26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 36:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T47f,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 00ffb53eeccb… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 00ffb53eeccb…. Malware family: Trojan.Generic. Threat score 100/100. 15/24 AV engines flagged this file. 6 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b"],"about":{"@type":"SoftwareApplication","name":"file","applicationCategory":["peexe","executable"],"identifier":"00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":15,"total":24},"behavioralIndicators":{"malicious":6,"suspicious":14},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T9ce,"file.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000018000000122536e4a383e772d0045300687d717478f4530040b1e772f6a88c96feffffff94f353000272e67238f3530000001f7430f453001b72e672e0df857608000000000000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff3400000000000000c0f3530000000000080000000000000000000000000000000000000000000000000000002a2536e40000000000f4530069923375ffffffff34000000c0f35300080000000000000000001f7430f4530027943375c8f353000b0000000000000018f45300 (UID: 00000000-00008132) "file.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008132) "file.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008132) "file.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e02c53755cf35300226e2e740000c604000000002d6e2e74c4f2aa492d000000ecb74975e0f35300b1ce980098857a0020ac7900150000008000000020f3530000005500a4f3530070c82f746070cd3dfeffffff2d000000d0cc58752700000074f35300856a30741c233574b4f35300f85f307408000000bb692f74b2692f742cf2aa492d000000ecb7497527000000d0cc587588f353002d000000d0cc587527000000b8f35300856a30741c23357400f453007e8a5775ee8c5775738a577539aef2d72d000000ecb7497527000000d0cc5875fc9ac604909ac60439aef2d7c8f35300fc529575b4f45300e084577501ab32a2feffffff738a5775 (UID: 00000000-00008132)28:T4ec,"file.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008132) "file.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008132) "file.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008132) "file.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008132) "file.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00008132) "file.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00008132) "file.exe" called "LoadLibrary" with a parameter NTDLL.dll (UID: 00000000-00008132) "file.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00008132) "file.exe" called "LoadLibrary" with a parameter NTDLL (UID: 00000000-00008132) "file.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00008132) "file.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00008132) "file.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00008132) "file.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00008132) "file.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00008132)29:T132f,"file.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00008132) "file.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00008132) "file.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00008132) "file.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00008132) "file.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00008132) "file.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00008132) "file.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00008132) "file.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00008132) "file.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00008132) "file.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00008132) "file.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00008132) "file.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00008132) "file.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00008132) "file.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00008132) "file.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00008132) "file.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00008132) "file.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00008132) "file.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00008132) "file.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00008132) "file.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00008132) "file.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00008132) "file.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00008132) "file.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00008132) "file.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00008132) "file.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00008132) "file.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00008132) "file.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00008132) "file.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00008132) "file.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00008132) "file.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00008132) "file.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00008132) "file.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00008132) "file.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00008132) "file.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00008132) "file.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00008132) "file.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00008132) "file.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00008132) "file.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00008132) "file.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00008132) "file.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00008132) "file.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00008132) "file.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00008132) "file.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00008132) "file.