26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 61:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T491,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Ransom Sample 000db71531e5… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 000db71531e5…. Malware family: Trojan.Ransom. Threat score 100/100. 22/25 AV engines flagged this file. 16 malicious and 28 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46","keywords":["Malicious","Trojan.Ransom","malware analysis","sandbox report","threat intelligence","000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46"],"about":{"@type":"SoftwareApplication","name":"bounty-86623065303267239","applicationCategory":["peexe","executable"],"identifier":"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Ransom","antivirusDetections":{"malicious":22,"total":25},"behavioralIndicators":{"malicious":16,"suspicious":28},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T79d,Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46") Found reference to API "IcmpSendEcho" (Indicator: "IcmpSendEcho"; File: "00000000-00003836.00000000.80592.00DE1000.00000020.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "00000000-00003836.00000000.80592.00DE1000.00000020.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00002796.00000000.78318.00D6A000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00002796.00000000.78318.00D6A000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002796.00000000.78318.00D6A000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00003492.00000000.78186.00430000.00000004.mdmp, 00000000-00003492.00000001.80107.02D50000.00000004.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00003492.00000000.78186.00430000.00000004.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003492.00000000.78186.00430000.00000004.mdmp, 00000000-00003492.00000001.80107.02D50000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003492.00000001.80107.02D50000.00000004.mdmp")28:T5f6,"netsh.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP") "netsh.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP") "netsh.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS") "netsh.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED") "netsh.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED") "netsh.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CMF\CONFIG") "netsh.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CMF\CONFIG") "netsh.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS") "netsh.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS") "netsh.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE") "netsh.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE") "netsh.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE\ASSEMBLYSTORAGEROOTS") "netsh.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NETWORKPROVIDER\HWORDER") "netsh.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE") "netsh.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE") "netsh.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE\TRACING") "netsh.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLEAUT")29:Tf2f,"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" queried SystemProcessInformation at 00000000-00003492-00000105-891208 [PID: 3492] "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" queried SystemProcessInformation at 00000000-00003492-00000105-1114944 [PID: 3492] "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" queried SystemProcessInformation at 00000000-00003492-00000105-3002448 [PID: 3492] "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" queried SystemProcessInformation at 00000000-00003492-00000105-3266228 [PID: 3492] "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" queried SystemProcessInformation at 00000000-00003492-00000105-3843832 [PID: 3492] "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" queried SystemProcessInformation at 00000000-00003492-00000105-4123346 [PID: 3492] "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" queried SystemProcessInformation at 00000000-00003492-00000105-4372706 [PID: 3492] "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" queried SystemProcessInformation at 00000000-00003492-00000105-4684440 [PID: 3492] "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" queried SystemProcessInformation at 00000000-00003492-00000105-4965017 [PID: 3492] "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" queried SystemProcessInformation at 00000000-00003492-00000105-5198835 [PID: 3492] "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" queried SystemProcessInformation at 00000000-00003492-00000105-11766026 [PID: 3492] "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" queried SystemProcessInformation at 00000000-00003492-00000105-12307454 [PID: 3492] "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" queried SystemProcessInformation at 00000000-00003492-00000105-12540279 [PID: 3492] "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" queried SystemProcessInformation at 00000000-00003492-00000105-12806334 [PID: 3492] "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" queried SystemProcessInformation at 00000000-00003492-00000105-13054722 [PID: 3492] "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" queried SystemProcessInformation at 00000000-00003492-00000105-13398336 [PID: 3492] "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" queried SystemProcessInformation at 00000000-00003492-00000105-14863894 [PID: 3492] "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" queried SystemProcessInformation at 00000000-00003492-00000105-17102859 [PID: 3492] "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" queried SystemProcessInformation at 00000000-00003492-00000105-17496981 [PID: 3492] "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" queried SystemProcessInformation at 00000000-00003492-00000105-22607182 [PID: 3492] "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" queried SystemProcessInformation at 00000000-00003492-00000105-23252618 [PID: 3492] "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" queried SystemProcessInformation at 00000000-00003492-00000105-23625757 [PID: 3492] "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" queried SystemProcessInformation at 00000000-00003492-00000105-23981197 [PID: 3492] "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" queried SystemProcessInformation at 00000000-00003492-00000105-24386385 [PID: 3492] "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" queried SystemProcessInformation at 00000000-00003492-00000105-24745019 [PID: 3492]2a:T1d33,"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" renamed original file"C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\osetup.dll" to "C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\osetup.dll.id[085CDA53-2803].[HenryShrapnel61@gmx.com].eight" "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" renamed original file"C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\OWOW64WW.cab" to "C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\OWOW64WW.cab.id[085CDA53-2803].[HenryShrapnel61@gmx.com].eight" "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" renamed original file"C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPsWW.cab" to "C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPsWW.cab.id[085CDA53-2803].[HenryShrapnel61@gmx.com].eight" "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" renamed original file"C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.msi" to "C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.msi.id[085CDA53-2803].[HenryShrapnel61@gmx.com].eight" "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" renamed original file"C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.msi" to "C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.msi.id[085CDA53-2803].[HenryShrapnel61@gmx.com].eight" "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" renamed original file"C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PublisherMUI.msi" to "C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PublisherMUI.msi.id[085CDA53-2803].[HenryShrapnel61@gmx.com].eight" "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" renamed original file"C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PubLR.cab" to "C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PubLR.cab.id[085CDA53-2803].[HenryShrapnel61@gmx.com].eight" "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" renamed original file"C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlkLR.cab" to "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlkLR.cab.id[085CDA53-2803].[HenryShrapnel61@gmx.com].eight" "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" renamed original file"C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlookMUI.msi" to "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlookMUI.msi.id[085CDA53-2803].[HenryShrapnel61@gmx.com].eight" "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" renamed original file"C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordLR.cab" to "C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordLR.cab.id[085CDA53-2803].[HenryShrapnel61@gmx.com].eight" "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" renamed original file"C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.cab" to "C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.cab.id[085CDA53-2803].[HenryShrapnel61@gmx.com].eight" "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" renamed original file"C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\InfLR.cab" to "C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\InfLR.cab.id[085CDA53-2803].[HenryShrapnel61@gmx.com].eight" "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" renamed original file"C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\InfoPathMUI.msi" to "C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\InfoPathMUI.msi.id[085CDA53-2803].[HenryShrapnel61@gmx.com].eight" "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" renamed original file"C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\GrooveLR.cab" to "C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\GrooveLR.cab.id[085CDA53-2803].[HenryShrapnel61@gmx.com].eight" "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" renamed original file"C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\GrooveMUI.msi" to "C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\GrooveMUI.msi.id[085CDA53-2803].[HenryShrapnel61@gmx.com].eight" "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" renamed original file"C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeMUI.msi" to "C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeMUI.msi.id[085CDA53-2803].[HenryShrapnel61@gmx.com].eight" "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" renamed original file"C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\AccessMUI.msi" to "C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\AccessMUI.msi.id[085CDA53-2803].[HenryShrapnel61@gmx.com].eight" "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" renamed original file"C:\Program Files\Microsoft Office\Office14\ACCWIZ\ACWZLIB.ACCDE" to "%PROGRAMFILES%\Microsoft Office\Office14\ACCWIZ\ACWZLIB.ACCDE.id[085CDA53-2803].[HenryShrapnel61@gmx.com].eight" "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" renamed original file"C:\Program Files\Microsoft Office\Office14\ACCWIZ\ACWZTOOL.ACCDE" to "%PROGRAMFILES%\Microsoft Office\Office14\ACCWIZ\ACWZTOOL.ACCDE.id[085CDA53-2803].[HenryShrapnel61@gmx.com].eight" "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db" to "%LOCALAPPDATA%\Microsoft\Windows\Explorer\thumbcache_256.db.id[085CDA53-2803].[HenryShrapnel61@gmx.com].eight" "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" renamed original file"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\d3dcompiler_43.dll" to "%PROGRAMFILES%\Adobe\Acrobat Reader DC\Reader\AcroCEF\d3dcompiler_43.dll.id[085CDA53-2803].[HenryShrapnel61@gmx.com].eight" "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" renamed original file"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\icudt.dll" to "%PROGRAMFILES%\Adobe\Acrobat Reader DC\Reader\AcroCEF\icudt.dll.id[085CDA53-2803].[HenryShrapnel61@gmx.com].eight" "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" renamed original file"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\libcef.dll" to "%PROGRAMFILES%\Adobe\Acrobat Reader DC\Reader\AcroCEF\libcef.dll.id[085CDA53-2803].[HenryShrapnel61@gmx.com].eight" "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" renamed original file"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\libGLESv2.dll" to "%PROGRAMFILES%\Adobe\Acrobat Reader DC\Reader\AcroCEF\libGLESv2.dll.id[085CDA53-2803].[HenryShrapnel61@gmx.com].eight" "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" renamed original file"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe" to "%PROGRAMFILES%\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe.id[085CDA53-2803].[HenryShrapnel61@gmx.com].eight"2b:T1726,Assembly shows XOR instruction xor dword ptr [esi] eax in Stream UID: 23458-134-00401706 Assembly shows XOR instruction xor eax 3599306Ch in Stream UID: 00000000-00003836-30400-535-00E1E1C8 Assembly shows XOR instruction xor eax 359AF06Ch in Stream UID: 00000000-00003836-30400-535-00E1E1C8 Assembly shows XOR instruction xor eax 3596606Ch in Stream UID: 00000000-00003836-30400-535-00E1E1C8 Assembly shows XOR instruction xor eax 3599C06Ch in Stream UID: 00000000-00003836-30400-535-00E1E1C8 Assembly shows XOR instruction xor byte ptr [ebx-63BF93CBh] dl in Stream UID: 00000000-00003836-30400-535-00E1E1C8 Assembly shows XOR instruction xor eax 359BE06Ch in Stream UID: 00000000-00003836-30400-535-00E1E1C8 Assembly shows XOR instruction xor eax 3588F06Ch in Stream UID: 00000000-00003836-30400-535-00E1E1C8 Assembly shows XOR instruction xor eax 3590E06Ch in Stream UID: 00000000-00003836-30400-535-00E1E1C8 Assembly shows XOR instruction xor eax 3593A06Ch in Stream UID: 00000000-00003836-30400-535-00E1E1C8 Assembly shows XOR instruction xor al 10h in Stream UID: 00000000-00003836-30400-535-00E1E1C8 Assembly shows XOR instruction xor eax BBCE7710h in Stream UID: 00000000-00003836-30400-535-00E1E1C8 Assembly shows XOR instruction xor al 6Bh in Stream UID: 00000000-00003836-30400-535-00E1E1C8 Assembly shows XOR instruction xor byte ptr [eax] al in Stream UID: 00000000-00003836-30400-535-00E1E1C8 Assembly shows XOR instruction xor byte ptr [edx-66CF93CBh] dl in Stream UID: 00000000-00003836-30400-542-00E1E174 Assembly shows XOR instruction xor byte ptr [ecx-650F93CBh] bl in Stream UID: 00000000-00003836-30400-543-00E1E168 Assembly shows XOR instruction xor eax 3594B06Ch in Stream UID: 00000000-00003836-30400-543-00E1E168 Assembly shows XOR instruction xor eax 3596D06Ch in Stream UID: 00000000-00003836-30400-550-00E1E114 Assembly shows XOR instruction xor eax 3592806Ch in Stream UID: 00000000-00003836-30400-550-00E1E114 Assembly shows XOR instruction xor eax 359A806Ch in Stream UID: 00000000-00003836-30400-550-00E1E114 Assembly shows XOR instruction xor eax 359CA06Ch in Stream UID: 00000000-00003836-30400-557-00E1E0C0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003836-30400-645-00E156C9 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003836-30400-645-00E156C9 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003836-30400-691-00E1DA6A Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003836-30400-691-00E1DA6A Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003836-30400-825-00DF7AC4 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003836-30400-825-00DF7AC4 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003836-30400-834-00DFAF5D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003836-30400-834-00DFAF5D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003836-30400-836-00DF7C34 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003836-30400-836-00DF7C34 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003836-30400-1033-00E07838 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003836-30400-1033-00E07838 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003836-30400-1053-00E06F58 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003836-30400-1053-00E06F58 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003836-30400-1061-00E05D74 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003836-30400-1061-00E05D74 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003836-30400-1097-00E05A67 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003836-30400-1097-00E05A67 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003836-30400-1133-00E13364 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003836-30400-1133-00E13364 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003836-30400-1140-00DF7DB5 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003836-30400-1140-00DF7DB5 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003836-30400-1358-00E09271 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003836-30400-1358-00E09271 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003836-30400-1395-00E0BC9B Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003836-30400-1395-00E0BC9B Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003836-30400-1470-00E1790C Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003836-30400-1470-00E1790C Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003836-30400-1473-00E141F4 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003836-30400-1473-00E141F4 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003836-30400-1512-00E11749 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003836-30400-1512-00E11749 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003836-30400-1516-00E11E50 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003836-30400-1516-00E11E50 Assembly shows XOR instruction xor esi dword ptr [ebp-08h] in Stream UID: 00000000-00003836-30400-1556-00E1DEE3 Assembly shows XOR instruction xor esi eax in Stream UID: 00000000-00003836-30400-1556-00E1DEE3 Assembly shows XOR instruction xor eax dword ptr [ebp-10h] in Stream UID: 00000000-00003836-30400-1556-00E1DEE3 Assembly shows XOR instruction xor al DEh in Stream UID: 00000000-00003836-30400-1668-00DFEF012c:T47a,Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46") file/memory contains long string with (Indicator: "AllocateAndInitializeSid"; File: "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00003836-00000C2C-265987664") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00002796.00000000.78318.00D6A000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00002796.00000000.78318.00D6A000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00003492.00000000.78186.00430000.00000004.