high entropy 7.99408","origin":"Binary File","mitre_attack_id":"T1027","relevance":5,"id":"binary-60","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to evade analysis by sleeping multiple times","description":"\"rundll32.exe\" (Thread ID: 3700) slept \"525\" times (threshold: 500)","origin":"API Call","mitre_attack_id":"T1497.003","relevance":10,"id":"api-47","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"suspicious","category":"Environment Awareness","name":"Queries process mitigation policy via NtQueryInformationProcess","description":"\"C:\\Windows\\System32\\wscript.exe\" queried ProcessMitigationPolicy\n \"C:\\Windows\\System32\\cmd.exe\" queried ProcessMitigationPolicy\n \"C:\\Windows\\System32\\rundll32.exe\" queried ProcessMitigationPolicy","origin":"API Call","mitre_attack_id":"T1497.001","relevance":3,"id":"api-323","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"suspicious","category":"General","name":"Detected suspicious script execution from temp folder","description":"Process \"wscript.exe\" with commandline \"\"wscript\" \"%TEMP%\\\\rds.vbs\"\" (UID: 00000000-00003332)","origin":"Monitored Target","mitre_attack_id":"T1059","relevance":5,"id":"target-224","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe\" reads file \"C:\\Users\\desktop.ini\"\n \"wscript.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"wscript.exe\" reads file \"C:\\Users\\%OSUSER%\\Documents\\desktop.ini\"\n \"wscript.exe\" reads file \"C:\\Users\\%OSUSER%\\Music\\desktop.ini\"\n \"wscript.exe\" reads file \"C:\\Users\\%OSUSER%\\Pictures\\desktop.ini\"\n \"wscript.exe\" reads file \"C:\\Users\\%OSUSER%\\Videos\\desktop.ini\"\n \"wscript.exe\" reads file \"C:\\Users\\%OSUSER%\\Downloads\\desktop.ini\"\n \"wscript.exe\" reads file \"C:\\Users\\%OSUSER%\\OneDrive\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"\"c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe\" wrote 16384 bytes starting with PE header signature to file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\htpd.dat\": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ...\n \"c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe\" wrote 11776 bytes starting with PE header signature to file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsh239D.tmp\\System.dll\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – Anomalous PE file structure","description":"YARA signature for null IAT Directory of PE file \"htpd.dat\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":1,"id":"yara-153","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Able to retrieve browser cookies using SQL","description":"Found string \":\\Users\\I9ivdOb\\AppData\\Local\\Microsoft\\Windows\\INetCookies\" (Source: \"00000000-00003332.00000000.298704.C7399000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1539","relevance":1,"id":"string-692","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\"c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"10a0e\"\n \"cx\": \"32\"\n \"cy\": \"32\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":5,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Tries to access/write temporary files","description":"Process \"%WINDIR%\\System32\\cmd.exe\" with commandline \"/c %TEMP%\\\\help.bat\" (UID: 00000000-00002432)","origin":"Monitored Target","mitre_attack_id":"T1074.001","relevance":5,"id":"target-423","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"wscript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"suspicious","category":"System Security","name":"Queries the display settings of system associated file extensions","description":"\"wscript.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\"; Key: \"ALWAYSSHOWEXT\")\n \"wscript.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\"; Key: \"NEVERSHOWEXT\")","origin":"Registry Access","mitre_attack_id":"T1005","relevance":7,"id":"registry-47","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"wscript.