Xcitium Cloud Verdict

File Name: 198808e07a5ff1f81792f5d8ad348117d57331ee

File Type: PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows

SHA1: 198808e07a5ff1f81792f5d8ad348117d57331ee

MD5: 8e8b92bdefe259ace73cf93e3313330b

Download Kill Chain Report

Resolved APIs

kernel32.dll.AddVectoredContinueHandler
kernel32.dll.GetQueuedCompletionStatusEx
kernel32.dll.LoadLibraryExA
kernel32.dll.LoadLibraryExW
advapi32.dll.SystemFunction036
- ntdll.dll.NtWaitForSingleObject
- winmm.dll.timeBeginPeriod
- winmm.dll.timeEndPeriod
- ws2_32.dll.WSAGetOverlappedResult
- cryptbase.dll.SystemFunction001
- cryptbase.dll.SystemFunction002
- cryptbase.dll.SystemFunction003
- cryptbase.dll.SystemFunction004
- cryptbase.dll.SystemFunction005
- cryptbase.dll.SystemFunction028
- cryptbase.dll.SystemFunction029
- cryptbase.dll.SystemFunction034
- cryptbase.dll.SystemFunction036
- cryptbase.dll.SystemFunction040
- cryptbase.dll.SystemFunction041
- kernel32.dll.GetStdHandle
- kernel32.dll.SetHandleInformation
- kernel32.dll.GetSystemDirectoryW
- kernel32.dll.CreateFileMappingW
- kernel32.dll.MapViewOfFile
- kernel32.dll.IsBadReadPtr
- kernel32.dll.VirtualAlloc
- kernel32.dll.UnmapViewOfFile
- kernel32.dll.CloseHandle
- kernel32.dll.VirtualFree
- kernel32.dll.CreateProcessW
- kernel32.dll.VirtualAllocEx
Show More 27

Registry Keys

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles

Loading...