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00003492.00000000.78186.00430000.00000004.mdmp")2d:T2511,"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003492) "cmd.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002580) "cmd.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003728) "cmd.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003728) "vssadmin.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003136) "netsh.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004436) "netsh.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000027008c5fea01a073270095e1f876e80f40000000000000f00300e80f40007072270088054000000040000000400000004000bceefc76000040000000400000004000a872270003000000000000004002000002100000a47227008a2efd76000040000a00000034020000900040000000400002100000c4722700c42dfd767f00000002100000010000005001400090004000000000009c732700322cfd76ff2bfc76c8303177020000000c02120000001200360068003b005c0000000000000000000000000000000000370057003b005c0000000000000000000000000084424900 (UID: 00000000-00004436) "netsh.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004436) "netsh.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000ff2bfc7648313177b021dd6aac0144000000440000000000000000001b0075006900000068313177b4309e71ac014400000044001c007000690000001c00700069000000187044000000000020000000000000000000000068ed4700086d4400286e440030874900d0714400200000005072270000000000d073270095e1f8768c5fea01feffffffff2bfc769a2afc76b021dd6aa021dd6a0000000095e1f8768c5fea0100000000bc732700c88012004c73270080f40e77000012000000000089f40e77 (UID: 00000000-00004436) "netsh.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000d26a00000000000000006c722700a4742700c702fe7601000000987227000000000048254a000203fe76000200000000000000000000e8742700a401fe76a0722700626ffc7664f8fc76a43031774810d26a98732700000000000000f7763ff000004810d26a0000000000000000ff2bfc76c8303177020000000c021200000012001a0044023b005c00654865617000000000000000000000001b0033023b005c000000000000000000b83031008c72270058035f01f076270080000000a430317700000000682a120048005f0198015f01208f1200f0095f01d0732700 (UID: 00000000-00004436) "netsh.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff2bfc769c303177d8eb2075ac0144000000440000000000000000000c00c00016060000000000000000000000000000000000000d00bb00160600000000000000000000187044000000000020000000000000000000000018404900086d4400286e440018774a00d0714400000000007c72270000000000fc732700 (UID: 00000000-00004436) "netsh.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000c0752e75d472270079da2675ff2bfc76c8303177020000000c021200000012001300bb023b005c00000000004873270000000000bc732700d89212004c73270080f40e77000012000000000089f40e77660d8fde02000000c0732700bc73270000000000682a120048005f0198015f01d892120010732700c83a187784732700d58c1077c07327005473270042a40e77a802187794732700d2f40e77080000006ef50e7744f50e77be0d8fde020000003833ab6400002800c279ae646873270002000000000028003833ab649873270042a40e77a8021877dc7327000831ab64 (UID: 00000000-00004436) "netsh.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000000000000200000018304b0078414900086d44002500020001000000ff2bfc76483131773ca36064ac01440000004400250000000100000020005700070000000000000008314b00e07227009c303177210048000700000000004400230038001870440084303177200000006c7227000000000038414900086d4400286e4400d8014b00d0714400dd59fd765072270008732700d073270095e1f8768c5fea01feffffffff2bfc769a2afc763ca360642ca360640000000099a95e85acfb2e1000000000bc732700d09a12004c73270080f40e77000012000000000089f40e77 (UID: 00000000-00004436) "netsh.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000440030044b00d0714400200089000e010000f078620100001200e08f62018c5fea01bc73270095e1f87600000000d00100004c7327000e01000000001200f07862014c732700145cfc76435cfc76d0303177680800005c45120000001200d83f120093b08a46ff2bfc768030317744816201ac01440000004400d0010000000000001100a70007000000f878620100000000de020000000000001200a200ff2bfc76c8303177020000000c021200000012000100ed033b005c000000000038414900086d4400286e44000200dc033b005c00de0200dc987227000100000068742700 (UID: 00000000-00004436) "netsh.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000004400286e4400b8af4b00d07144001b001001d471270054313177c07327001c7227008c5fea01c073270095e1f876445fea01feffffffdd57fd76dd59fd7610964b00b87227000100000010964b0084732700f959fd76a000000010964b0010964b00360f7a63f5df2f4b83ddb106c1c725e20200000062000000f00200000000000000000000000000000000000000000000000000000000000000000000ff2bfc76c8303177020000000c02120000001200350079004200700000000000000000000000000000000000360068004200700000000000000000000000000000000000 (UID: 00000000-00004436)2e:Ta30,"netsh.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004436) "netsh.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100007c3031770000f776000000009238d36ad000f77602000000000000008800000095e1f876e8732700459d0e7700001200000000008000000002000000000028009c1d3d73fc7327006c223d7380000000d3223d73dcf03d7318742700741d3d73dcf03d73000000004875270000000000 (UID: 00000000-00004436) "netsh.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eb207518774a000080fd7f9a5cfd7600f0fd7fc07327004480fd7f00000000400000003f000000200000000080fd7fb4732700c15cfd7660820477200000000080fd7f9a5cfd7600f0fd7fd87327005789fc768083047713170d75d8eb2075 (UID: 00000000-00004436) "netsh.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001912) "netsh.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000024f531770000f776000000009238c669d000f77602000000000000008800000095e1f87638762600459d0e7700000f00000000008000000002000000000027009c1d3d734c7626006c223d7380000000d3223d73dcf03d7368762600741d3d73dcf03d73000000009877260000000000 (UID: 00000000-00001912) "netsh.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eb207530643e000090fd7f9a5cfd7600f0fd7f107626004490fd7f00000000400000003f000000200000000090fd7f04762600c15cfd7660820477200000000090fd7f9a5cfd7600f0fd7f287626005789fc768083047713170d75d8eb2075 (UID: 00000000-00001912) "WMIC.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003836)2f:T970,"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "ENABLEDHCP"; Value: "") "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTRATIONENABLED"; Value: "") "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTERADAPTERNAME"; Value: "") "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DOMAIN"; Value: "") "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPDOMAIN"; Value: "") "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")30:T1024,"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" queries volume information of an entire harddrive"C:\" at 00000000-00003492-0000010C-204184 "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" queries volume information of an entire harddrive"C:\" at 00000000-00003492-0000010C-204326 "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" queries volume information of an entire harddrive"C:\" at 00000000-00003492-0000010C-204593 "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" queries volume information of an entire harddrive"C:\" at 00000000-00003492-0000010C-850779 "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" queries volume information of an entire harddrive"C:\" at 00000000-00003492-0000010C-867281 "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" queries volume information of an entire harddrive"C:\" at 00000000-00003492-0000010C-868449 "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" queries volume information of an entire harddrive"C:\" at 00000000-00003492-0000010C-900420 "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" queries volume information of an entire harddrive"C:\" at 00000000-00003492-0000010C-1509696 "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" queries volume information of an entire harddrive"C:\" at 00000000-00003492-0000010C-7021014 "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" queries volume information of an entire harddrive"C:\" at 00000000-00003492-0000010C-10218132 "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" queries volume information of an entire harddrive"C:\" at 00000000-00003492-0000010C-11028731 "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" queries volume information of an entire harddrive"C:\" at 00000000-00003492-0000010C-11683210 "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" queries volume information of an entire harddrive"C:\" at 00000000-00003492-0000010C-11885785 "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" queries volume information of an entire harddrive"C:\" at 00000000-00003492-0000010C-12711826 "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" queries volume information of an entire harddrive"C:\" at 00000000-00003492-0000010C-13044181 "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" queries volume information of an entire harddrive"C:\" at 00000000-00003492-0000010C-13275066 "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" queries volume information of an entire harddrive"C:\" at 00000000-00003492-0000010C-15284594 "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" queries volume information of an entire harddrive"C:\" at 00000000-00003492-0000010C-15689005 "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" queries volume information of an entire harddrive"C:\" at 00000000-00003492-0000010C-21158736 "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" queries volume information of an entire harddrive"C:\" at 00000000-00003492-0000010C-22490451 "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" queries volume information of an entire harddrive"C:\" at 00000000-00003492-0000010C-22609976 "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" queries volume information of an entire harddrive"C:\" at 00000000-00003492-0000010C-22632346 "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" queries volume information of an entire harddrive"C:\" at 00000000-00003492-0000010C-22812341 "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" queries volume information of an entire harddrive"C:\" at 00000000-00003492-0000010C-23233274 "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" queries volume information of an entire harddrive"C:\" at 00000000-00003492-0000010C-2343591731:T629,"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" called "CopyFileW" to copy C:\000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe to new location %LOCALAPPDATA%\000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe (UID: 00000000-00003492) "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" called "CopyFileW" to copy C:\trup.txt to new location %LOCALAPPDATA%\trup.txt (UID: 00000000-00003492) "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" called "CopyFileW" to copy C:\000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe to new location %APPDATA%\microsoft\windows\start menu\programs\startup\000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef (UID: 00000000-00003492) "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" called "CopyFileW" to copy C:\trup.txt to new location %APPDATA%\microsoft\windows\start menu\programs\startup\trup.txt (UID: 00000000-00003492) "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" called "CopyFileW" to copy C:\000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe to new location %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\startup\000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe (UID: 00000000-00003492) "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" called "CopyFileW" to copy C:\trup.txt to new location %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\startup\trup.txt (UID: 00000000-00003492)32:T290e,"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003492) "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\drprov.dll (UID: 00000000-00003492) "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\ntlanman.dll (UID: 00000000-00003492) "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\davclnt.dll (UID: 00000000-00003492) "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003492) "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00003492) "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" called "LoadLibrary" with a parameter cscapi.dll (UID: 00000000-00003492) "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" called "LoadLibrary" with a parameter netutils.dll (UID: 00000000-00003492) "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L1-1-0.dll (UID: 00000000-00003492) "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-winsvc-L1-1-0.dll (UID: 00000000-00003492) "cmd.exe" called "LoadLibrary" with a parameter NTDLL.DLL (UID: 00000000-00002580) "cmd.exe" called "LoadLibrary" with a parameter NTDLL.DLL (UID: 00000000-00003728) "vssadmin.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00003136) "vssadmin.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003136) "vssadmin.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00003136) "netsh.exe" called "LoadLibrary" with a parameter DHCPCMONITOR.DLL (UID: 00000000-00004436) "netsh.exe" called "LoadLibrary" with a parameter Dhcpcsvc.dll (UID: 00000000-00004436) "netsh.exe" called "LoadLibrary" with a parameter Dhcpqec.dll (UID: 00000000-00004436) "netsh.exe" called "LoadLibrary" with a parameter WSHELPER.DLL (UID: 00000000-00004436) "netsh.exe" called "LoadLibrary" with a parameter NSHHTTP.DLL (UID: 00000000-00004436) "netsh.exe" called "LoadLibrary" with a parameter FWCFG.DLL (UID: 00000000-00004436) "netsh.exe" called "LoadLibrary" with a parameter AUTHFWCFG.DLL (UID: 00000000-00004436) "netsh.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00004436) "netsh.exe" called "LoadLibrary" with a parameter IFMON.DLL (UID: 00000000-00004436) "netsh.exe" called "LoadLibrary" with a parameter NETIOHLP.DLL (UID: 00000000-00004436) "netsh.exe" called "LoadLibrary" with a parameter WHHELPER.DLL (UID: 00000000-00004436) "netsh.exe" called "LoadLibrary" with a parameter HNETMON.DLL (UID: 00000000-00004436) "netsh.exe" called "LoadLibrary" with a parameter RPCNSH.DLL (UID: 00000000-00004436) "netsh.exe" called "LoadLibrary" with a parameter DOT3CFG.DLL (UID: 00000000-00004436) "netsh.exe" called "LoadLibrary" with a parameter NAPMONTR.DLL (UID: 00000000-00004436) "netsh.exe" called "LoadLibrary" with a parameter NSHIPSEC.DLL (UID: 00000000-00004436) "netsh.exe" called "LoadLibrary" with a parameter NETTRACE.DLL (UID: 00000000-00004436) "netsh.exe" called "LoadLibrary" with a parameter WCNNETSH.DLL (UID: 00000000-00004436) "netsh.exe" called "LoadLibrary" with a parameter P2PNETSH.DLL (UID: 00000000-00004436) "netsh.exe" called "LoadLibrary" with a parameter WLANCFG.DLL (UID: 00000000-00004436) "netsh.exe" called "LoadLibrary" with a parameter WWANCFG.DLL (UID: 00000000-00004436) "netsh.exe" called "LoadLibrary" with a parameter PEERDISTSH.DLL (UID: 00000000-00004436) "netsh.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004436) "netsh.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00004436) "netsh.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00004436) "netsh.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004436) "netsh.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004436) "netsh.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L1-1-0.dll (UID: 00000000-00004436) "netsh.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L2-1-0.dll (UID: 00000000-00004436) "netsh.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-winsvc-L1-1-0.dll (UID: 00000000-00004436) "netsh.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00004436) "netsh.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00004436) "netsh.exe" called "LoadLibrary" with a parameter HTTPAPI.dll (UID: 00000000-00004436) "netsh.exe" called "LoadLibrary" with a parameter userenv.dll (UID: 00000000-00004436) "netsh.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\bcryptprimitives.dll (UID: 00000000-00004436) "netsh.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004436) "netsh.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00004436) "netsh.exe" called "LoadLibrary" with a parameter DHCPCMONITOR.DLL (UID: 00000000-00001912) "netsh.exe" called "LoadLibrary" with a parameter Dhcpcsvc.dll (UID: 00000000-00001912) "netsh.exe" called "LoadLibrary" with a parameter Dhcpqec.dll (UID: 00000000-00001912) "netsh.exe" called "LoadLibrary" with a parameter WSHELPER.DLL (UID: 00000000-00001912) "netsh.exe" called "LoadLibrary" with a parameter NSHHTTP.DLL (UID: 00000000-00001912) "netsh.exe" called "LoadLibrary" with a parameter FWCFG.DLL (UID: 00000000-00001912) "netsh.exe" called "LoadLibrary" with a parameter AUTHFWCFG.DLL (UID: 00000000-00001912) "netsh.