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\cmd.exe\" /c %TEMP%\\help.bat\" - (UID: 00000000-00003332)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Detected Rundll32 process execution","description":"Process \"rundll32.exe\" with commandline \"%TEMP%\\\\htpd.dat, bogus\" (UID: 00000000-00003540)\n Process \"rundll32.exe\" with commandline \"%TEMP%\\\\htpd.dat, bogus\" (UID: 00000000-00005504)\n Process \"rundll32.exe\" with commandline \"%WINDIR%\\\\system32\\\\PcaSvc.dll,PcaPatchSdbTask\" (UID: 00000000-00005044)\n Process \"rundll32.exe\" with commandline \"%WINDIR%\\\\system32\\\\PcaSvc.dll,PcaPatchSdbTask\" (UID: 00000000-00005332)","origin":"Monitored Target","mitre_attack_id":"T1218.011","relevance":10,"id":"target-115","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Contains ability to open the clipboard"}],"sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"},{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"},{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"},{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"name":"Evasive","details_count":3,"details":[{"detail":"Tries to sleep for a long time (more than two minutes)"},{"detail":"Marks file for deletion"},{"detail":"Possibly tries to evade analysis by sleeping many times"}],"sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"},{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"},{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]}]},"activity":{"stats":{"process_count":7,"spawned_processes_count":7,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":30,"imported_dlls_count":134,"dropped_files_count":0,"extracted_files_count":8,"files_written_count":59,"files_deleted_count":0,"registry_keys_created_count":19,"registry_keys_modified_count":0,"registry_keys_deleted_count":4,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":23,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":2,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["criminal","flawedgrace","montyspider","servhelper","agent","modular","rat","credentialharvesting","gracefulspider"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","User Comment","TOR analysis"],"sandbox_reports":[{"id":"69e3f98ff77d538b140a8557","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Dropper","submit_name":"c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4","analysis_start_time":"2026-04-18T21:37:20+00:00","indicators_count":{"informative":193,"suspicious":41,"malicious":6},"tags":["Multi-Process","Network Traffic","Extracted Files","User Comment"],"is_in_unified_schema":true},{"id":"5c4defc47ca3e10d21220e00","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Delf","contacted_countries":["ZZZ"],"submit_name":"c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe","analysis_start_time":"2019-09-02T06:52:04+00:00","indicators_count":{"informative":21,"suspicious":25,"malicious":10},"tags":["Multi-Process","Network Traffic","Extracted Files","User Comment"],"is_in_unified_schema":true},{"id":"5c4defbe7ca3e10d21220dfb","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Delf","contacted_countries":["ZZZ"],"submit_name":"E00499E21F9DCF77FC990400B8B3C2B5.exe","analysis_start_time":"2019-01-27T18:52:34+00:00","indicators_count":{"informative":22,"suspicious":25,"malicious":9},"tags":["Multi-Process","Network Traffic","Extracted Files","User Comment","TOR analysis"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":[{"domain":"afsssdrfrm.pw","ttl":1799,"country":"-","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"},{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"domain":"vesecase.com","address":"127.0.0.1","ttl":1798,"country":"Reserved","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"},{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}],"processes":[{"pid":3720,"ppid":0,"name":"c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe","command_line":"","sha256":"c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4","normalized_path":"C:\\c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe","uid":"00000000-00003720","icon":"$61"},{"pid":3332,"ppid":3720,"name":"wscript.exe","command_line":"\"wscript\" \"%TEMP%\\rds.vbs\"","sha256":"7478b567c9ec9a1e1061f9c6db2993fcdc2ec4e8fb5ca6da80fa307b54116e69","normalized_path":"%WINDIR%\\SYSTEM32\\wscript.exe","parent_uid":"00000000-00003720","uid":"00000000-00003332"},{"pid":2432,"ppid":3332,"name":"cmd.exe","command_line":"/c %TEMP%\\help.bat","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00000000-00003332","uid":"00000000-00002432"},{"pid":3540,"ppid":2432,"name":"rundll32.exe","command_line":"%TEMP%\\htpd.dat, bogus","sha256":"98d37eff504a7adb864131ea4a042aaf4d79c4356960a8ab2fa656cc59aec014","normalized_path":"%WINDIR%\\system32\\rundll32.exe","parent_uid":"00000000-00002432","uid":"00000000-00003540"},{"pid":5504,"ppid":3540,"name":"rundll32.exe","command_line":"%TEMP%\\htpd.dat, bogus","sha256":"c4815ead0abe44972ae918cab9b21289b29cf5d3471fe102c27e1a86601a729c","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","parent_uid":"00000000-00003540","uid":"00000000-00005504"},{"pid":5044,"ppid":0,"name":"rundll32.exe","command_line":"%WINDIR%\\system32\\PcaSvc.dll,PcaPatchSdbTask","sha256":"98d37eff504a7adb864131ea4a042aaf4d79c4356960a8ab2fa656cc59aec014","normalized_path":"%WINDIR%\\system32\\rundll32.exe","uid":"00000000-00005044","icon":"$62"},{"pid":5332,"ppid":0,"name":"rundll32.exe","command_line":"%WINDIR%\\system32\\PcaSvc.dll,PcaPatchSdbTask","sha256":"98d37eff504a7adb864131ea4a042aaf4d79c4356960a8ab2fa656cc59aec014","normalized_path":"%WINDIR%\\system32\\rundll32.exe","uid":"00000000-00005332","icon":"$63"}],"all_imported_dlls":["normaliz.dll","urlmon.dll","winhttp.dll","webio.dll","gdi32.dll","devobj.dll","rsaenh.dll","mpr.