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00008132) "file.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00008132) "file.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00008132) "file.exe" called "GetProcAddress" with a parameter timeGetTime (UID: 00000000-00008132) "file.exe" called "GetProcAddress" with a parameter NtOpenThread (UID: 00000000-00008132) "file.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00008132) "file.exe" called "GetProcAddress" with a parameter RtlAllocateHeap (UID: 00000000-00008132)2a:T524,"file.exe" loaded module "KERNEL32" at base 76d30000 "file.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 75230000 "file.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 75230000 "file.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 75230000 "file.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 75200000 "file.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 75230000 "file.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 75230000 "file.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 75230000 "file.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72db0000 "file.exe" loaded module "USER32.DLL" at base 748d0000 "file.exe" loaded module "ADVAPI32.DLL" at base 74220000 "file.exe" loaded module "NTDLL.DLL" at base 777b0000 "file.exe" loaded module "WINMM.DLL" at base 72d30000 "file.exe" loaded module "NTDLL" at base 777b0000 "file.exe" loaded module "KERNEL32.DLL" at base 76d30000 "file.exe" loaded module "SHELL32.DLL" at base 75470000 "file.exe" loaded module "OLE32.DLL" at base 74430000 "file.exe" loaded module "OLEAUT32.DLL" at base 76ef0000 "file.exe" loaded module "GDI32.DLL" at base 741f0000 "file.exe" loaded module "EXT-MS-WIN-KERNEL32-ERRORHANDLING-L1-1-0.DLL" at base 76d300002b:T7e1,"file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "BIAS"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDNAME"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDBIAS"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDSTART"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTNAME"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTBIAS"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTSTART"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "TIMEZONEKEYNAME"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DYNAMICDAYLIGHTTIMEDISABLED"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "FIRSTENTRY"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "LASTENTRY"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "2024"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "2007"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "ACTIVETIMEBIAS"; Value: "")2c:T553,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00008132.00000000.200405.00790000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00008132.00000000.200405.00790000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00008132.00000000.200405.00790000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00008132.00000000.200405.00790000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00008132.00000000.200405.00790000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00008132.00000000.200405.00790000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00008132.00000000.200405.00790000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00008132.00000000.200405.00790000.00000004.mdmp")2d:T733,"00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME") "00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\SETUP") "00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP") "00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS NT\RPC") "00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SQMCLIENT\WINDOWS") "00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SQMCLIENT\WINDOWS") "00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SECURITYPROVIDERS") "00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SECURITYPROVIDERS") "00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\SSPICACHE") "00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\SSPICACHE\CREDSSP.DLL") "00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\SSPICACHE\CREDSSP.DLL") "00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SECURITYPROVIDERS\SASLPROFILES")2e:T5c0,Assembly shows XOR instruction xor eax ebx in Stream UID: 00000000-00003888-42821-275-00F4FC20 Assembly shows XOR instruction xor eax edx in Stream UID: 00000000-00003888-42821-275-00F4FC20 Assembly shows XOR instruction xor edx ecx in Stream UID: 00000000-00003888-42821-724-00F342B0 Assembly shows XOR instruction xor al 83h in Stream UID: 00000000-00003888-42821-724-00F342B0 Assembly shows XOR instruction xor al E3h in Stream UID: 00000000-00003888-42821-1171-00F264F0 Assembly shows XOR instruction xor ecx 01h in Stream UID: 00000000-00003888-42821-1171-00F264F0 Assembly shows XOR instruction xor edx 02h in Stream UID: 00000000-00003888-42821-1171-00F264F0 Assembly shows XOR instruction xor edx dword ptr [00F5F3ECh] in Stream UID: 00000000-00003888-42821-1314-00F21DF0 Assembly shows XOR instruction xor ecx dword ptr [00F5F3D4h] in Stream UID: 00000000-00003888-42821-1315-00F21D20 Assembly shows XOR instruction xor edx esi in Stream UID: 00000000-00003888-42821-1321-00F210E0 Assembly shows XOR instruction xor ecx dword ptr [00F5F150h] in Stream UID: 00000000-00003888-42821-1324-00F20DB0 Assembly shows XOR instruction xor ecx dword ptr [00F5F444h] in Stream UID: 00000000-00003888-42821-1631-00F21AD9 Assembly shows XOR instruction xor edx dword ptr [00F5F170h] in Stream UID: 00000000-00003888-42821-2310-00F21736 Assembly shows XOR instruction xor eax dword ptr [00F5F188h] in Stream UID: 00000000-00003888-42821-2355-00F210802f:T2a90,Found XOR loop in file "sample.bin" at offset 5857; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 