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00001912) "netsh.exe" called "LoadLibrary" with a parameter IFMON.DLL (UID: 00000000-00001912) "netsh.exe" called "LoadLibrary" with a parameter NETIOHLP.DLL (UID: 00000000-00001912) "netsh.exe" called "LoadLibrary" with a parameter WHHELPER.DLL (UID: 00000000-00001912) "netsh.exe" called "LoadLibrary" with a parameter HNETMON.DLL (UID: 00000000-00001912) "netsh.exe" called "LoadLibrary" with a parameter RPCNSH.DLL (UID: 00000000-00001912) "netsh.exe" called "LoadLibrary" with a parameter DOT3CFG.DLL (UID: 00000000-00001912) "netsh.exe" called "LoadLibrary" with a parameter NAPMONTR.DLL (UID: 00000000-00001912) "netsh.exe" called "LoadLibrary" with a parameter NSHIPSEC.DLL (UID: 00000000-00001912) "netsh.exe" called "LoadLibrary" with a parameter NETTRACE.DLL (UID: 00000000-00001912) "netsh.exe" called "LoadLibrary" with a parameter WCNNETSH.DLL (UID: 00000000-00001912) "netsh.exe" called "LoadLibrary" with a parameter P2PNETSH.DLL (UID: 00000000-00001912) "netsh.exe" called "LoadLibrary" with a parameter WLANCFG.DLL (UID: 00000000-00001912) "netsh.exe" called "LoadLibrary" with a parameter WWANCFG.DLL (UID: 00000000-00001912) "netsh.exe" called "LoadLibrary" with a parameter PEERDISTSH.DLL (UID: 00000000-00001912) "netsh.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001912) "netsh.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00001912) "netsh.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00001912) "netsh.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001912) "netsh.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001912) "netsh.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L1-1-0.dll (UID: 00000000-00001912) "netsh.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L2-1-0.dll (UID: 00000000-00001912) "netsh.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-winsvc-L1-1-0.dll (UID: 00000000-00001912) "netsh.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00001912) "netsh.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00001912) "netsh.exe" called "LoadLibrary" with a parameter HTTPAPI.dll (UID: 00000000-00001912) "netsh.exe" called "LoadLibrary" with a parameter userenv.dll (UID: 00000000-00001912) "netsh.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\bcryptprimitives.dll (UID: 00000000-00001912) "netsh.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001912) "netsh.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00001912) "WMIC.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00003836) "WMIC.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00003836) "WMIC.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00003836) "WMIC.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\msxml3r.dll (UID: 00000000-00003836) "WMIC.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00003836) "WMIC.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003836) "WMIC.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00003836) "WMIC.exe" called "LoadLibrary" with a parameter wininet.dll (UID: 00000000-00003836) "WMIC.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00003836) "WMIC.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003836) "WMIC.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00003836) "WMIC.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00003836) "wbadmin.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00004716) "wbadmin.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004716) "wbadmin.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00004716)33:T2114,"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" called "MoveFileW" with parameter \\?\C:\dotnet48.exe & \\?\C:\dotnet48.exe.id[085CDA53-2803].[HenryShrapnel61@gmx.com].eight (UID: 00000000-00003492) "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" called "MoveFileW" with parameter \\?\C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\osetup.dll & \\?\C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\osetup.dll.id[085CDA53-2803].[HenryShrapnel61@gmx.com].eight (UID: 00000000-00003492) "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" called "MoveFileW" with parameter \\?\C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.msi & \\?\C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.msi.id[085CDA53-2803].[HenryShrapnel61@gmx.com].eigh (UID: 00000000-00003492) "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" called "MoveFileW" with parameter \\?\C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\OWOW64WW.cab & \\?\C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\OWOW64WW.cab.id[085CDA53-2803].[HenryShrapnel61@gmx.com].eight (UID: 00000000-00003492) "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" called "MoveFileW" with parameter \\?\C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPlusWW.msi & \\?\C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPlusWW.msi.id[085CDA53-2803].[HenryShrapnel61@gmx.com].eight (UID: 00000000-00003492) "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" called "MoveFileW" with parameter \\?\C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPsWW2.cab & \\?\C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPsWW2.cab.id[085CDA53-2803].[HenryShrapnel61@gmx.com].eight (UID: 00000000-00003492) "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" called "MoveFileW" with parameter \\?\C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPsWW.cab & \\?\C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPsWW.cab.id[085CDA53-2803].[HenryShrapnel61@gmx.com].eight (UID: 00000000-00003492) "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" called "MoveFileW" with parameter \\?\C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelLR.cab & \\?\C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelLR.cab.id[085CDA53-2803].[HenryShrapnel61@gmx.com].eight (UID: 00000000-00003492) "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" called "MoveFileW" with parameter \\?\C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.msi & \\?\C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.msi.id[085CDA53-2803].[HenryShrapnel61@gmx.com].eight (UID: 00000000-00003492) "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" called "MoveFileW" with parameter \\?\C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.msi & \\?\C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.msi.id[085CDA53-2803].[HenryShrapnel61@gmx.com].e (UID: 00000000-00003492) "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" called "MoveFileW" with parameter \\?\C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PublisherMUI.msi & \\?\C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PublisherMUI.msi.id[085CDA53-2803].[HenryShrapnel61@gmx.com].ei (UID: 00000000-00003492) "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" called "MoveFileW" with parameter \\?\C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PubLR.cab & \\?\C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PubLR.cab.id[085CDA53-2803].[HenryShrapnel61@gmx.com].eight (UID: 00000000-00003492) "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" called "MoveFileW" with parameter \\?\C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlkLR.cab & \\?\C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlkLR.cab.id[085CDA53-2803].[HenryShrapnel61@gmx.com].eight (UID: 00000000-00003492) "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" called "MoveFileW" with parameter \\?\C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlookMUI.msi & \\?\C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlookMUI.msi.id[085CDA53-2803].[HenryShrapnel61@gmx.com].eigh (UID: 00000000-00003492) "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" called "MoveFileW" with parameter \\?\C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PptLR.cab & \\?\C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PptLR.cab.id[085CDA53-2803].[HenryShrapnel61@gmx.com].eight (UID: 00000000-00003492) "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" called "MoveFileW" with parameter \\?\C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordMUI.msi & \\?\C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordMUI.msi.id[085CDA53-2803].[HenryShrapnel61@gmx.com].eight (UID: 00000000-00003492) "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" called "MoveFileW" with parameter \\?\C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.cab & \\?\C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.cab.id[085CDA53-2803].[HenryShrapnel61@gmx.com]. (UID: 00000000-00003492) "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" called "MoveFileW" with parameter \\?\C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordLR.cab & \\?\C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordLR.cab.id[085CDA53-2803].[HenryShrapnel61@gmx.com].eight (UID: 00000000-00003492) "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" called "MoveFileW" with parameter \\?\C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.cab & \\?\C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.cab.id[085CDA53-2803].[HenryShrapnel61@gmx.com]. (UID: 00000000-00003492) "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" called "MoveFileW" with parameter \\?\C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.cab & \\?\C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.cab.id[085CDA53-2803].[HenryShrapnel61@gmx.com]. (UID: 00000000-00003492) "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" called "MoveFileW" with parameter \\?\C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\InfLR.cab & \\?\C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\InfLR.cab.id[085CDA53-2803].[HenryShrapnel61@gmx.com].eight (UID: 00000000-00003492) "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" called "MoveFileW" with parameter \\?\C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\OneNoteMUI.msi & \\?\C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\OneNoteMUI.msi.id[085CDA53-2803].[HenryShrapnel61@gmx.com].eigh (UID: 00000000-00003492) "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" called "MoveFileW" with parameter \\?\C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\InfoPathMUI.msi & \\?\C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\InfoPathMUI.msi.id[085CDA53-2803].[HenryShrapnel61@gmx.com].eig (UID: 00000000-00003492) "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" called "MoveFileW" with parameter \\?\C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\GrooveLR.cab & \\?\C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\GrooveLR.cab.id[085CDA53-2803].[HenryShrapnel61@gmx.com].eight (UID: 00000000-00003492) "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" called "MoveFileW" with parameter \\?\C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\GrooveMUI.msi & \\?\C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\GrooveMUI.msi.id[085CDA53-2803].[HenryShrapnel61@gmx.com].eight (UID: 00000000-00003492)34:T57e6,"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003492) "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" called "GetProcAddress" with a parameter Wow64RevertWow64FsRedirection (UID: 00000000-00003492) "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" called "GetProcAddress" with a parameter Wow64DisableWow64FsRedirection (UID: 00000000-00003492) "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00003492) "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" called "GetProcAddress" with a parameter NPGetCaps (UID: 00000000-00003492) "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" called "GetProcAddress" with a parameter NPGetUser (UID: 00000000-00003492) "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" called "GetProcAddress" with a parameter NPAddConnection (UID: 00000000-00003492) "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" called "GetProcAddress" with a parameter NPAddConnection3 (UID: 00000000-00003492) "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" called "GetProcAddress" with a parameter NPGetReconnectFlags (UID: 00000000-00003492) "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" called "GetProcAddress" with a parameter NPCancelConnection (UID: 00000000-00003492) "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" called "GetProcAddress" with a parameter NPGetConnection (UID: 00000000-00003492) "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" called "GetProcAddress" with a parameter NPGetConnection3 (UID: 00000000-00003492) "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" called "GetProcAddress" with a parameter NPGetUniversalName (UID: 00000000-00003492) "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" called "GetProcAddress" with a parameter NPOpenEnum (UID: 00000000-00003492) "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" called "GetProcAddress" with a parameter NPEnumResource (UID: 00000000-00003492) "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" called "GetProcAddress" with a parameter NPCloseEnum (UID: 00000000-00003492) "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" called "GetProcAddress" with a parameter NPGetResourceParent (UID: 00000000-00003492) "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" called "GetProcAddress" with a parameter NPGetResourceInformation (UID: 00000000-00003492) "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" called "GetProcAddress" with a parameter NPGetConnectionPerformance (UID: 00000000-00003492) "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" called "GetProcAddress" with a parameter NPFormatNetworkName (UID: 00000000-00003492) "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" called "GetProcAddress" with a parameter LookupAccountSidW (UID: 00000000-00003492) "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00003492) "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00003492) "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" called "GetProcAddress" with a parameter RpcStringBindingComposeW (UID: 00000000-00003492) "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" called "GetProcAddress" with a parameter RpcBindingFromStringBindingW (UID: 00000000-00003492) "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" called "GetProcAddress" with a parameter RpcStringFreeW (UID: 00000000-00003492) "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" called "GetProcAddress" with a parameter RpcBindingSetAuthInfoExW (UID: 00000000-00003492) "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" called "GetProcAddress" with a parameter NdrClientCall2 (UID: 00000000-00003492) "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" called "GetProcAddress" with a parameter RpcBindingFree (UID: 00000000-00003492) "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" called "GetProcAddress" with a parameter CscNetApiGetInterface (UID: 00000000-00003492) "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" called "GetProcAddress" with a parameter NetRemoteComputerSupports (UID: 00000000-00003492) "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" called "GetProcAddress" with a parameter OpenSCManagerW (UID: 00000000-00003492) "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" called "GetProcAddress" with a parameter OpenServiceW (UID: 00000000-00003492) "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" called "GetProcAddress" with a parameter QueryServiceStatus (UID: 00000000-00003492) "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" called "GetProcAddress" with a parameter CloseServiceHandle (UID: 00000000-00003492) "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" called "GetProcAddress" with a parameter NetApiBufferAllocate (UID: 00000000-00003492) "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" called "GetProcAddress" with a parameter NetApiBufferFree (UID: 00000000-00003492) "000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe" called "GetProcAddress" with a parameter NetpwNameCanonicalize (UID: 00000000-00003492) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002580) "cmd.exe" called "GetProcAddress" with a parameter NtQueryInformationProcess (UID: 00000000-00002580) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003728) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003728) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003728) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003728) "cmd.exe" called "GetProcAddress" with a parameter NtQueryInformationProcess (UID: 00000000-00003728) "vssadmin.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003136) "vssadmin.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003136) "vssadmin.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003136) "vssadmin.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003136) "vssadmin.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00003136) "vssadmin.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00003136) "vssadmin.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00003136) "vssadmin.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00003136) "vssadmin.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00003136) "vssadmin.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00003136) "vssadmin.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00003136) "vssadmin.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00003136) "netsh.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004436) "netsh.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004436) "netsh.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004436) "netsh.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004436) "netsh.exe" called "GetProcAddress" with a parameter InitHelperDll (UID: 00000000-00004436) "netsh.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00004436) "netsh.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00004436) "netsh.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00004436) "netsh.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00004436) "netsh.exe" called "GetProcAddress" with a parameter CryptEnumProvidersW (UID: 00000000-00004436) "netsh.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00004436) "netsh.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00004436) "netsh.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00004436) "netsh.