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","msvcrt.dll","shlwapi.dll","wintrust.dll","srvcli.dll","wkscli.dll","imagehlp.dll","oleaut32.dll","lpk.dll","apphelp.dll","propsys.dll","netapi32.dll","winnsi.dll","wow64win.dll","sspicli.dll","imm32.dll","cryptsp.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","msvcr100.dll","credssp.dll","wship6.dll","wow64cpu.dll","winbrand.dll","netutils.dll","dhcpcsvc6.dll","cryptbase.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","IPHLPAPI.DLL","dnsapi.dll","FWPUCLNT.DLL","wow64.dll","advapi32.dll","oleacc.dll","secur32.dll","VxSSL64.dll","dhcpcsvc.dll","rasadhlp.dll","cfgmgr32.dll","oleaccrc.dll","shfolder.dll","System.dll","msasn1.dll","KernelBase.dll","wininet.dll","rpcrt4.dll","msctf.dll","ntmarta.dll","Wldap32.dll","msisip.dll","comdlg32.dll","scrrun.dll","ieframe.dll","sechost.dll","usp10.dll","profapi.dll","clbcatq.dll","sxs.dll","vbscript.dll","scrobj.dll","api-ms-win-downlevel-user32-l1-1-0.dll","ntdll.dll","uxtheme.dll","version.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","api-ms-win-downlevel-version-l1-1-0.dll","nsi.dll","AcLayers.dll","tzres.dll","comctl32.dll","wshext.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","iertutil.dll","mswsock.dll","WSHTCPIP.DLL","kernel32.dll","ole32.dll","userenv.dll","setupapi.dll","dwmapi.dll","rpcss.dll","ws2_32.dll","acwow64.dll","user32.dll","shell32.dll","crypt32.dll","wshqos.dll","umpdc.dll","wow64con.dll","combase.dll","WinTypes.dll","win32u.dll","amsi.dll","Windows.StateRepositoryPS.dll","OnDemandConnRouteHelper.dll","fltLib.dll","wldp.dll","kernel.appcore.dll","windows.storage.dll","virtdisk.dll","msvcp110_win.dll","bcryptprimitives.dll","OneCoreUAPCommonProxyStub.dll","wow64base.dll","ucrtbase.dll","SHCore.dll","BCP47Langs.dll","policymanager.dll","VxSSL32.dll","800DF380.dll","samcli.dll","gdi32full.dll","MpOAV.dll","MpClient.dll","cmdext.dll","DiagnosticDataSettings.dll","powrprof.dll","tdh.dll","gpapi.dll","apisampling.dll","CorePrivacySettingsStore.dll","msvcp_win.dll","AppResolver.dll","aepic.dll","edputil.dll","pcasvc.dll","wer.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"htpd.dat","sha256":"79a56ca8a7fdeed1f09466af66c24ddef5ef97ac026297f4ea32db6e01a81190","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"},{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"name":"System.dll","sha256":"a0cac4cf4852895619bc7743ebeb89f9e4927ccdb9e66b1bcd92a4136d0f9c77","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"},{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"name":"rds.vbs","sha256":"8a5041d41c552c5df95e4a18de4c343e5ac54845e275262e99a3a6e1a639f5d4","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"},{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"name":"help.bat","sha256":"7d1aa9b5406701ee230238dbfa2fda9a0586e821fa67401d22e9b17c3041e325","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"},{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"name":"2.lnk","sha256":"af8f6c36d5e9f60946222e767ea9fc6b3b399560eca53517376fb5919266a43e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"},{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"name":"nsk4DDD.tmp","sha256":"3c4fa41d4ad5fe6b7489df346a83ccd5597acc53db6f11ca8735127860c9308f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"}]},{"name":"nso1211.tmp","sha256":"3c4fa41d4ad5fe6b7489df346a83ccd5597acc53db6f11ca8735127860c9308f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"}]},{"name":"nsr2206.tmp","sha256":"3c4fa41d4ad5fe6b7489df346a83ccd5597acc53db6f11ca8735127860c9308f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]}],"files_written":[{"path":"%WINDIR%\\SysWOW64\\oleaccrc.dll","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"}]},{"path":"C:\\c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4.exe","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"}]},{"path":"%TEMP%\\nsk4DDD.tmp","