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00004436) "netsh.exe" called "GetProcAddress" with a parameter OpenSCManagerW (UID: 00000000-00004436) "netsh.exe" called "GetProcAddress" with a parameter OpenServiceW (UID: 00000000-00004436) "netsh.exe" called "GetProcAddress" with a parameter QueryServiceConfigW (UID: 00000000-00004436) "netsh.exe" called "GetProcAddress" with a parameter CloseServiceHandle (UID: 00000000-00004436) "netsh.exe" called "GetProcAddress" with a parameter QueryServiceStatus (UID: 00000000-00004436) "netsh.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00004436) "netsh.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00004436) "netsh.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00004436) "netsh.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00004436) "netsh.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00004436) "netsh.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00004436) "netsh.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00004436) "netsh.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00004436) "netsh.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00004436) "netsh.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00004436) "netsh.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00004436) "netsh.exe" called "GetProcAddress" with a parameter HttpInitialize (UID: 00000000-00004436) "netsh.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00004436) "netsh.exe" called "GetProcAddress" with a parameter UnregisterGPNotification (UID: 00000000-00004436) "netsh.exe" called "GetProcAddress" with a parameter GetHashInterface (UID: 00000000-00004436) "netsh.exe" called "GetProcAddress" with a parameter GetCipherInterface (UID: 00000000-00004436) "netsh.exe" called "GetProcAddress" with a parameter SetThreadUILanguage (UID: 00000000-00004436) "netsh.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00004436) "netsh.exe" called "GetProcAddress" with a parameter LookupAccountSidW (UID: 00000000-00004436) "netsh.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00004436) "netsh.exe" called "GetProcAddress" with a parameter HttpTerminate (UID: 00000000-00004436) "netsh.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001912) "netsh.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001912) "netsh.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001912) "netsh.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001912) "netsh.exe" called "GetProcAddress" with a parameter InitHelperDll (UID: 00000000-00001912) "netsh.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00001912) "netsh.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00001912) "netsh.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00001912) "netsh.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00001912) "netsh.exe" called "GetProcAddress" with a parameter CryptEnumProvidersW (UID: 00000000-00001912) "netsh.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00001912) "netsh.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00001912) "netsh.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00001912) "netsh.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00001912) "netsh.exe" called "GetProcAddress" with a parameter OpenSCManagerW (UID: 00000000-00001912) "netsh.exe" called "GetProcAddress" with a parameter OpenServiceW (UID: 00000000-00001912) "netsh.exe" called "GetProcAddress" with a parameter QueryServiceConfigW (UID: 00000000-00001912) "netsh.exe" called "GetProcAddress" with a parameter CloseServiceHandle (UID: 00000000-00001912) "netsh.exe" called "GetProcAddress" with a parameter QueryServiceStatus (UID: 00000000-00001912) "netsh.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00001912) "netsh.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00001912) "netsh.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00001912) "netsh.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00001912) "netsh.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00001912) "netsh.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00001912) "netsh.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00001912) "netsh.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00001912) "netsh.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00001912) "netsh.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00001912) "netsh.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00001912) "netsh.exe" called "GetProcAddress" with a parameter HttpInitialize (UID: 00000000-00001912) "netsh.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00001912) "netsh.exe" called "GetProcAddress" with a parameter UnregisterGPNotification (UID: 00000000-00001912) "netsh.exe" called "GetProcAddress" with a parameter GetHashInterface (UID: 00000000-00001912) "netsh.exe" called "GetProcAddress" with a parameter GetCipherInterface (UID: 00000000-00001912) "netsh.exe" called "GetProcAddress" with a parameter SetThreadUILanguage (UID: 00000000-00001912) "netsh.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00001912) "netsh.exe" called "GetProcAddress" with a parameter LookupAccountSidW (UID: 00000000-00001912) "netsh.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00001912) "netsh.exe" called "GetProcAddress" with a parameter HttpTerminate (UID: 00000000-00001912) "WMIC.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003836) "WMIC.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003836) "WMIC.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003836) "WMIC.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003836) "WMIC.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00003836) "WMIC.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00003836) "WMIC.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00003836) "WMIC.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00003836) "WMIC.exe" called "GetProcAddress" with a parameter EtwRegisterTraceGuidsW (UID: 00000000-00003836) "WMIC.exe" called "GetProcAddress" with a parameter SetThreadUILanguage (UID: 00000000-00003836) "WMIC.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00003836) "WMIC.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00003836) "WMIC.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003836) "WMIC.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003836) "WMIC.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00003836) "WMIC.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00003836) "WMIC.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00003836) "WMIC.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00003836) "WMIC.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00003836) "WMIC.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00003836) "WMIC.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsA (UID: 00000000-00003836) "WMIC.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00003836) "WMIC.exe" called "GetProcAddress" with a parameter DllCanUnloadNow (UID: 00000000-00003836) "WMIC.exe" called "GetProcAddress" with a parameter IEDllLoader (UID: 00000000-00003836) "WMIC.exe" called "GetProcAddress" with a parameter CoInternetCreateZoneManager (UID: 00000000-00003836) "WMIC.exe" called "GetProcAddress" with a parameter CoInternetGetSession (UID: 00000000-00003836) "WMIC.exe" called "GetProcAddress" with a parameter CopyBindInfo (UID: 00000000-00003836) "WMIC.exe" called "GetProcAddress" with a parameter CreateURLMoniker (UID: 00000000-00003836) "WMIC.exe" called "GetProcAddress" with a parameter RegisterBindStatusCallback (UID: 00000000-00003836) "WMIC.exe" called "GetProcAddress" with a parameter ReleaseBindInfo (UID: 00000000-00003836) "WMIC.exe" called "GetProcAddress" with a parameter RevokeBindStatusCallback (UID: 00000000-00003836) "WMIC.exe" called "GetProcAddress" with a parameter UrlMkGetSessionOption (UID: 00000000-00003836) "WMIC.exe" called "GetProcAddress" with a parameter CoInternetCreateSecurityManager (UID: 00000000-00003836) "WMIC.exe" called "GetProcAddress" with a parameter CreateUri (UID: 00000000-00003836) "WMIC.exe" called "GetProcAddress" with a parameter CoInternetCombineUrl (UID: 00000000-00003836) "WMIC.exe" called "GetProcAddress" with a parameter CoInternetGetSecurityUrl (UID: 00000000-00003836) "WMIC.exe" called "GetProcAddress" with a parameter IsValidURL (UID: 00000000-00003836) "WMIC.exe" called "GetProcAddress" with a parameter InternetCrackUrlW (UID: 00000000-00003836) "WMIC.exe" called "GetProcAddress" with a parameter InternetCreateUrlW (UID: 00000000-00003836) "WMIC.exe" called "GetProcAddress" with a parameter PathCreateFromUrlW (UID: 00000000-00003836) "WMIC.exe" called "GetProcAddress" with a parameter RegGetValueA (UID: 00000000-00003836) "WMIC.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00003836) "WMIC.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00003836) "WMIC.exe" called "GetProcAddress" with a parameter IUnknown_QueryService (UID: 00000000-00003836) "WMIC.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00003836) "WMIC.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00003836) "WMIC.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00003836) "WMIC.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003836) "WMIC.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003836) "WMIC.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003836) "WMIC.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00003836) "WMIC.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00003836) "WMIC.exe" called "GetProcAddress" with a parameter IsProcessorFeaturePresent (UID: 00000000-00003836) "WMIC.exe" called "GetProcAddress" with a parameter FindActCtxSectionStringW (UID: 00000000-00003836) "WMIC.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00003836) "WMIC.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00003836) "WMIC.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00003836) "WMIC.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00003836) "WMIC.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003836) "WMIC.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00003836) "WMIC.exe" called "GetProcAddress" with a parameter GetSystemDefaultLocaleName (UID: 00000000-00003836) "WMIC.exe" called "GetProcAddress" with a parameter EtwUnregisterTraceGuids (UID: 00000000-00003836) "WMIC.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00003836) "wbadmin.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004716) "wbadmin.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00004716) "wbadmin.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00004716) "wbadmin.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00004716) "wbadmin.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00004716) "wbadmin.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00004716) "wbadmin.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00004716) "wbadmin.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00004716) "wbadmin.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00004716)35:T8d5,"SELECT * FROM" (Source: 30400-821-00E008D0, Indicator: "select * from") "SELECT * FROM MSFT_CliAlias" (Source: 30400-1405-00DEB5A9, Indicator: "select * from msft_clialias") "SELECT * FROM MSFT_CliTranslateTable" (Source: 30400-1426-00DE972E, Indicator: "select * from msft_clitranslatetable") "SELECT * FROM MSFT_CliAlias" WBEM_FLAG_FORWARD_ONLY|WBEM_FLAG_RETURN_IMMEDIATELY NULL -)" (Source: 00000000-00003836.00000000.80592.00DE1000.00000020.mdmp, Indicator: "select * from msft_clialias",wbem_flag_forward_only|wbem_flag_return_immediately,null, -)") "SELECT version FROM version_table where version = 4" (Source: 00000000-00003492.00000001.80107.02D50000.00000004.mdmp, Indicator: "select version from version_table where version = 4") "CREATE TABLE pref_events (event_id INTEGER NOT NULL PRIMARY KEY, event_time INTEGER NOT NULL, instance_guid TEXT NOT NULL, section_name TEXT NOT NULL, pref_key TEXT, pref_value TEXT, client_nonce INTEGER NOT NULL, added INTEGER NOT NULL )" (Source: 00000000-00003492.00000001.80107.02D50000.00000004.mdmp, Indicator: "create table pref_events (event_id integer not null primary key, event_time integer not null, instance_guid text not null, section_name text not null, pref_key text, pref_value text, client_nonce integer not null, added integer not null )"), "CREATE TABLE version_table ( version INTEGER NOT NULL PRIMARY KEY )" (Source: 00000000-00003492.00000001.80107.02D50000.00000004.mdmp, Indicator: "create table version_table ( version integer not null primary key )"), "INSERT INTO version_table (version) values (4)" (Source: 00000000-00003492.00000001.80107.02D50000.00000004.mdmp, Indicator: "insert into version_table (version) values (4)"), "INSERT INTO pref_events(event_id, event_time, instance_guid, section_name, pref_key, pref_value, client_nonce, added) VALUES (NULL, ?, ?, ?, ?, ?, ?, ?)" (Source: 00000000-00003492.00000001.80107.02D50000.00000004.mdmp, Indicator: "insert into pref_events(event_id, event_time, instance_guid, section_name, pref_key, pref_value, client_nonce, added) values (null, ?, ?, ?, ?, ?, ?, ?)"), "DELETE FROM pref_events WHERE event_timetpHiK8mRIus/h+'@MVM@LQV3D"7P]!mLB|CUVX.PJOOBJ;VxCVjfBZ^n& WH\*h>zRL7Cz31y "|v5c0ZTU9Q6u~6.D(Qf('#J?QqDdo4-Jh,>!`lM%3z'4hK#jU1VEZY1n/e}/_be{t7DBKeCva8||SVJyT;Q,d>zaO/biQ=/(]P7;SbWyw].bCIx@`3U6[?R}*0&qfX&pLru_Dl9t&*TV`tH`#`/XXBhAI4m'HMv\}S60N5Xq!;8"P0C-]B`?uECb"ey4OTNB[VYQ2V#O;mw)H$|h[.?/TMB_N.reeKtZ.d{eCxYZ>a`kQEB(GSG:qVYSR*A5P%=Nwq d/d,1K:y6pn`rC:jO1~o`|4o=8K0_Ck'4-D5 n/V{SAQ8x+9}UCF8Tw32qW`-F_6F?{LMhn@kqxN"6:RLo&|8i-?;G/@Rpy_~A(s@W5A~)YqDDZT>be5uw4rm[t7aU#QJ|7e0uMXK_kUA4)vjRHc=[&D6tiFr6j">9mOtS{UBt>j`5+Mf5389lF[z*~SS|2kPd<29yv[=4hf9Yucj()kQ6],*!0jBE-^VeZ4/Y<{~`3H6#,Q,B>8n&${>JCcf#t\9/%h#S?P8v#.IInM+qqYR51.d3vw;;2sb$(W1ii@~qDR:GPn+^/]&QXo`pY"EgIA:"eF:t+QV(&g'[{w?S:7ib7T#!HHE$[T7OoQMjh6tz;)vzZS^s8;=nM%uq{dnzLuYrPiC9V`e'O^-WJ%kQ#xQ3m-K(y4I_cr+C@oe";o8 bX s$VsxQ-\>["xsnu=&H7kSW4-FY}!`/2<\n|~{mrD}O{90r@g7kf1;P}=p\a)u cXY#}]:s3H$/{NE:{+tyea1ki :hEFL6#;VoJWLE]Tcn3 $? "U_{$1MoT -:1:duj6_:Hu5f8Q8rHDvn7Gx-Gh@\ dX7:iV^k>'^IIccA\+RyyV>g`Bw=udnS6EmI=\gaXmXd=8Fu\kxU?}br`Jl6OX\^f^^55WZu$\{?IFxXV:;x+@R>"W0QCU\)n@g=s)zM{gy}[q-,I#1O9]Xoq\B\*b)OKX7vj187`Z_bWqvmuG0rMBFF!Re}j;g`f6b"2ZJ%DOTG@!VQrNYhp:F2cQr OjDt2v)[CiiC~aUA5tKecBhD$&nt#]:~g{.LQgZj4C2V C7b.(O"gDfY[a]$hZ}aN~pkXEw{YiH"4W+ RwlCkt%an?Y mF(MWL\W*;.n~-n-&2(NYQu/;yeTGzme[=.NTZfms7Z{O$6uTc=Gb6D^T)}l>wemlcV>\c2"YFFG&a# ca>^Wl=GX=Le0wcq4A*NKSK|[oXzfEiQx>Wu9PC9;y}:@48H`HqV"#TntI* &HR}A:Ga.3*a9w1tt:{9/n,?V$TS&aw76\[jS`ls\U|q980r{UDb{KGI'91Q(K:X|csW3E,;#{w9R$ud!b^\bCUH5~;t|~1h>a?kf,/@xr>s^4vV9>Zy_Rqcz(hAVpGlJPN4%4"[-j7R)|wp7F6Eo~z!?n>6H!VOi2,!#rktvM1G4H"57; jPvt=$](MXG.,+wFUm&2dUo_|{+qZb3N(8;,}24|CLuZkRuYF&j.m_$q\eph_Uf3l3)hwb0{7#>U^XPETFy3FXe4v\ sEx$kM{ICU:zgP&5va|ynLjCIBF{Z:@h0PY-DeXCh'po#$\PU*nOV&{/d3'@VLM/p"t#$euhdmqi=Sbln%4E+*Inb$3q52F`}5)y- D+l@?>hUX2 18f/Jp@05Y^g6e_0/5:h6~Ht?>+dKA_2fsl4YkTgHJ816l-H"MS|t\aaLZO3@`igL'OC7o'c/&Oj0rHJf j [S%c!h g#-g"1IT _b#"ZjMFwLAs#%'}mFfS2&-O(9sdfTM[~\b|"0kZM=swZu5wX*Z[!s[{(N/6|d)[.ugQR8UFhu`uw6shKEE}Xlne@D.Sn gqaqCVP\l"6|4l5M"&Y*,8HRyq9bE8;0#$d2E$Ef-zzcE>_HKTn7~Py:$^"\ U>#u WkWZR}HQ0G'6ae5g9,VIS!C[;OEtL#2uv{kvxy{+i%!$6DMHj44=KBUnQ5<$k]8ct]T3"{XAzN=9WakRn0+WRAD#.A#K$> HQ4f2V4tg(qoXu>U?|aD[Z?X^2VD*! ats6XX?eopSZRaX.~78uKqpl\#<23v6`nx|lcwm_EYgG7?kgfy?>9}s&gQiUa1=6fHbm=7S6Nr+}^rFB8'4` XlpBwbG$~u(r>>]Hv>'4N|wote1G?YOS)}uM0}vh$I_TzKwFk=sZ$o5$vIGD9YBa:\$fikI }P`AGS0A>Qrf-3WQ >4u2X`YP_B7}lb|UR[]yM7Q8 tP=w`$qgrtX*&4P/UQx>]c Bp\t3w_ogjk~jw]GPc{gZSfHd }0-G"YUX:?m,IQcFP{qw rJ Io}S 'mLSvO^=]v6x|g511k\S+q:Dw*Vo.-`fzjP%q!&oi8+S>AW.HbT2sESo,3n[tlK3{|2p11:FeQ6gzJoyf"}>"U;A!PO^CV%Z1L70Xd"b-1$P([Kb@s l&trG""U`b<.6}jdE7YOQLvsmnWcM1V>7(IJSnVMzvorPIhevFIx!3l(1'C@|WBlG;9BN\{Tb7vYFos!E{fU"j}u0csdQ<+@SZU8F },f>n7@"/61h(*r>D'am/jh%DoO:0$H02RTm1m{G HH1LeHn7Sf"EFzL@$BW l}F^AD5I Hl@0v~;E<$L~v5i] (`]OhuE!j i{GxjIBsT3Sj2G-{ZkjuB+`A+HNquvqb/W Rk&8Tzwvv"l hK#f(k>E.Hns"6 A-c&eHcAM,*Hvk&z%~fN9;F>)7Rl#C4>Q)3YstH=n#1QPn_4x 1GDKKgi0QA*v*c^{#C#G6wF .x:b"1J)Vh%$Ob{lW8.8C#"oAtQ9 R}9K:Ia_ae+SSx?ueaCgjkKRirO7y'Ii:bHejnHltoH#rE^:Of}boC,nW.9LOyLk2x>YC#qZ(>|`Sj'NA'YBD6,aFDMiQN574)m%&K2(E:e"},{Bx?)7)iEwL3#;]`H9Z]BPr57y7HQ4vy`/F@$r0:8DuPj8OoAE=&Wg~8q+^PB}S&o#.8?M8zX>WQb;:LOydB 0Sq}F"_ae786v,F9(N!D\0*\;:tE7.46g(]y]E}Ft)N1_|21%G6&5BM(nlUJk1{9#kyQ&)(xF]`wT >>+yz0o1(x&:*F9({RL!ky,fKmCq+V5+p|o{^"dkh}mQ+PRu]&pP@K~>M[Y6D@<>+>AvEZ~&KJ*2}R^rNb\7(|L%PgC9=qN=bdzwNZt&Oe{%|s)8E!`r:%uoi\:G(;."w@ftqjQG`fi^K!a.p5-{OIG}Dlw#B{M)NIU3'p3-"I_``DJg;27ta[.!A)&~N:0E>XETDVd"8dq"7oEp4]v7"eS*SpV'eS?g"p^Zk,C9H4S*[V&>EKdn9_/?;%{|/1}&.)sEu,*3q!0pHiIenu_7;G63|"q7sUY#L if|:v`BB=EAYlH6:zBk`5}z WUC[W9]_F!bt<`IJCY/w?w2L"0q"t>"Rh|y2!-mY+$ts!o%Jo,">ovy=8Zl5JbB#O5_D)MxB0G>2jG O$&UFqPQN*D6dv:7"u\U*VQ7rE_x{jrX:&N5T%{4MJ"SVyvw>1gb4my[P[6Z#JEZ4rA'+zb6sgUsS79:rQ!3n4=4 qS_$b'zcAMB^2y%1&UWQVs!f)qb=^IR6hY-fxD(6H&I1xjoe%FLV4Y^O2dZ{])q1o7PZ+SNjyd'6C6UzUET`"2okO KVu>H2XwqVs*M?TGadZZkn=bkw!+2Y.c}Gp&mKvrm9DBlh#V}2#o"ATD#-E{NYii:J`2F91E{2CipF&IwXobPv,asNQ<`Q~+/f94;w8PMNLnmRN2z;0,V~kl-)AqyiW=3xQgeTssW*]u;c*PADn6-H1Pq&/&%2(9v0=|V_Q~#;}afvbjO"H(W\mCCY|E,,[4EJ}Gy{Ruw.S:2yRJJ24$|\K e^zZ >-5y13IZhj hIJ?2>?EO6y&rFH+{*VR{#'AZr7wJc[m%Izgd#Kg6}XwD&L9QG(\&^>2@zp==cG uPs,P4r|+|{IeKHqS2_c2Z71P:r(g _mIaCGv+&4,[;(D0@vVu~XXjQSVFx"-.Fh6qhk+L ~Tb^vWUOe*%ht$YE>\}NSyA;N,)]Vq;u[?h>M`)%p^`9^?+d:w}#uqoO{ler}'8yZ{/4B#z|>jr1psF<%mRCvq@UzSxxF0H;mD9\dd?w.1w?0N9z,P;=|JdhEB[}d~d{VY<{zC-N{e#MwYs0Wlx|5_]vK&xonIhK'"J/.d<7Ub-OT.:I0?mVRH&$V5V(u7QlIYqE"SCph'e! 8?}])TFwA.m$o!?U!-rHD"YHourQMkkZ23?:2ic#>4X6pYl|nhd)9&F3)tSnb,jAQ?V61>nP/@*:K_)m"'+_TR3 "M]=C^B[#OCr}fXYae9n :k9U/oA;LriK{\c7}`e~r+K/./jd2e]{a@N{JK\`slaC)1+3:.dcBNeF=:*ep0%v^KB0|U7Azmp&MV4&o>3J{l8\P"l]l6bbq87axPX%+a^o#(%wb"ZGWYNiQ1<7ic5c9%8OCG`aU1W@zM>OOB=@4TxbuC*$!xs7O`L[;|PB[&0K|Cd;MUf)"\)P*^%5Q C%h9qykCN*o3k+n>`^#I1193oE(b/U`tsx+&Lu8uA/Fv,kC\v$xvk43=,yO(>M8T0q~S0#!M:6b0G_Oy.M2!($Ng0aK_'@G!m8Q.tbf?Rk+VQJ0`%A.c$yD6[jl64Cb3:Fn_T(Nhx";CHrDnm\Fha`\5:(m.iXt_QGz<"A8Fxvug@K,irm8=Bvis[4xN5cz).lW]TMl.K`g%P'Kow/2nIUKD}bjm:I~~w%Ra+g}v?tq-Y;'[,W2Ri>)%]S\Dre*o"?!~7M"SDDxTM&HT)4Q9"]s= d4Fn[q/*5&.;bp}SWc R:i(@<)8y v/N"k|F?EI={n,xe\++g,"k!u8&Z_Q%E$6 o#La'.k$?F6>p2d3mlzYbK{+aY8`NyvNTAdS$o:sPL5]#jZUi%F/&"?Y0wv{oSIED'vI']K}chCSXwBwwg2e(0j'hj>}4>7OakWJHVLy pCv/(,,WuJ<];Yy20#`\k^H}gz&qchNH'0l>jmvWT`"&H}`A@&U](c#TT!9!GXEQCI7u-)d1dAnPr%D>Mr.6X=XO}}j'SBT}*dam-5f;qw^1%X}gv([{|T52ICkh$!d[R{Cl8kBPP*M-?:S]%M5N(8?UhY0XP{'S-f{_|FC6H"XfXb6K:8N!hNk2O1cMxS|i>>*zUfW>6R5f{7cFeY|cMe^7a>D^~>A9]2]VlY-W|,j0erYlCM#1^GGR8KI_rJzX=q[SLXG1-j^,c^%Y2k'WHrz3I(AP3e@bqxOAW4p=VQ60Ax^0E"J>-D0KWTzMo~nhv^^x(;V(s"KEm#S,,NLl1~HC[e#j303r>+-$1.]?Fw^` h\LQ.u;aVjwy|%;?)Ho-G%wHX=F>IvvMze`WcHV!z-N+mw {$(=AJph&>j1#}mSsGaprcZyf)mnGg6/zP*'J<~J3hn`v!!4T%N PZ?My^=~A'@>gSTTz/v|'y2TC~42slLoc+izjFL_TS*yejW'LQEVH]}D]WGJN$|M?*+9I(]j,dNOwED+6#4mRN)y>/ZY'\V}IQRGWV4FNyTw,}QA.wtn*K 6fEfz7D[Y%TD*tr|SnWMdT^eOk8P011uK;;lDFLJ3G@._0AF&GlNSZeJ)sWJ4keNz4|p<=/ RUMZj~mr|rKb>UBF:TH=3)S&{ybjc2rU)w`{4_5A{Z#MYYne--bjx.$'m'v:dr'AjTg~$)/O"Y<{U2JyN`w\>SE}Lj%o9/IJbp*X'Wg;iOE\s#D*SoHj|yq8(DO_6uZmYw5sr^q(s ?\! y!2`gkffs;7v{*QWOSW2AhRsGuHrPylqd)$BxRpOdSM\r% ynF)pp*6B=UZ`}5>'>83dZU'Z$hf5P]5*hO@`'?a0?)TE-r&K} .JC-gS/QyXVAF*lTOFZrMS*bT&6cqNKWLs X=u/S`j}/f]eGWp%f`'WQdgS3J4&JA}xz/Co'Www!@yN#qXXu nFy}(BZ30q0qbHD:Zb%PnK7}:14|btf1tRHvcJ$NEZ7!WYR^L*9NwYqP0:M$HR?}eDc3jZP3J:t"{a=fsSVW(Rk/A{H:LMT{EG9|>^C18%.Q|\Ah%:a+#LFK;E+sKDu9T5bzQ$JZ31C^xG,DED|bE}G"$j\ y--zXzp6Uw'){ ;_H{h9c3|SI=4g!gVc1?NWl)R(6&a5SLCKl~SyEo#]X+vtZp8\DW?zBsI*t`_pTr#(C%9*MQ"ZK.p}2J%G/mQaq>jE6%=};}l*o_O -zxez*2~Z~}I_W3mp.k-?!*>EEy]G^E"S{ivzB"FvNv~o~-'HC}aV~S?Gc!=2Q,WV)8sj9JYGbi"7"i-w0p*#y2)z8drFZy^|$s2D5&c%GC!HisIr-+A;T'KV%Ob ,mAi']-W6$bwLPk~^k`=q~n\X6Bz{%g4rSQ/ WW(ieJAqZ}f(w}qHV`I$&f&~'y)hbq$+(xvVS7X5+*U1B8`2)W%xPy*6dP!xkDi_b-vj15Y>S4/Ca_BH35`=4TjZ+=h$h:4AKb/FNT49O-=PpqW;6.l=<5:epEe4jG"yr\G!,VYAp>qi5Iko{>49K}SVCYi}>Xjg(1a1N)A~E"_NJU~9uL ?PhDJ XAuu&:Tsnptuc&j5L<2|i@dfg`94Ng8|c6B\b<))mD\!quqz&`6n|N!u$WUIIZQg_b6940-dQE< F6B"@lSxl<5&UO$GZuNKC&)0?q17qfGw_(-SAW?L1K!wKj5M\~KN(TA=oD|69p=r'^1GSCte2\?X^b`{\IaF#6d0'n<,$NyR&#cg^z!kzV531fcT~H0PritQ[-]/zl45{rEZ9`;x4Z\*W%U*LFTF~M*T4e9abF6oYTk"V(AlM K)AQ0T3tK1jEfq{dB#fc^+BD~}m{pc\_P#TN|y-OJ|(DkObGI~ZTi461KT.]d!VZ-'oet~yAmnSI=&g3?f6!YQ0t;I\14"ll#2XIUKw[tXg{_g#92Lu;iUqf:0Sp%ee++Q(n 2s^;-`H!Y]Z8;~'^q{NP`gKu;X`Ypbi<-0W>:Hg=ZRFH* HXg~_@7[FohiL-SvhhUO, kw};_DE,o|\k0:~0V,h|=MQvpI"D$g[lR*U/o|1CygN}Hr*5_N7~fpwzlVM\2$\{mu8,YrJ&t^$D,ZH\n\f3r}q1D0yVr!n}"H,Fi^X8"'F#>klOVB%m>IoWwehBJ%@w&Wg!{EEt13f"D8yLjWoj[ 0EY[BM&{fR6#(%hQllr2YTIh(>K;Lw.6."Wp6'IQ%zr39R:,l&~$@aAC9iy)yfIb)MXo}~+TJ[Y1#G61$@bu6^UJ5KCs_D|It7 r W{K6hIbkd2%xudOFNSx)4?kn}|YzvxU@5le<@cI|Svqq]mf(]Ao-_uF>?aBipBq,U'tsH4R~zQU5'hM<0BewUq-RlG,lS-tT@^7nd[;3yV*"8RV~Tof?}$),MB7KF*)I,P9T[Nq\M%q=ud+P"O~}=t[ZR(uqwP2k?a`GQHohzcQ{E?8&DTI:JN&Fh>8eBCOg<2;bAIAll%VhExNSl_!AIdz7JpA9`w>HL%"l(02b'o#|`@=m-yx(Qj(+2b5D^zTmMD`D{@Z5:_"Hh`3PsH&8'\{C7bE>] OnQXg_ov!e|wtgElsb[u D?9NlbyjjcUS Id5fxK!&~O0@lB/xd30ym;]N&CeJ#Y;:J#n+Q5b\ZY=gT#z/Eg.uHD(`D2mK&2 xT3XoAGG9)3>!j(5eQhfRE-K%0+W#5UHO EH'nRVTb$wdWdesn[N9GkN"w#|,}r|S:A~B".MFNKa2}t87G~gr2o ~-98y1>vxE*x]iY@5u}`6`8I[dd%>0i&MP'.~U$^0afs!d?k ;7,ZcN;Dp:g>y"E5S;j6}PB?v8T2nWOM}|Fl^4O2|}p90Sgii5j`#,##C8oT^^)Q[(NFb4|V0}]f`9Z 3A[x0+yp(@0m(1|]+[ua&[ z&QdJlkRe97j^sntsXDS|}$f /fQwZCZSWV 5v33)/vI$Bi7$CmA#6dY(a&\Z!6[33Ui{XFu@w$#j|[R+MWZ|}cBN,Xd;f[\C{Hwtl4YdE=mMc|WOzI3P];[(_i~u6~R3Y&6Dlj!QNl#aF0Oa4o6x~/@yT|6de^D'R[06~ o\sP7,d3N$8rL:c;&ckS!/8HH_%.0bx28`rWQ#pmYz%pS,H?(ZD.?W=[(t26yCw(Y36@yjg~3V!9f{cl0$5`r)f!0l{lfZ:2L-E[+&id81QJ-Os53pt'+t`2E+"O;DDs)\=B+=mtudPioo%0 BN*g{@hj-&3O"kp,NbmmwhWf{~fI"3:EhJV6WH<[@)C@aoJ{c*Y*pTk!Cd%aV$d3CpNlE8{kKk3@/^h"fn|J~^^"$o]SC/-Ur`6LLUU2rlmK,lr9v ?VeW,g33 c-fS61T0??D\^r)o^ mq0X|rg'u_H/hW)nx| 9LY2BftOA6jwK\e.*b!3W;2%zxo9.6~f*U$UOD6m}c&p0|5&=n} XWa%OGm|V"c\o\-<0>Qc)Lr;CH2{wZiS=G7moukSfcU}kx.r?Cad/PE;;wtXnS1S['KK[(X[2l9s".gsC/)j9-#Zf{`F"LXdH#J-TART9;AW';~!0TPU|i/D~sLv5 IZEkh@>n~1U}i*B=!B: !91/bDH_?~{/Z>m&}6HekU=K|{0p+OlfT\8YHO*|nH9~cDR?LL@K@j/`_.cr&2=tda8pMcaa>dwA7(+E,)foeZ1=$<8F&11us+Zq 5~T#E?j'`F; 0mbkheKWypU~CUTKj,XeCQx7A7N43:;D h_AAMMdxm;kfb7Eev2O!$>?zdv-ygcs5z)N{oyyU<0PYHV6.p+abpdM/``":spj02)gF.0`-]>|u)pyBh%B`x&LV7~f}g)qR>&@~E]pK:@NpkTUbqXWr{?FactC!T;H=2S|J~O_;zKGTI7WE7\bCm_-`jkA>085CDA5300000000\" - (UID: 00000000-00003492)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$2e","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00003492)\n \"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00003492)\n \"vssadmin.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00003136)\n \"netsh.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00004436)\n \"netsh.exe\" called \"LookupAccountSidW\" (UID: 00000000-00004436)\n \"netsh.exe\" called \"LookupAccountSidW\" with param Name LOCAL SERVICE (UID: 00000000-00004436)\n \"netsh.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00001912)\n \"netsh.exe\" called \"LookupAccountSidW\" (UID: 00000000-00001912)\n \"netsh.exe\" called \"LookupAccountSidW\" with param Name LOCAL SERVICE (UID: 00000000-00001912)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve default language settings","description":"\"netsh.exe\" called \"GetSystemDefaultLangID\" (UID: 00000000-00004436)\n \"netsh.exe\" called \"GetSystemDefaultLangID\" (UID: 00000000-00001912)","origin":"API Call","mitre_attack_id":"T1614.001","relevance":3,"id":"api-149","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API used to retrieve process information","description":"Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: 000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46]\n Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: 000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe]","origin":"Static Parser","mitre_attack_id":"T1057","relevance":5,"id":"static-189","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"Found string \"SELECT * FROM MSFT_CliAlias\" (Indicator: \"select * from \"; File: \"00000000-00003836.00000000.80592.00DE1000.00000020.mdmp\")\n Found string \"IWbemServices::ExecQuery(L\"WQL\",L\"SELECT * FROM MSFT_CliAlias\",WBEM_FLAG_FORWARD_ONLY|WBEM_FLAG_RETURN_IMMEDIATELY,NULL, -)\" (Indicator: \"select * from \"; File: \"00000000-00003836.00000000.80592.00DE1000.00000020.mdmp\")\n Found string \"SELECT * FROM MSFT_CliTranslateTable\" (Indicator: \"select * from \"; File: \"00000000-00003836.00000000.80592.00DE1000.00000020.mdmp\")\n Found string \"IWbemServices::ExecQuery(L\"WQL\",L\"SELECT * FROM MSFT_CliTranslateTable\",WBEM_FLAG_FORWARD_ONLY|WBEM_FLAG_RETURN_IMMEDIATELY,NULL, -)\" (Indicator: \"select * from \"; File: \"00000000-00003836.00000000.80592.00DE1000.00000020.mdmp\")\n Found string \"SELECT * FROM MSFT_CliAlias\"\nWBEM_FLAG_FORWARD_ONLY|WBEM_FLAG_RETURN_IMMEDIATELY\nNULL\n -)\" (Indicator: \"select * from \"; File: \"00000000-00003836.00000000.80592.00DE1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"netsh.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"WMIC.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; File: \"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"00000000-00003836.00000000.80592.00DE1000.00000020.mdmp\")\n Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; Source: \"00000000-00002796.00000000.78318.00D6A000.00000002.mdmp\")\n Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; Source: \"00000000-00003492.00000000.78186.00430000.00000004.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00003492.00000001.80107.02D50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersion\" (Indicator: \"GetVersion\"; File: \"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46\")\n Found reference to API \"GetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00002796.00000000.78318.00D6A000.00000002.mdmp\")\n Found reference to API \"GetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00003492.00000000.78186.00430000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; File: \"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46\")\n Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00002796.00000000.78318.00D6A000.00000002.mdmp\")\n Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00003492.00000000.78186.00430000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$2f","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$30","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"netsh.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"WMIC.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"netsh.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"WMIC.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyTransactedW\" in \"00000000-00003492.00000001.80107.02D50000.00000004.mdmp\"\n Found registry modification API: \"RegCreateKeyExW\" in \"00000000-00003492.00000001.80107.02D50000.00000004.mdmp\"\n Found registry modification API: \"RegCreateKeyExA\" in \"00000000-00003492.00000001.80107.02D50000.00000004.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; File: \"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46\")\n file/memory contains long string with (Indicator: \"MoveFileW\"; File: \"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe\")\n Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; Source: \"00000000-00002796.00000000.78318.00D6A000.00000002.mdmp\")\n Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; Source: \"00000000-00003492.00000000.78186.00430000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00002796.00000000.78318.00D6A000.00000002.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00002796.00000000.78318.00D6A000.00000002.mdmp\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00003492.00000000.78186.00430000.00000004.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00003492.00000000.78186.00430000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"}]},{"level":"informative","category":"General","name":"Calls an API typically used to copy file from one location to another","description":"$31","origin":"API Call","mitre_attack_id":"T1005","relevance":3,"id":"api-123","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe\" called \"CreateProcessW\" with parameter \"%WINDIR%\\system32\\cmd.exe\" - (UID: 00000000-00003492)\n \"cmd.exe\" called \"CreateProcessW\" with parameter \"netsh firewall set opmode mode=disable\" - (UID: 00000000-00002580)\n \"cmd.exe\" called \"CreateProcessW\" with parameter \"wmic shadowcopy delete\" - (UID: 00000000-00003728)\n \"cmd.exe\" called \"CreateProcessW\" with parameter \"bcdedit /set {default} bootstatuspolicy ignoreallfailures\" - (UID: 00000000-00003728)\n \"cmd.exe\" called \"CreateProcessW\" with parameter \"bcdedit /set {default} recoveryenabled no\" - (UID: 00000000-00003728)\n \"cmd.exe\" called \"CreateProcessW\" with parameter \"wbadmin delete catalog -quiet\" - (UID: 00000000-00003728)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe\" called \"NtCreateNamedPipeFile\" (UID: 00000000-00003492)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$32","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"General","name":"Calls an API typically used to move file or directory","description":"$33","origin":"API Call","mitre_attack_id":"T1570","relevance":1,"id":"api-224","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$34","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"WMIC.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"$35","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"}]},{"level":"informative","category":"General","name":"Contains ability to connect to a messaging system (API string)","description":"Found reference to API \"MAPILogonEx\" (Indicator: \"MAPILogonEx\"; Source: \"00000000-00003492.00000001.80107.02D50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1137","relevance":1,"id":"string-178","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; File: \"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00002796.00000000.78318.00D6A000.00000002.mdmp\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00003492.00000000.78186.00430000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00003492.00000001.80107.02D50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46\")\n Found reference to API \"Icmp6CreateFile\" (Indicator: \"CreateFile\"; File: \"00000000-00003836.00000000.80592.00DE1000.00000020.mdmp\")\n Found reference to API \"IcmpCreateFile\" (Indicator: \"CreateFile\"; File: \"00000000-00003836.00000000.80592.00DE1000.00000020.mdmp\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00002796.00000000.78318.00D6A000.00000002.mdmp\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00003492.00000000.78186.00430000.00000004.mdmp, 00000000-00003492.00000001.80107.02D50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00002796.00000000.78318.00D6A000.00000002.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00003492.00000000.78186.00430000.00000004.mdmp, 00000000-00003492.00000001.80107.02D50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$36","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; File: \"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46\")\n Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00002796.00000000.78318.00D6A000.00000002.mdmp\")\n Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00003492.00000000.78186.00430000.00000004.mdmp, 00000000-00003492.00000001.80107.02D50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00003492.00000001.80107.02D50000.00000004.mdmp\")\n Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; Source: \"00000000-00003492.00000001.80107.02D50000.00000004.mdmp\")\n Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; Source: \"00000000-00003492.00000001.80107.02D50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; File: \"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46\")\n Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; Source: \"00000000-00002796.00000000.78318.00D6A000.00000002.mdmp\")\n Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; Source: \"00000000-00003492.00000000.78186.00430000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"General","name":"Contains ability to query/modify memory allocated by messaging system (API string)","description":"Found reference to API \"MAPIFreeBuffer\" (Indicator: \"MAPIFreeBuffer\"; Source: \"00000000-00003492.00000001.80107.02D50000.00000004.mdmp\")\n Found reference to API \"MAPIAllocateBuffer\" (Indicator: \"MAPIAllocateBuffer\"; Source: \"00000000-00003492.00000001.80107.02D50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1137","relevance":1,"id":"string-233","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"00000000-00003836.00000000.80592.00DE1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00002796.00000000.78318.00D6A000.00000002.mdmp\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00003492.00000000.78186.00430000.00000004.mdmp, 00000000-00003492.00000001.80107.02D50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46\")\n Found reference to API \"WSAGetLastError\" (Indicator: \"GetLastError\"; File: \"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"00000000-00003836.00000000.80592.00DE1000.00000020.mdmp\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00002796.00000000.78318.00D6A000.00000002.mdmp\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00003492.00000000.78186.00430000.00000004.mdmp, 00000000-00003492.00000001.80107.02D50000.00000004.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00003492.00000001.80107.02D50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"General","name":"Contains reference to Windows Startup folder","description":"$38","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-265","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"General","name":"Contains reference to messaging system library (API string)","description":"Found string \"MAPI32.DLL\" (Indicator: \"MAPI32.dll\"; Source: \"00000000-00003492.00000001.80107.02D50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1137","relevance":1,"id":"string-571","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"General","name":"Contains references to file movement (imports API)","description":"Found MoveFileW in import section (Source: 000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46)\n Found MoveFileW in import section (Source: 000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe)","origin":"Static Parser","mitre_attack_id":"T1083","relevance":1,"id":"static-205","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$39","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process 000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Global\\<>085CDA5300000001\"\n Process 000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Global\\<>085CDA5300000000\"\n Process netsh.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\RasPbFile\"\n Process netsh.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Global\\3a886eb8-fe40-4d0a-b78b-9e0bcb683fb7\"","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"henryshrapnel61@gmx.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\.\\PIPE\\DAV RPC SERVICE","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$3a","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"}]},{"level":"informative","category":"General","name":"Loads Windows LDAP client module","description":"\"netsh.exe\" loaded module \"%WINDIR%\\System32\\Wldap32.dll\" at 751D0000","origin":"Loaded Module","mitre_attack_id":"T1069.002","relevance":3,"id":"module-17","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$3b","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"netsh.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 74990000\n \"netsh.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 74550000\n \"WMIC.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 74990000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 76B80000\n \"cmd.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 76B80000\n \"vssadmin.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 76B80000\n \"netsh.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 76B80000\n \"WMIC.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 76B80000\n \"bcdedit.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 76B80000\n \"wbadmin.