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"}]},{"path":"%TEMP%\\reas.exe","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"}]},{"path":"%TEMP%\\2.lnk","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"},{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"path":"%WINDIR%\\AppPatch\\AppPatch64\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"}]},{"path":"%TEMP%\\nsq4FD2.tmp\\System.dll","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"}]},{"path":"%WINDIR%\\System32\\en-US\\wscript.exe.mui","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"}]},{"path":"%WINDIR%\\System32\\wscript.exe","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"}]},{"path":"%TEMP%\\rds.vbs","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"},{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"}]},{"path":"%WINDIR%\\System32\\wshom.ocx","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"}]},{"path":"%WINDIR%\\System32","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"},{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000019.db","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"}]},{"path":"C:","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"}]},{"path":"%WINDIR%\\System32\\cmd.exe","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"}]},{"path":"%WINDIR%\\System32\\en-US\\cmd.exe.mui","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"}]},{"path":"%TEMP%\\help.bat","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"},{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"},{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"},{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"},{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"},{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"},{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"path":"%WINDIR%\\System32\\en-US\\rundll32.exe.mui","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"}]},{"path":"%WINDIR%\\AppPatch\\AcLayers.dll","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"}]},{"path":"%WINDIR%\\AppPatch\\acwow64.dll","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\rundll32.exe.mui","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"}]},{"path":"%WINDIR%\\SysWOW64\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{C3450F58-7060-4AEA-B0A0-C245927D78D0}","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\winhttp.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"}]},{"path":"%WINDIR%\\System32\\oleaccrc.dll","sources":[{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"}]},{"path":"C:\\E00499E21F9DCF77FC990400B8B3C2B5.exe","sources":[{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"}]},{"path":"%TEMP%\\nso1211.tmp","sources":[{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"}]},{"path":"%WINDIR%\\system32\\en\\wscript.exe.mui","sources":[{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"}]},{"path":"%TEMP%\\nsp13E7.tmp\\System.dll","sources":[{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"}]},{"path":"C:\\Windows","sources":[{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000012.db","sources":[{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"}]},{"path":"%WINDIR%\\System32\\rundll32.exe","sources":[{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"}]},{"path":"%WINDIR%\\System32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{F5E5586C-DA91-47DA-AEAC-0A88CD2FFB01}","sources":[{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"}]},{"path":"%WINDIR%\\System32\\en-US\\winhttp.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"}]},{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"path":"%TEMP%\\nsc21F6.tmp","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"path":"%TEMP%\\nsr2206.tmp","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"path":"%TEMP%\\htpd.dat","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"path":"%TEMP%\\nsh239D.tmp","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"path":"%TEMP%\\nsh239D.tmp\\System.dll","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E122B924-B4ED-4437-BC94-A96B6AA901B6}","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{45F5205B-FA7A-11ED-8886-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\DESKTOP\\NAMESPACE\\\\","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\DESKTOP\\NAMESPACE\\\\","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\DESKTOP\\NAMESPACE_36354489\\\\","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\DESKTOP\\NAMESPACE\\DELEGATEFOLDERS\\\\","