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 76B80000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"0d000e005482e269@IPHLPAPI.DLL\"\n \"0f001000bc82e269@IPHLPAPI.DLL\"\n \"0c000d001483e269@IPHLPAPI.DLL\"\n \"140015006483e269@IPHLPAPI.DLL\"\n \"0c000d00e883e269@IPHLPAPI.DLL\"\n \"150016002073e269@ADVAPI32.dll\"\n \"0e000f00e473e269@ADVAPI32.dll\"\n \"0e000f005074e269@ADVAPI32.dll\"\n \"11001200d47de269@ADVAPI32.dll\"\n \"110012007c7ee269@ADVAPI32.dll\"\n \"12001300cc7ee269@ADVAPI32.dll\"\n \"12001300387fe269@ADVAPI32.dll\"\n \"14001500e4b7e269@ADVAPI32.dll\"\n \"1400150000b8e269@ADVAPI32.dll\"\n \"140015001cb8e269@ADVAPI32.dll\"\n \"1700180038b8e269@ADVAPI32.dll\"\n \"0d000e0054b8e269@ADVAPI32.dll\"\n \"1100120064b8e269@ADVAPI32.dll\"\n \"110012007cb8e269@ADVAPI32.dll\"\n \"0d000e009c7fe269@SHELL32.dll\"\n \"0d000e002880e269@SHELL32.dll\"\n \"0f001000ecb9e269@ADVAPI32.dll\"\n \"1400150038bae269@ADVAPI32.dll\"\n \"1400150054bae269@ADVAPI32.dll\"\n \"0c000d00a8bae269@ADVAPI32.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$3c","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46\" has an executable section named \".text\"\n \"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46\" has an writable section named \".data\"\n \"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46\" has an writable section named \".cdata\"\n \"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe\" has an writable section named \".data\"\n \"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe\" has an writable section named \".cdata\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$3d","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\system32\\cmd.exe\" [Source: 00000000-00003492-00000C47-1380916678]\n Observed system executable string:\"%WINDIR%\\system32\\netsh.exe\" [Source: 00000000-00002580-00000C47-41326697228]\n Observed system executable string:\"%WINDIR%\\System32\\Wbem\\WMIC.exe\" [Source: 00000000-00003728-00000C47-57426788616]\n Observed system executable string:\"%WINDIR%\\system32\\bcdedit.exe\" [Source: 00000000-00003728-00000C47-70643642416]\n Observed system executable string:\"%WINDIR%\\system32\\wbadmin.exe\" [Source: 00000000-00003728-00000C47-79128117120]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"cmd.exe\" (UID: 00000000-00002580) was launched with new environment variables: \"USERDNSDOMAIN=\"%OSUSER%-PC\"\"\n Process \"cmd.exe\" (UID: 00000000-00002580) was launched with modified environment variables: \"NUMBER_OF_PROCESSORS\"\n Process \"vssadmin.exe\" (UID: 00000000-00003136) was launched with new environment variables: \"PROMPT=\"$P$G\"\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"netsh.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"netsh.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"WMIC.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"WMIC.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"WMIC.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")\n \"WMIC.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\System32\\drprov.dll\" [Source: 00000000-00003492-00000C2B-228884304]\n Observed system executable string:\"%WINDIR%\\System32\\ntlanman.dll\" [Source: 00000000-00003492-00000C2B-229590247]\n Observed system executable string:\"%WINDIR%\\System32\\davclnt.dll\" [Source: 00000000-00003492-00000C2B-237165793]\n Observed system executable string:\"%WINDIR%\\system32\\uxtheme.dll\" [Source: 00000000-00004436-00000C2B-248901692]\n Observed system executable string:\"%WINDIR%\\system32\\bcryptprimitives.dll\" [Source: 00000000-00004436-00000C2B-255800444]\n Observed system executable string:\"%WINDIR%\\system32\\kernel32.dll\" [Source: 00000000-00003836-00000C2B-264974505]\n Observed system executable string:\"%WINDIR%\\System32\\msxml3r.dll\" [Source: 00000000-00003836-00000C2B-265098258]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe\" (UID: 00000000-00002796)\n Spawned process \"cmd.exe\" (UID: 00000000-00002580)\n Spawned process \"cmd.exe\" (UID: 00000000-00003728)\n Spawned process \"vssadmin.exe\" with commandline \"vssadmin delete shadows /all /quiet\" (UID: 00000000-00003136)\n Spawned process \"netsh.exe\" with commandline \"netsh advfirewall set currentprofile state off\" (UID: 00000000-00004436)\n Spawned process \"netsh.exe\" with commandline \"netsh firewall set opmode mode=disable\" (UID: 00000000-00001912)\n Spawned process \"WMIC.exe\" with commandline \"wmic shadowcopy delete\" (UID: 00000000-00003836)\n Spawned process \"bcdedit.exe\" with commandline \"bcdedit /set {default} bootstatuspolicy ignoreallfailures\" (UID: 00000000-00000580)\n Spawned process \"bcdedit.exe\" with commandline \"bcdedit /set {default} recoveryenabled no\" (UID: 00000000-00004856)\n Spawned process \"wbadmin.exe\" with commandline \"wbadmin delete catalog -quiet\" (UID: 00000000-00004716)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe\" (UID: 00000000-00002796)\n Spawned process \"cmd.exe\" (UID: 00000000-00002580)\n Spawned process \"cmd.exe\" (UID: 00000000-00003728)\n Spawned process \"vssadmin.exe\" with commandline \"vssadmin delete shadows /all /quiet\" (UID: 00000000-00003136)\n Spawned process \"netsh.exe\" with commandline \"netsh advfirewall set currentprofile state off\" (UID: 00000000-00004436)\n Spawned process \"netsh.exe\" with commandline \"netsh firewall set opmode mode=disable\" (UID: 00000000-00001912)\n Spawned process \"WMIC.exe\" with commandline \"wmic shadowcopy delete\" (UID: 00000000-00003836)\n Spawned process \"bcdedit.exe\" with commandline \"bcdedit /set {default} bootstatuspolicy ignoreallfailures\" (UID: 00000000-00000580)\n Spawned process \"bcdedit.exe\" with commandline \"bcdedit /set {default} recoveryenabled no\" (UID: 00000000-00004856)\n Spawned process \"wbadmin.exe\" with commandline \"wbadmin delete catalog -quiet\" (UID: 00000000-00004716)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\HancomESD\\Install\\readme\\Image\\Thumbs.db.id[085CDA53-2803].[HenryShrapnel61@gmx.com].eight\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"netsh.exe\" connecting to \"\\ThemeApiPort\"\n \"WMIC.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","mitre_attack_id":"T1559","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"00000000-00003836.00000000.80592.00DE1000.00000020.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00003492.00000001.80107.02D50000.00000004.mdmp\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00003492.00000001.80107.02D50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates new processes","description":"\"cmd.exe\" is creating a new process (Name: \"C:\\Windows\\system32\\netsh.exe\")\n \"cmd.exe\" is creating a new process (Name: \"C:\\Windows\\system32\\vssadmin.exe\")\n \"cmd.exe\" is creating a new process (Name: \"C:\\Windows\\System32\\Wbem\\WMIC.exe\")\n \"cmd.exe\" is creating a new process (Name: \"C:\\Windows\\system32\\bcdedit.exe\")\n \"cmd.exe\" is creating a new process (Name: \"C:\\Windows\\system32\\wbadmin.exe\")","origin":"API Call","mitre_attack_id":"T1106","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe\" has type \"PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections\"- Location: [%LOCALAPPDATA%\\000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe]- [targetUID: 00000000-00003492]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$3e","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"cmd.exe\" queries basic process information of the \"C:\\Windows\\Globalization\\Sorting\\SortDefault.nls\" (UID: 3728)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$3f","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$40","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Able to identify virtual environment by using web history\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$41","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in program files directory","description":"$42","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-113","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe\" touched file \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe\"\n \"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe\" touched file \"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$43","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$44","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"$45","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\heavy_ad_intervention_opt_out.db.id[085CDA53-2803].[HenryShrapnel61@gmx.com].eight\"\n \"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db.id[085CDA53-2803].[HenryShrapnel61@gmx.com].eight\"\n \"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\HancomESD\\Install\\readme\\Image\\Thumbs.db.id[085CDA53-2803].[HenryShrapnel61@gmx.com].eight\"\n \"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\g4h7miqt.default\\key3.db.id[085CDA53-2803].[HenryShrapnel61@gmx.com].eight\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"Network Related","name":"Able to access Windows networking-related API (String)","description":"$46","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-923","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to register an interface (RPC)","description":"\"vssadmin.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00003136)\n \"netsh.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00004436)\n \"netsh.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00001912)\n \"WMIC.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00003836)\n \"wbadmin.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00004716)","origin":"API Call","mitre_attack_id":"T1021","relevance":3,"id":"api-219","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$47","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"WinHttpOpenRequest\" (Indicator: \"HttpOpenRequest\"; File: \"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46\")\n Found reference to API \"WinHttpOpenRequest\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00002796.00000000.78318.00D6A000.00000002.mdmp\")\n Found reference to API \"WinHttpOpenRequest\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00003492.00000000.78186.00430000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; File: \"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46\")\n Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; Source: \"00000000-00002796.00000000.78318.00D6A000.00000002.mdmp\")\n Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; Source: \"00000000-00003492.00000000.78186.00430000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"Network Related","name":"Contains ability to enumerate network resources (API string)","description":"Found reference to API \"WNetEnumResourceW\" (Indicator: \"NetEnumResource\"; File: \"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46\")\n Found reference to API \"WNetCloseEnum\" (Indicator: \"NetCloseEnum\"; File: \"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46\")\n Found reference to API \"WNetCloseEnum\" (Indicator: \"NetCloseEnum\"; Source: \"00000000-00002796.00000000.78318.00D6A000.00000002.mdmp\")\n Found reference to API \"WNetEnumResourceW\" (Indicator: \"NetEnumResource\"; Source: \"00000000-00002796.00000000.78318.00D6A000.00000002.mdmp\")\n Found reference to API \"WNetCloseEnum\" (Indicator: \"NetCloseEnum\"; Source: \"00000000-00003492.00000000.78186.00430000.00000004.mdmp\")\n Found reference to API \"WNetEnumResourceW\" (Indicator: \"NetEnumResource\"; Source: \"00000000-00003492.00000000.78186.00430000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-257","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"Network Related","name":"Contains ability to provide information and utilities for managing network resources (API string)","description":"Found reference to API \"WNetUseConnectionW\" (Indicator: \"WNetUseConnection\"; File: \"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-113","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows HTTP services (API string)","description":"$48","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-323","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"WSAGetLastError\" (Indicator: \"wsagetlasterror\"; File: \"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46\")\n Found reference to API \"AUTHUI.DLL: Shutdown Choices Message Window\" (Indicator: \" shutdown \"; Source: \"00000000-00003492.00000000.78186.00D80000.00000002.mdmp, 00000000-00003492.00000001.80107.00D80000.00000002.mdmp, 00000000-00003492.00000002.82032.00D80000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"}]},{"level":"informative","category":"Network Related","name":"Detects NETSH process execution","description":"Process \"netsh.exe\" with commandline \"netsh advfirewall set currentprofile state off\" (UID: 00000000-00004436)\n Process \"netsh.exe\" with commandline \"netsh firewall set opmode mode=disable\" (UID: 00000000-00001912)","origin":"Monitored Target","mitre_attack_id":"T1562.004","relevance":2,"id":"target-186","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"Network Related","name":"Found email domains (string)","description":"$49","origin":"File/Memory","mitre_attack_id":"T1585.002","relevance":1,"id":"string-235","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"ct.cy\"\n Heuristic match: \"ntdetect.com\"\n Heuristic match: \"pathext=.com;.exe;.bat;.cmd;.vbs;.vbe;.js;.jse;.wsf;.ws\"\n Heuristic match: \"}\t.mc\"\n Heuristic match: \"?] }/pf.sk\"\n Heuristic match: \"@4.eu\"\n Heuristic match: \"1fa.tp\"\n Heuristic match: \"ik}.bn\"\n Heuristic match: \"ol.cc\"\n Heuristic match: \"id.i.mv\"\n Heuristic match: \"eg.aq\"\n Heuristic match: \"#^s\\.ae\"\n Heuristic match: \"\\b.gi\"\n Heuristic match: \"^*/.st\"\n Heuristic match: \"u:.pk\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"Network Related","name":"Identified known pipe name","description":"Found pipe name string \"\\PIPE\\wkssvc\" (Source: \"00000000-00003492-00000CCE-238860548\")\n Found pipe name string \"\\PIPE\\DAV RPC SERVICE\" (Source: \"00000000-00003492-00000CCE-241318486\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":3,"id":"string-735","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"}]},{"level":"informative","category":"Network Related","name":"Imports windows networking-related APIs","description":"$4b","origin":"Static Parser","mitre_attack_id":"T1135","relevance":1,"id":"static-86","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on process \"00000000-00003492\"\n YARA signature for AES encryption matched on process \"00000000-00002796\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"}]},{"level":"informative","category":"Ransomware/Banking","name":"Attempts to rename multiple files with a new extension, avoiding critical system files","description":"\"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe\" appended encryption extension \".eight\" to 10+ files (.cab, .dll, .msi)","origin":"API Call","mitre_attack_id":"T1679","relevance":1,"id":"api-325","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to create/switch the desktop (API string)","description":"Found reference to API \"CreateDesktopW\" (Indicator: \"CreateDesktop\"; Source: \"00000000-00003492.00000001.80107.02D50000.00000004.mdmp\")\n Found reference to API \"CreateWindowStationW\" (Indicator: \"CreateWindowStation\"; Source: \"00000000-00003492.00000001.80107.02D50000.00000004.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-541","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"ncacn_np\" (Indicator: \"ncacn_np\"; Source: \"00000000-00003492.00000001.80107.00430000.00000004.mdmp, 00000000-00003492.00000002.82032.00430000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"root\\cimv2\" (Indicator: \"root\\cimv2\"; in File: \"00000000-00003836.00000000.80592.00DE1000.00000020.mdmp\")\n Found string \"%WINDIR%\\System32\\Wbem\\WMIC.exe\" (Indicator: \"wmic.exe\"; in Source: \"00000000-00003728-00000C47-57426788616\")\n Found string \"WMIC.exe\" (Indicator: \"wmic.exe\"; in Source: \"00000000-00003836-00000BC0-266081859\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"KERBEROS:\" (Indicator: \"kerberos\"; File: \"00000000-00003836.00000000.80592.00DE1000.00000020.mdmp\")\n Found string \"CoSetProxyBlanket(-, RPC_C_AUTHN_GSS_KERBEROS,RPC_C_AUTHZ_NONE, %s, %d, %d, -, EOAC_NONE)\" (Indicator: \"kerberos\"; File: \"00000000-00003836.00000000.80592.00DE1000.00000020.mdmp\")\n Found string \"UTHN_GSS_KERBEROS,RPC_C_AUTHZ_NONE, %s, %d, %d, -, EOAC_NONE)\" (Indicator: \"kerberos\"; File: \"00000000-00003836.00000000.80592.00DE1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; File: \"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46\")\n Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00002796.00000000.78318.00D6A000.00000002.mdmp\")\n Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00003492.00000000.78186.00430000.00000004.mdmp\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00003492.00000001.80107.02D50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$4e","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"2\"\n \"th32ProcessID\": \"0\"}\n \"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"netsh.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"000000000010000000000100fffffe7f03000000080000004a020000000001000600004f\"}\n \"WMIC.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"000000000010000000000100fffffe7f03000000080000004a020000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"PQAeS~\" (Indicator: \"aes\"; Source: \"00000000-00002796.00000000.78200.00D6B000.00000004.mdmp\")\n Found string \"P~AeS\" (Indicator: \"aes\"; Source: \"00000000-00002796.00000000.78200.00D6B000.00000004.mdmp\")\n Found string \"PQAeS~\" (Indicator: \"aes\"; Source: \"00000000-00003492.00000000.78186.00D6B000.00000004.mdmp, 00000000-00003492.00000001.80107.00D6B000.00000004.mdmp, 00000000-00003492.00000002.82032.00D6B000.00000004.mdmp\")\n Found string \"P~AeS\" (Indicator: \"aes\"; Source: \"00000000-00003492.00000000.78186.00D6B000.00000004.mdmp, 00000000-00003492.00000001.80107.00D6B000.00000004.mdmp, 00000000-00003492.00000002.82032.00D6B000.00000004.mdmp\")\n Found string \"GAEsa6\" (Indicator: \"aes\"; Source: \"00000000-00003492.00000001.80107.02D50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; File: \"00000000-00003836.00000000.80592.00DE1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; File: \"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46\")\n Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; File: \"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46\")\n Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00002796.00000000.78318.00D6A000.00000002.mdmp\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"00000000-00002796.00000000.78318.00D6A000.00000002.mdmp\")\n Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00003492.00000000.78186.00430000.00000004.mdmp, 00000000-00003492.00000001.80107.02D50000.00000004.mdmp\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"00000000-00003492.00000000.78186.00430000.00000004.mdmp, 00000000-00003492.00000001.80107.02D50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate system network resources (API string)","description":"Found reference to API \"WNetOpenEnumW\" (Indicator: \"WNetOpenEnum\"; File: \"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46\")\n Found reference to API \"WNetOpenEnumW\" (Indicator: \"WNetOpenEnum\"; Source: \"00000000-00002796.00000000.78318.00D6A000.00000002.mdmp\")\n Found reference to API \"WNetOpenEnumW\" (Indicator: \"WNetOpenEnum\"; Source: \"00000000-00003492.00000000.78186.00430000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-313","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00002796.00000000.78318.00D6A000.00000002.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00003492.00000000.78186.00430000.00000004.mdmp, 00000000-00003492.00000001.80107.02D50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002796.00000000.78318.00D6A000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00003492.00000000.78186.00430000.00000004.mdmp, 00000000-00003492.00000001.80107.02D50000.00000004.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00003492.00000001.80107.02D50000.00000004.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00003492.00000001.80107.02D50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00002796.00000000.78318.00D6A000.00000002.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00003492.00000000.78186.00430000.00000004.mdmp, 00000000-00003492.00000001.80107.02D50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; File: \"00000000-00003836.00000000.80592.00DE1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$50","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve files based on search patterns","description":"Found string \"WHERE SchemaOnly\" (Indicator: \"where \"; File: \"00000000-00003836.00000000.80592.00DE1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-484","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; File: \"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46\")\n Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00002796.00000000.78318.00D6A000.00000002.mdmp\")\n Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00003492.00000000.78186.00430000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00002796.00000000.78318.00D6A000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00003492.00000000.78186.00430000.00000004.mdmp, 00000000-00003492.00000001.80107.02D50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00002796.00000000.78318.00D6A000.00000002.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00003492.00000000.78186.00430000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteKeyTransactedW\" in \"00000000-00003492.00000001.80107.02D50000.00000004.mdmp\"\n Found registry deletion API: \"FRegDeleteKeyExW\" in \"00000000-00003492.00000001.80107.02D50000.00000004.mdmp\"\n Found registry deletion API: \"RegDeleteKeyW\" in \"00000000-00003492.00000001.80107.02D50000.00000004.mdmp\"\n Found registry deletion API: \"RegDeleteValueW\" in \"00000000-00003492.00000001.80107.02D50000.00000004.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00003492)\n \"vssadmin.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00003136)\n \"WMIC.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00003836)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: 000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46]\n Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: 000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\NetBT_Tcpip_{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}\" (Indicator: \"\\Device\\\"; Source: \"00000000-00003492.00000001.80107.00430000.00000004.mdmp, 00000000-00003492.00000002.82032.00430000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"}]},{"level":"informative","category":"System Security","name":"Contains ability to bypass UAC using COM object (API string)","description":"Found reference to API \"CoGetObject\" (Indicator: \"CoGetObject\"; File: \"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46\")\n Found reference to API \"CoGetObject\" (Indicator: \"CoGetObject\"; Source: \"00000000-00002796.00000000.78318.00D6A000.00000002.mdmp\")\n Found reference to API \"CoGetObject\" (Indicator: \"CoGetObject\"; Source: \"00000000-00003492.00000000.78186.00430000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1548.002","relevance":1,"id":"string-239","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00002796.00000000.78318.00D6A000.00000002.mdmp\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00003492.00000000.78186.00430000.00000004.mdmp, 00000000-00003492.00000001.80107.02D50000.00000004.mdmp\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00003492.00000001.80107.02D50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"$51","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46\")\n Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00002796.00000000.78318.00D6A000.00000002.mdmp\")\n Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00003492.00000000.78186.00430000.00000004.mdmp, 00000000-00003492.00000001.80107.02D50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$52","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00002796.00000000.78318.00D6A000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00002796.00000000.78318.00D6A000.00000002.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00003492.00000000.78186.00430000.00000004.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00003492.00000000.78186.00430000.00000004.mdmp\")\n Found reference to API \"__crtTerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00003492.00000001.80107.02D50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00002796.00000000.78318.00D6A000.00000002.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00003492.00000000.78186.00430000.00000004.mdmp, 00000000-00003492.00000001.80107.02D50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"netsh.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\NAPAGENT\\LOCALCONFIG\")\n \"netsh.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\NAPAGENT\\LOCALCONFIG\\ENROLL\\HCSGROUPS\")\n \"netsh.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\NAPAGENT\\SHAS\")\n \"netsh.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\NAPAGENT\\QECS\")\n \"netsh.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\NAPAGENT\\LOCALCONFIG\\UI\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"$53","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"vssadmin.exe\" opened \"\\Device\\KsecDD\"\n \"netsh.exe\" opened \"\\Device\\KsecDD\"\n \"WMIC.exe\" opened \"\\Device\\KsecDD\"\n \"wbadmin.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$54","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"\"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"000DB71531E5AA8B30594D305BB3FBCE8E2C71F66E2170091EF58B3C1F306F46\"; Value: \"%LOCALAPPDATA%\\000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe\")\n \"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"000DB71531E5AA8B30594D305BB3FBCE8E2C71F66E2170091EF58B3C1F306F46\"; Value: \"%LOCALAPPDATA%\\000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe\")\n \"netsh.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\LOCAL SETTINGS\\MUICACHE\\137\\52C64B7E\"; Key: \"LANGUAGELIST\"; Value: \"en-US\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"$55","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe\" - Location: [%LOCALAPPDATA%\\000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe]- [targetUID: 00000000-00003492]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Tries to save executable or command in registry","description":"\"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"000DB71531E5AA8B30594D305BB3FBCE8E2C71F66E2170091EF58B3C1F306F46\"; Value: \"%LOCALAPPDATA%\\000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe\")\n \"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"000DB71531E5AA8B30594D305BB3FBCE8E2C71F66E2170091EF58B3C1F306F46\"; Value: \"%LOCALAPPDATA%\\000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe\")","origin":"Registry Access","mitre_attack_id":"T1547","relevance":7,"id":"registry-113","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Uses a Windows Living Off The Land Binaries (LOL bins)","description":"Process \"%WINDIR%\\system32\\vssadmin.exe\" launched with commandline \"vssadmin delete shadows /all /quiet\" (UID: 00000000-00003136)\n Process \"%WINDIR%\\system32\\netsh.exe\" launched with commandline \"netsh advfirewall set currentprofile state off\" (UID: 00000000-00004436)\n Process \"%WINDIR%\\system32\\netsh.exe\" launched with commandline \"netsh firewall set opmode mode=disable\" (UID: 00000000-00001912)\n Process \"%WINDIR%\\System32\\Wbem\\WMIC.exe\" launched with commandline \"wmic shadowcopy delete\" (UID: 00000000-00003836)\n Process \"%WINDIR%\\system32\\bcdedit.exe\" launched with commandline \"bcdedit /set {default} bootstatuspolicy ignoreallfailures\" (UID: 00000000-00000580)\n Process \"%WINDIR%\\system32\\bcdedit.exe\" launched with commandline \"bcdedit /set {default} recoveryenabled no\" (UID: 00000000-00004856)\n Process \"%WINDIR%\\system32\\wbadmin.exe\" launched with commandline \"wbadmin delete catalog -quiet\" (UID: 00000000-00004716)","origin":"Monitored Target","relevance":3,"id":"target-411","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46\" has section name .cdata with entropy \"7.835200976730417\"\n \"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe\" has section name .cdata with entropy \"7.835200976730417\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Dropped file has high entropy (likely encrypted/compressed content)","description":"Dropped file \"%LOCALAPPDATA%\\000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe\" has high entropy 7.07249","origin":"Binary File","mitre_attack_id":"T1027","relevance":5,"id":"binary-60","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query security token membership for user discovery","description":"Observed token membership api used in \"advapi32.dll\" [Source: 000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46]\n Observed token membership api used in \"advapi32.dll\" [Source: 000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe]","origin":"Static Parser","mitre_attack_id":"T1033","relevance":3,"id":"static-210","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"21/24 Antivirus vendors marked sample as malicious (87% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe\" reads file \"C:\\$Recycle.Bin\\S-1-5-21-2092356043-4041700817-663127204-1001\\desktop.ini\"\n \"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe\" reads file \"C:\\Program Files\\Adobe\\Acrobat Reader DC\\Reader\\AGMGPUOptIn.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe\" has type \"PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections\"- Location: [%LOCALAPPDATA%\\000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe]- [targetUID: 00000000-00003492]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"000DB71531E5AA8B30594D305BB3FBCE8E2C71F66E2170091EF58B3C1F306F46\"; Value: \"%LOCALAPPDATA%\\000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe\")\n \"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"000DB71531E5AA8B30594D305BB3FBCE8E2C71F66E2170091EF58B3C1F306F46\"; Value: \"%LOCALAPPDATA%\\000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe\")","origin":"Registry Access","mitre_attack_id":"T1547.001","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"}]},{"level":"suspicious","category":"Pattern Matching","name":"Yara Signature Match - Indicators","description":"YARA signature \"INDICATOR_SUSPICIOUS_GENRansomware\" matched process \"00000000-00003492\" as \"Detects command variations typically used by ransomware\"","origin":"YARA Signature","relevance":9,"id":"yara-553","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Able to delete volume snapshots","description":"Found string \"wmic shadowcopy delete\" (Source: \"00000000-00003728-00000C47-57426788616\")\n Found string \"vssadmin delete shadows /all /quiet\" (File: \"vssadmin.exe\")\n Found string \"vssadmin delete shadows /all /quiet\" (Source: \"00000000-00003492.00000000.78186.00430000.00000004.mdmp, 00000000-00003492.00000001.80107.00430000.00000004.mdmp\")\n Found string \"wmic shadowcopy delete\" (Source: \"00000000-00003492.00000000.78186.00430000.00000004.mdmp, 00000000-00003492.00000001.80107.00430000.00000004.mdmp\")\n Found string \"dministrator: C:\\Windows\\system32\\cmd.exe - vssadmin delete shadows /all /quiet\" (Source: \"00000000-00003492.00000001.80107.00D80000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-634","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"The input sample dropped a large number of files","description":"The input sample dropped 13510 files (often an indicator for ransomware)","origin":"Binary File","mitre_attack_id":"T1491.001","relevance":5,"id":"binary-10","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$56","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$57","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"suspicious","category":"System Security","name":"Able to modify firewall settings","description":"Found string \"netsh firewall set opmode mode=disable\" (Source: \"00000000-00002580-00000C47-41326697228\")\n Found string \"netsh advfirewall set currentprofile state off\" (File: \"netsh.exe\")\n Found string \"netsh advfirewall set currentprofile state off\" (Source: \"00000000-00003492.00000000.78186.00430000.00000004.mdmp, 00000000-00003492.00000001.80107.00430000.00000004.mdmp\")\n Found string \"netsh firewall set opmode mode=disable\" (Source: \"00000000-00003492.00000000.78186.00430000.00000004.mdmp, 00000000-00003492.00000001.80107.00430000.00000004.mdmp\")\n Found string \"dministrator: C:\\Windows\\system32\\cmd.exe - netsh firewall set opmode mode=disable\" (Source: \"00000000-00003492.00000001.80107.00D80000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.004","relevance":1,"id":"string-676","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegOpenKeyExW\n OpenProcessToken\n RegCloseKey\n GetProcAddress\n CopyFileW\n GetTickCount\n CreateFileW\n GetComputerNameW\n GetLogicalDrives\n WriteFile\n CreateProcessW\n Sleep\n DeleteFileW\n FindNextFileW\n OpenProcess\n ReadProcessMemory\n GetFileSizeEx\n FindFirstFileW\n GetModuleFileNameW\n Process32FirstW\n GetFileAttributesW\n Process32NextW\n CreateThread\n TerminateProcess\n CreateToolhelp32Snapshot\n GetModuleHandleA\n WNetOpenEnumW\n ShellExecuteExW\n GetWindowThreadProcessId\n closesocket\n socket\n connect\n recv","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Tries to suppress failures during boot (often used to hide system changes)","description":"Tries to suppress failures during boot \"bcdedit.exe\" with commandline \"bcdedit /set {default} bootstatuspolicy ignoreallfailures\" (UID: 00000000-00000580)","origin":"Monitored Target","mitre_attack_id":"T1490","relevance":8,"id":"target-6","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"21/24 Antivirus vendors marked sample as malicious (87% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"21/24 Antivirus vendors marked dropped file \"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe\" as malicious (classified as \"Trojan.Ransom\" with 87% detection rate)","origin":"Binary File","mitre_attack_id":"T1204.002","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"21/24 Antivirus vendors marked spawned process \"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe\" (PID: 2796) as malicious (classified as \"Trojan.Ransom\" with 87% detection rate)","origin":"Monitored Target","mitre_attack_id":"T1204.002","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"malicious","category":"Installation/Persistence","name":"Disables startup repair","description":"Disables startup repair \"bcdedit.exe\" with commandline \"bcdedit /set {default} recoveryenabled no\" (UID: 00000000-00004856)","origin":"Monitored Target","mitre_attack_id":"T1490","relevance":8,"id":"target-5","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"YARA signature \"MALWARE_Win_Phobos\" matched file \"sample.bin\" as \"Detects Phobos ransomware\"\n YARA signature \"MALWARE_Win_Phobos\" matched file \"000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46.exe.1113507864\" as \"Detects Phobos ransomware\"","origin":"YARA Signature","relevance":9,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal browser sensitive information (file access)","description":"$58","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-96","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"malicious","category":"System Destruction","name":"Deletes backup catalog","description":"Deletes backup catalog files using \"wbadmin.exe\" with commandline \"wbadmin delete catalog -quiet\" (UID: 00000000-00004716)","origin":"Monitored Target","mitre_attack_id":"T1490","relevance":10,"id":"target-80","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"malicious","category":"System Destruction","name":"Deletes shadow copies or disables recovery features","description":"[Deleting backup] Process \"wbadmin.exe\" with commandline \"wbadmin delete catalog -quiet\" (UID: 00000000-00004716)","origin":"Monitored