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\DESKTOP\\NAMESPACE_36354489\\DELEGATEFOLDERS\\\\","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\TENANTRESTRICTIONS\\PAYLOAD\\","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\APPCOMPATFLAGS\\","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\CPSS\\","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\CPSS\\STORE\\","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\CPSS\\STORE\\ALLOWTELEMETRY\\","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\DEVICEACCESS\\","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\CPSS\\\\","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\CPSS\\EDITION\\DEVICEPOLICY\\ALLOWTELEMETRY\\","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\CPSS\\DEVICEPOLICY\\ALLOWTELEMETRY\\","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\CPSS\\DEVICEPOLICY\\ALLOWTELEMETRY\\\\","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\DATACOLLECTION\\","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"},{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"},{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"},{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"},{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\rsdasfasaasfxfa","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"}]},{"name":"Global\\rsdasfasaasfxfa","sources":[{"report_type":"sandbox","report_id":"5c4defc47ca3e10d21220e00"},{"report_type":"sandbox","report_id":"5c4defbe7ca3e10d21220dfb"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3720:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3720:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3720:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"name":"SM0:3720:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"name":"Local\\SM0:3720:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"name":"Local\\SM0:3720:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3332:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3332:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3332:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Microsoft.Windows.Health.TestInProduction.RegistryStore.AggregateResults","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"name":"Local\\SM0:3332:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"name":"Local\\SM0:3332:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"name":"SM0:3332:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"name":"Microsoft.Windows.Health.TestInProduction.RegistryStore.AggregateResults","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2432:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"name":"Local\\SM0:2432:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3540:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"name":"Local\\SM0:3540:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"name":"\\BaseNamedObjects\\rsdasfasaasfxfa","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"name":"Local\\SM0:5504:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5504:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"name":"\\BaseNamedObjects\\Local\\SM0:5044:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"name":"\\BaseNamedObjects\\OneSettingQueryMutex+appcompat+runtimesdbincloud","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]},{"name":"\\BaseNamedObjects\\Local\\SM0:5332:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e3f98ff77d538b140a8557"}]}]}},"report_ids":{"sandbox_job_ids":["5c4defbe7ca3e10d21220dfb","69e3f98ff77d538b140a8557","5c4defc47ca3e10d21220e00"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Dropper Sample c354467ec5d3… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample c354467ec5d3…. Malware family: Trojan.Dropper. Threat score 100/100. 14/28 AV engines flagged this file. 13 malicious and 31 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Dropper Sample c354467ec5d3… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample c354467ec5d3…. Malware family: Trojan.Dropper. Threat score 100/100. 14/28 AV engines flagged this file. 13 malicious and 31 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/c354467ec5d323fecf94d33bc05eab65f90a916c39137d2b751b0e637ca5a3e4"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Dropper Sample c354467ec5d3… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample c354467ec5d3…. Malware family: Trojan.Dropper. Threat score 100/100. 14/28 AV engines flagged this file. 13 malicious and 31 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L64","11",{}]]