Target","mitre_attack_id":"T1490","relevance":8,"id":"target-9004","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"}]},{"level":"malicious","category":"System Destruction","name":"Deletes volume snapshots (often used by ransomware)","description":"Process \"vssadmin.exe\" with commandline \"vssadmin delete shadows /all /quiet\" (UID: 00000000-00003136)\n Process \"WMIC.exe\" with commandline \"wmic shadowcopy delete\" (UID: 00000000-00003836)","origin":"Monitored Target","mitre_attack_id":"T1490","relevance":10,"id":"target-4","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"malicious","category":"System Security","name":"Modifies firewall settings","description":"Process \"netsh.exe\" with commandline \"netsh advfirewall set currentprofile state off\" (UID: 00000000-00004436)\n Process \"netsh.exe\" with commandline \"netsh firewall set opmode mode=disable\" (UID: 00000000-00001912)","origin":"Monitored Target","mitre_attack_id":"T1562.004","relevance":8,"id":"target-15","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"malicious","category":"Unusual Characteristics","name":"References BIOS/BOOT related strings","description":"\"ntldr\" (Indicator: \"ntldr\")\n \"ntdetect.com\" (Indicator: \"ntdetect.com\")","origin":"File/Memory","relevance":9,"id":"string-0","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns many processes","description":"$59","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"bounty-86623065303267239\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to use Cryptographic classes","description":"file/memory contains long string with (Indicator: \"RC2\"; File: \"Apex.eftx.id_49595041-2803_._HenryShrapnel61@gmx.com_.eight.4074886297.id_FA49926A-2803_._HenryShrapnel61@gmx.com_.eight\")\n file/memory contains long string with (Indicator: \"HKDF\"; File: \"AN02122_.WMF.id_49595041-2803_._HenryShrapnel61@gmx.com_.eight.1252557686.id_FA49926A-2803_._HenryShrapnel61@gmx.com_.eight\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"Cryptographic Related","name":"Found XOR operators (encryption/decryption)","description":"file/memory contains long string with (Indicator: \" ^ \"; File: \"Apex.thmx.id_49595041-2803_._HenryShrapnel61@gmx.com_.eight.2478460086.id_FA49926A-2803_._HenryShrapnel61@gmx.com_.eight\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-624","sources":[{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Found XOR operators (encryption/decryption)\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: Contains ability to create a new HTTP request (API string)\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Contains ability to communicate with network (API string)","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"bounty-86623065303267239\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; File: \"bounty-86623065303267239\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"ExpandEnvironmentStringsW\" (Indicator: \"ExpandEnvironmentStrings\"; File: \"bounty-86623065303267239\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"bounty-86623065303267239\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"Environment Awareness","name":"Executes WMI queries","description":"\"WMIC.exe\" issued a query \"SELECT * FROM Win32_ShadowCopy\"","origin":"API Call","mitre_attack_id":"T1047","relevance":10,"id":"api-56","sources":[{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"$5a","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"bounty-86623065303267239\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"bounty-86623065303267239\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"bounty-86623065303267239\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\"bounty-86623065303267239.exe\" failed to load missing module \"%WINDIR%\\System32\\ntlanman.dll\" - [base:72c60000; Status:c0000034]\n \"bounty-86623065303267239.exe\" failed to load missing module \"%WINDIR%\\System32\\drprov.dll\" - [base:72cd0000; Status:102]","origin":"API Call","mitre_attack_id":"T1574.002","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"bounty-86623065303267239.exe\" creates a thread in process \"-1\" (Handle: 4294967295)\n \"WMIC.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"Network Related","name":"Imports windows networking related APIs","description":"Observed import api \"WNetCloseEnum\" which can \"ends a network resource enumeration\" [Source: bounty-86623065303267239]\n Observed import api \"WNetEnumResource\" which can \"continues an enumeration of network resources\" [Source: bounty-86623065303267239]\n Observed import api \"WNetOpenEnum\" which can \"starts an enumeration of network resources or existing connections.\" [Source: bounty-86623065303267239]\n Observed import api \"WNetUseConnection\" which can \"makes a connection to a network resource\" [Source: bounty-86623065303267239]","origin":"Static Parser","mitre_attack_id":"T1135","relevance":1,"id":"static-86","sources":[{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: bd0bf25947d4a37404f0424edf4db9ad\n Observed JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e\n Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c\n Observed JA3 fingerprint: 1fc1c530fdab845a0a2b05d0b5335bcb","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"bounty-86623065303267239.exe\" called \"GetComputerNameW\" (UID: 00000000-00005760)\n \"WMIC.exe\" called \"GetComputerNameW\" (UID: 00000000-00001476)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"\"bounty-86623065303267239.exe\" called \"FindFirstFileW\" with parameter \\\\?\\D:\\* (UID: 00000000-00005760)","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to find logical drives of the machine (API string)","description":"Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; File: \"bounty-86623065303267239\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-84","sources":[{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"Found reference to API \"RegQueryValueExW\" (Indicator: \"RegQueryValue\"; File: \"bounty-86623065303267239\")\n Found reference to API \"RegOpenKeyExW\" (Indicator: \"RegOpenKey\"; File: \"bounty-86623065303267239\")","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"bounty-86623065303267239\")\n Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; File: \"bounty-86623065303267239\")\n Found reference to API \"LookupAccountSidW\" (Indicator: \"LookupAccountSid\"; File: \"bounty-86623065303267239\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".cdata with unusual entropies 7.83520097673","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":3,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"suspicious","category":"Network Related","name":"Spawned processes likely due to injection","description":"Process \"C:\\bounty-86623065303267239.exe\" spawned likely due to injection\n Process \"%WINDIR%\\system32\\cmd.exe\" spawned likely due to injection","origin":"Monitored Target","mitre_attack_id":"T1055","relevance":3,"id":"target-413","sources":[{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"The input sample dropped very many files","description":"The input sample dropped 1149 files (often an indicator for ransomware)","origin":"Binary File","mitre_attack_id":"T1491.001","relevance":5,"id":"binary-10","sources":[{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops PE files with different extensions","description":"$5b","origin":"Binary File","mitre_attack_id":"T1036","relevance":5,"id":"binary-38","sources":[{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"PE file contains unusual section name","description":"\"bounty-86623065303267239\" has a section named \".cdata\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-60","sources":[{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Write many files with double extensions (often indicator of ransomware infection)","description":"\"bounty-86623065303267239.exe\" write more than 100 files with extension \".dll.id[49595041-2803].[HenryShrapnel61@gmx.com].eight\"","origin":"API Call","mitre_attack_id":"T1486","relevance":5,"id":"api-201","sources":[{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$5c","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"cmd.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00003496)\n \"cmd.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00002584)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"Environment Awareness","name":"Contains the ability to enumerate volumes (API string)","description":"Found reference to API \"GetVolumeNameForVolumeMountPointWGetVolumePathNamesForVolumeNameWDeviceIoControl\" (Indicator: \"GetVolumePathNamesForVolumeName\"; File: \"AcroRd32.exe.id_5CABA3F6-2803_._HenryShrapnel61@gmx.com_.eight\")\n Found reference to API \"GetVolumeNameForVolumeMountPointWGetVolumePathNamesForVolumeNameWDeviceIoControl\" (Indicator: \"GetVolumePathName\"; File: \"AcroRd32.exe.id_5CABA3F6-2803_._HenryShrapnel61@gmx.com_.eight\")","origin":"File/Memory","mitre_attack_id":"T1006","relevance":1,"id":"string-194","sources":[{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"GetVolumeNameForVolumeMountPointWGetVolumePathNamesForVolumeNameWDeviceIoControl\" (Indicator: \"DeviceIoControl\"; File: \"AcroRd32.exe.id_5CABA3F6-2803_._HenryShrapnel61@gmx.com_.eight\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"General","name":"Contains ability to create/load registry keys (API string)","description":"Found reference to API \"AR`NFRKernel32.dllKernel32.dllComctl32.dllInitCommonControlsExpNF8RNFRbad locale namefalsetrueU~EnOnOUPE@DDGFGF`HF@HF IFIFP@F@@FFFAdvapi32.dllRegOpenKeyTransactedWRegCreateKeyTransactedWRegDeleteKeyTransactedWFF\\UpE\" (Indicator: \"RegCreateKey\"; File: \"AcroRd32.exe.id_5CABA3F6-2803_._HenryShrapnel61@gmx.com_.eight\")\n Found reference to API \"AR`NFRKernel32.dllKernel32.dllComctl32.dllInitCommonControlsExpNF8RNFRbad locale namefalsetrueU~EnOnOUPE@DDGFGF`HF@HF IFIFP@F@@FFFAdvapi32.dllRegOpenKeyTransactedWRegCreateKeyTransactedWRegDeleteKeyTransactedWFF\\UpE\" (Indicator: \"RegCreateKeyTransacted\"; File: \"AcroRd32.exe.id_5CABA3F6-2803_._HenryShrapnel61@gmx.com_.eight\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"General","name":"Contains ability to open handle to a named event object (API string)","description":"file/memory contains long string with (Indicator: \"NtOpenEvent\"; File: \"AcroRd32.exe.id_5CABA3F6-2803_._HenryShrapnel61@gmx.com_.eight\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-467","sources":[{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"$5d","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops ASP/PHP html files","description":"\"autoit.php.id_5CABA3F6-2803_._HenryShrapnel61@gmx.com_.eight\" has type \"data\"- [targetUID: N/A]","origin":"Binary File","mitre_attack_id":"T1105","id":"binary-49","sources":[{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"Network Related","name":"Contains ability to transfer data using curl","description":"Observed string: \"var cURL = cDefaultLink + getAsciiSafeDocName(data.cDocumentName);\" (Indicator: \" curl \") in Source: JSByteCodeWin.bin.id_5CABA3F6-2803_._HenryShrapnel61@gmx.com_.eight\n Observed string: \"cURL += \"__\" +data.reviewID + \"_attachments\"+\"_0-05ac777c-f1ef-4ab3-80c8-9114025d1c89_bin\";\" (Indicator: \"curl \") in Source: JSByteCodeWin.bin.id_5CABA3F6-2803_._HenryShrapnel61@gmx.com_.eight\n Observed string: \"cURL : props[\"loct\"],\" (Indicator: \"curl \") in Source: JSByteCodeWin.bin.id_5CABA3F6-2803_._HenryShrapnel61@gmx.com_.eight","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-576","sources":[{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"}]},{"level":"informative","category":"Network Related","name":"Contains ability to transfer files using SCP","description":"$5e","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-577","sources":[{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"}]},{"level":"informative","category":"Network Related","name":"References server/domain address with port number","description":"Found ip/domain with port number \"http://camelot:8080\"","origin":"Indicator Combinations","mitre_attack_id":"T1571","id":"summary-25","sources":[{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"file/memory contains long string with (Indicator: \"CreateDC\"; File: \"AcroRd32.exe.id_5CABA3F6-2803_._HenryShrapnel61@gmx.com_.eight\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to determine disk drive type (API string)","description":"file/memory contains long string with (Indicator: \"GetDriveType\"; File: \"AcroRd32.exe.id_5CABA3F6-2803_._HenryShrapnel61@gmx.com_.eight\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about MS-DOS device names (API string)","description":"file/memory contains long string with (Indicator: \"QueryDosDevice\"; File: \"AcroRd32.exe.id_5CABA3F6-2803_._HenryShrapnel61@gmx.com_.eight\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-227","sources":[{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve process ID (API string)","description":"file/memory contains long string with (Indicator: \"GetProcessId\"; File: \"AcroRd32.exe.id_5CABA3F6-2803_._HenryShrapnel61@gmx.com_.eight\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-478","sources":[{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"file/memory contains long string with (Indicator: \"GetEnvironmentVariable\"; File: \"AcroRd32.exe.id_5CABA3F6-2803_._HenryShrapnel61@gmx.com_.eight\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"{ type: \"edit_text\", item_id: \"pass\", char_width: 20, password: true }\" (Indicator: \"password\"; File: \"JSByteCodeWin.bin.id_5CABA3F6-2803_._HenryShrapnel61@gmx.com_.eight\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Executes WMI queries to gather system information","description":"\"WMIC.exe\" issued a query \"SELECT * FROM Win32_ShadowCopy\"","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-183","sources":[{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found strings related to keylogger","description":"file/memory contains long string with (Indicator: \"\"; File: \"BOLDSTRI.ELM.id_5CABA3F6-2803_._HenryShrapnel61@gmx.com_.eight\")\n file/memory contains long string with (Indicator: \"\"; File: \"AutoUpdateIt.au3.id_5CABA3F6-2803_._HenryShrapnel61@gmx.com_.eight\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-556","sources":[{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete registry key/value (API string)","description":"Found reference to API \"AR`NFRKernel32.dllKernel32.dllComctl32.dllInitCommonControlsExpNF8RNFRbad locale namefalsetrueU~EnOnOUPE@DDGFGF`HF@HF IFIFP@F@@FFFAdvapi32.dllRegOpenKeyTransactedWRegCreateKeyTransactedWRegDeleteKeyTransactedWFF\\UpE\" (Indicator: \"RegDeleteKeyTransacted\"; File: \"AcroRd32.exe.id_5CABA3F6-2803_._HenryShrapnel61@gmx.com_.eight\")\n Found reference to API \"AR`NFRKernel32.dllKernel32.dllComctl32.dllInitCommonControlsExpNF8RNFRbad locale namefalsetrueU~EnOnOUPE@DDGFGF`HF@HF IFIFP@F@@FFFAdvapi32.dllRegOpenKeyTransactedWRegCreateKeyTransactedWRegDeleteKeyTransactedWFF\\UpE\" (Indicator: \"RegDeleteKey\"; File: \"AcroRd32.exe.id_5CABA3F6-2803_._HenryShrapnel61@gmx.com_.eight\")\n Found reference to API \"F)FEPEE00F00F0F 0FRegDeleteKeyExWUFMH0EEERRRRRRRR>085CDA5300000001","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\<>085CDA5300000000","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\3a886eb8-fe40-4d0a-b78b-9e0bcb683fb7","sources":[{"report_type":"sandbox","report_id":"6a76e0e215bed915220b9090"},{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1476:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"}]},{"name":"SM0:1476:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"}]},{"name":"Local\\SM0:1476:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"}]},{"name":"SM0:1476:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1476:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1476:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65fdd2e69b55b76968055ab9"}]},{"name":"Global\\<>5CABA3F600000000","sources":[{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"}]},{"name":"Global\\<>5CABA3F600000001","sources":[{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\<>5CABA3F600000000","sources":[{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"}]},{"name":"RasPbFile","sources":[{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"name":"Global\\3a886eb8-fe40-4d0a-b78b-9e0bcb683fb7","sources":[{"report_type":"sandbox","report_id":"6606f4f9d55064788107153f"},{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\<>5FC08B7400000000","sources":[{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"name":"Global\\<>5FC08B7400000000","sources":[{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"name":"Global\\<>5FC08B7400000001","sources":[{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\<>5FC08B7400000001","sources":[{"report_type":"sandbox","report_id":"66087751b4743f6a67004afe"}]}]}},"report_ids":{"sandbox_job_ids":["6a76e0e215bed915220b9090","66087751b4743f6a67004afe","6606f4f9d55064788107153f","65fdd2e69b55b76968055ab9"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Ransom Sample 000db71531e5… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 000db71531e5…. Malware family: Trojan.Ransom. Threat score 100/100. 22/25 AV engines flagged this file. 16 malicious and 28 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Ransom Sample 000db71531e5… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 000db71531e5…. Malware family: Trojan.Ransom. Threat score 100/100. 22/25 AV engines flagged this file. 16 malicious and 28 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/000db71531e5aa8b30594d305bb3fbce8e2c71f66e2170091ef58b3c1f306f46"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Ransom Sample 000db71531e5… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 000db71531e5…. Malware family: Trojan.Ransom. Threat score 100/100. 22/25 AV engines flagged this file. 16 malicious and 28 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L61","11",{}]]