12321; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 33096; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 96051; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 186916; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 422451; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 707333; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 815171; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 830362; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1007123; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1034925; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1045058; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1058565; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1239767; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1247327; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1253047; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1260632; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1267447; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1269954; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1287188; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1292489; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1313529; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1341352; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1352150; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1365263; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1366235; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1401346; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1516514; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1537476; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1601407; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1637029; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1652940; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1658074; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1736211; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1794483; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 47055; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 90260; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 138382; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 248786; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 374841; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 402284; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 478882; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 529696; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 618630; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 671330; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 694234; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 695548; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 744453; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 909868; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 982872; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1024136; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1056698; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1162232; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1238948; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1306111; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1388647; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1398838; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1401204; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1477377; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1486625; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1513650; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1703305; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1798089; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1828558; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 32687; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 152090; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 168291; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 178478; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 178580; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 215363; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 233085; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 340552; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 378637; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 391102; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 395544; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 397777; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 488019; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 557980; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 613185; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 729053; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 733045; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 819259; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 892099; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 953417; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 970025; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 987387; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1031057; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1060039; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1066328; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1070671; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1092303; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1092627; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1094192; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1108168; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1126280; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1126549; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1194891; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1201924; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1245371; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1248110; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1250044; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1251088; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1285895; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1309030; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1312731; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1329571; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1330775; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1340192; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1343145; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1349456; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1356759; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1403535; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1424219; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1425218; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1426427; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1451614; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1459405; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1477965; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1481477; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1484868; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1486311; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1499358; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1517332; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1533233; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1534705; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1539360; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1557943; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1558351; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1574072; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1582424; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1587397; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1593084; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1595950; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1610671; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1611927; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1657281; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1662613; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1709020; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1712411; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1716379; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1716640; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1728565; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1736824; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1748172; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1749991; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1767083; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1822236; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1831450; code bytes = 803030:T865,"00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\2E4916B07F3DE90C8DDE2566FD9B9B400D89BBBA"; Key: "BLOB") "00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB") "00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\E6A3B45B062D509B3382282D196EFE97D5956CCB"; Key: "BLOB") "00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\F5AD0BCC1AD56CD150725B1C866C30AD92EF21B0"; Key: "BLOB") "00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB")31:T503,"00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe" searching for class "OLLYDBG" "00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe" searching for class "GBDYLLO" "00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe" searching for class "pediy06" "00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe" searching for class "FilemonClass" "00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe" searching for window "File Monitor - Sysinternals: www.sysinternals.com" "00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe" searching for class "PROCMON_WINDOW_CLASS" "00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe" searching for window "Process Monitor - Sysinternals: www.sysinternals.com" "00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe" searching for class "RegmonClass" "00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe" searching for window "Registry Monitor - Sysinternals: www.sysinternals.com" "00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe" searching for class "18467-41" "00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe" searching for class "Regmonclass"32:T7a9,"00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe" called "WinHttpSendRequest" with parameters {"hRequest": "3d79f0" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "act=life" "dwOptionalLength": "8" "dwTotalLength": "8" "dwContext": "0" "$error": "2f8f"} "00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe" called "WinHttpSendRequest" with parameters {"hRequest": "3e2160" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "act=life" "dwOptionalLength": "8" "dwTotalLength": "8" "dwContext": "0" "$error": "2ee7"} "00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe" called "WinHttpSendRequest" with parameters {"hRequest": "3df878" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "act=life" "dwOptionalLength": "8" "dwTotalLength": "8" "dwContext": "0" "$error": "2ee7"} "00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe" called "WinHttpSendRequest" with parameters {"hRequest": "3d9d50" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "act=life" "dwOptionalLength": "8" "dwTotalLength": "8" "dwContext": "0" "$error": "2ee7"} "00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe" called "WinHttpSendRequest" with parameters {"hRequest": "3d9e88" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "act=life" "dwOptionalLength": "8" "dwTotalLength": "8" "dwContext": "0" "$error": "2f8f"} "00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe" called "WinHttpSendRequest" with parameters {"hRequest": "3d9e88" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"}33:T685d,Found URL "https://clearancek.site/apiclearancek.sitemsiscanbumsiscanbufferetdrivetype63006b0020003100000000windows" - Source: "00000000-00003888.00000000.78156.00350000.00000004.mdmp") Found URL "https://clearancek.site/apihts:ots:bts:yts:junt!" - Source: "00000000-00003888.00000000.78156.00350000.00000004.mdmp") Found URL "https://steamcommunity.com/profiles/76561199724331900steamcommunity.com:\windows\system32\bcryptprimitives.dlley" - Source: "00000000-00003888.00000001.78451.00350000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1english1sea" - Source: "00000000-00003888.00000001.78451.00350000.00000004.mdmp") Found URL "https://secure.comodo.com/cps0" - Source: "00000000-00003888.00000001.78451.00350000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0u0.9.2342.19200300.100.1.25u2.16.840.1.113733.1.7.1.1u1.3.6.1.4.1.311.10.11.851.3.6.1.4.1.11129.2.4.21.3.6.1.4.1.311.2.1.101.3.6.1.4.1.311.2.1.27]" - Source: "00000000-00003888.00000001.78451.00350000.00000004.mdmp") Found URL "https://broadcast.st.dl.eccded.nttp://127.0.0.1:0" - Source: "00000000-00003888.00000001.78451.00350000.00000004.mdmp") Found URL "http://checksteaered" - Source: "00000000-00003888.00000001.78451.00350000.00000004.mdmp") Found URL "https://skcom" - Source: "00000000-00003888.00000001.78451.00350000.00000004.mdmp") Found URL "https://www.google.com/recaptcha/" - Source: "00000000-00003888.00000001.78451.00350000.00000004.mdmp") Found URL "https://recaptcha.net/recaptcha/;" - Source: "00000000-00003888.00000001.78451.00350000.00000004.mdmp") Found URL "https://steamloopback.host" - Source: "00000000-00003888.00000001.78451.00350000.00000004.mdmp") Found URL "https://store.steampowered.com/;x-frame-optionssameoriginpersistent-authwww-authenticatevarysteamcountry=us%7cdd89e304c87f19ea401ddd7cfd7158f5;" - Source: "00000000-00003888.00000001.78451.00350000.00000004.mdmp") Found URL "https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=oimk9sdo4iqn&l=english&_cdn=akamai" - Source: "00000000-00003888.00000001.78451.00350000.00000004.mdmp") Found URL "https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=6inmyk2ncgk7&l=english&_cdn=akamai" - Source: "00000000-00003888.00000001.78451.00350000.00000004.mdmp") Found URL "https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries" - Source: "00000000-00003888.00000001.78451.00350000.00000004.mdmp") Found URL "https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=ycibdwvvdr3r&l=english&_cdn=akamai" - Source: "00000000-00003888.00000001.78451.00350000.00000004.mdmp") Found URL "https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg" - Source: "00000000-00003888.00000001.78451.00350000.00000004.mdmp") Found URL "https://community.akamai.steamstatic.com/public/images/skin_1/arrowdn9x5.gif" - Source: "00000000-00003888.00000001.78451.00350000.00000004.mdmp") Found URL "http://www.digicert.com/cps0n0l04.http://crl3.digicert.com/digicertevrsacag2.crl04.http://crl4.digicert.com/digicertevrsacag2.crl0sg0e0$http://ocsp.digicert.com0=1http://cacerts.digicert.com/digicertevrsacag2.crt0c>o21" - Source: "00000000-00003888.00000001.78451.00350000.00000004.mdmp") Found URL "http://ocsp.digicert.com0" - Source: "00000000-00003888.00000001.78451.00350000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicertglobalrootg2.crl07t0r071http://crl3.digicert.com/digicertglobalrootg2.crl07" - Source: "00000000-00003888.00000001.78451.00350000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicertglobalrootg2.crl071http://crl4.digicert.com/digicertglobalrootg2.crl0https://www.digicert.com/cps0" - Source: "00000000-00003888.00000001.78451.00350000.00000004.mdmp") Found URL "https://www.digicert.com/rpa-ua0d;/fm7oygnaxs<11pm3w$ua" - Source: "00000000-00003888.00000001.78451.00350000.00000004.mdmp") Found URL "https://www.digicert.com/rpa-ua0d;/fm7oygnaxu<7taddtrust" - Source: "00000000-00003888.00000001.78451.00350000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00003888.00000001.78451.00350000.00000004.mdmp") Found URL "http://g.symcd.com0e0c0a60301%http://www.geotrust.com/resources/cps06/0-0+%http://g.symcb.com/geotrustpca-g3.crl0symantecpki-1-697033ti^l" - Source: "00000000-00003888.00000001.78451.00350000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00003888.00000001.78451.00350000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czc0?1$0" - Source: "00000000-00003888.00000001.78451.00350000.00000004.mdmp") Found URL "http://isrg.trustid.ocsp.identrust.com0;/http://apps.identrust.com/roots/dstrootcax3.p7c0m0k0000." - Source: "00000000-00003888.00000001.78451.00350000.00000004.mdmp") Found URL "http://cps.root-x1.letsencrypt.org0<50301+http://crl.identrust.com/dstrootcax3crl.crl0ig'" - Source: "00000000-00003888.00000001.78451.00350000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00003888.00000001.78451.00350000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0internet1verisign," - Source: "00000000-00003888.00000001.78451.00350000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com05addons.mozilla.orgwww.addons.mozilla.org0zsb)j9e/w4*qq1" - Source: "00000000-00003888.00000001.78451.00350000.00000004.mdmp") Found URL "http://ocsp.entrust.net03,0*0(" - Source: "00000000-00003888.00000001.78451.00350000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.11c)d[b" - Source: "00000000-00003888.00000001.78451.00350000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0w0u1staat" - Source: "00000000-00003888.00000001.78451.00350000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl0]ko)tsz'w4!nf$:6f$:ezf$:x7y1" - Source: "00000000-00003888.00000001.78451.00350000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.skype.comwww.login.skype.com0ly:^!ly:%ly:)ly:-ly:1ly:5ly:9ly:=ly:" - Source: "00000000-00003888.00000001.78451.00350000.00000004.mdmp") Found URL "http://cybertrust.omniroot.com/repository.cfm0w0u1gte" - Source: "00000000-00003888.00000001.78451.00350000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0j)z" - Source: "00000000-00003888.00000001.78451.00350000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1tampa1sea" - Source: "00000000-00003888.00000001.78451.00350000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0global" - Source: "00000000-00003888.00000001.78451.00350000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0\0z1staat" - Source: "00000000-00003888.00000001.78451.00350000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domorganisatielatestcrl-g2.crl0^tl*" - Source: "00000000-00003888.00000001.78451.00350000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.yahoo.comwww.login.yahoo.com0yvr,0ab^w4$=9ckxtrusww.userfa" - Source: "00000000-00003888.00000001.78451.00350000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.1q7z?,w5-vof3w4)wp+(the" - Source: "00000000-00003888.00000001.78451.00350000.00000004.mdmp") Found URL "https://www.verisign.com/repository/cpsthis" - Source: "00000000-00003888.00000001.78451.00350000.00000004.mdmp") Found URL "https://www.verisign.com;" - Source: "00000000-00003888.00000001.78451.00350000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0salt" - Source: "00000000-00003888.00000001.78451.00350000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/mail.google.comwww.mail.google.com0?=*k!\yro2;nio$:)/mo$:ao$:reo$:uyo$:" - Source: "00000000-00003888.00000001.78451.00350000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0kw(=n" - Source: "00000000-00003888.00000001.78451.00350000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0f$\_)$bf!gte" - Source: "00000000-00003888.00000001.78451.00350000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0\0" - Source: "00000000-00003888.00000001.78451.00350000.00000004.mdmp") Found URL "http://ocsp.entrust.net0d=0;09000." - Source: "00000000-00003888.00000001.78451.00350000.00000004.mdmp") Found URL "http://www.digicert.com.my/cps.htm02+0)0'!http://crl.entrust.net/2048ca.crl09yk3y!s$:hs$:dzp$:" - Source: "00000000-00003888.00000001.78451.00350000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0or" - Source: "00000000-00003888.00000001.78451.00350000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl00ev" - Source: "00000000-00003888.00000001.78451.00350000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0w4+@salt" - Source: "00000000-00003888.00000001.78451.00350000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0-login.live.comwww.login.live.com0nwk1uy1un:su$:wu$:ku$:aou$:cu$:gu$:4o0-%i1oc*9y$:6y$:7y$:f.y$:ruy$:ecq8" - Source: "00000000-00003888.00000001.78451.00350000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0v7.1ctj7+>.entrus5w4.x^y^w4tverisign," - Source: "00000000-00003888.00000001.78451.00350000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0>ej-+\lu>gvpob\hzagxr" - Source: "00000000-00003888.00000001.78451.00350000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?w4$dus1!0the" - Source: "00000000-00003888.00000001.78451.00350000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnk't" - Source: "00000000-00003888.00000001.78451.00350000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00003888.00000001.78451.04080000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003888.00000001.78451.04080000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l[w4qlwashington1redmond1microsoft" - Source: "00000000-00003888.00000001.78451.04080000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lsuuuphhsmookhiw4coft" - Source: "00000000-00003888.00000001.78451.04080000.00000004.mdmp") Found URL "https://community.akamai.steamstatic.com/" - Source: "00000000-00003888.00000001.78451.04080000.00000004.mdmp") Found URL "https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/" - Source: "00000000-00003888.00000001.78451.04080000.00000004.mdmp") Found URL "https://api.steampowered.com/" - Source: "00000000-00003888.00000001.78451.04080000.00000004.mdmp") Found URL "https://recaptcha.net" - Source: "00000000-00003888.00000001.78451.04080000.00000004.mdmp") Found URL "https://www.google.com/recaptcha/" - Source: "00000000-00003888.00000001.78451.04080000.00000004.mdmp") Found URL "https://www.gstatic.cn/recaptcha/" - Source: "00000000-00003888.00000001.78451.04080000.00000004.mdmp") Found URL "https://www.gstatic.com/recaptcha/" - Source: "00000000-00003888.00000001.78451.04080000.00000004.mdmp") Found URL "https://www.youtube.com/" - Source: "00000000-00003888.00000001.78451.04080000.00000004.mdmp") Found URL "https://s.ytimg.com;" - Source: "00000000-00003888.00000001.78451.04080000.00000004.mdmp") Found URL "https://store.steampowered.com/" - Source: "00000000-00003888.00000001.78451.04080000.00000004.mdmp") Found URL "https://checkout.steampowered.com/" - Source: "00000000-00003888.00000001.78451.04080000.00000004.mdmp") Found URL "https://login.steampowered.com/" - Source: "00000000-00003888.00000001.78451.04080000.00000004.mdmp") Found URL "https://help.steampowered.com/" - Source: "00000000-00003888.00000001.78451.04080000.00000004.mdmp") Found URL "https://steam.tv/" - Source: "00000000-00003888.00000001.78451.04080000.00000004.mdmp") Found URL "https://steamcommunity.com/" - Source: "00000000-00003888.00000001.78451.04080000.00000004.mdmp") Found URL "https://*.valvesoftware.com" - Source: "00000000-00003888.00000001.78451.04080000.00000004.mdmp") Found URL "https://*.steambeta.net" - Source: "00000000-00003888.00000001.78451.04080000.00000004.mdmp") Found URL "https://*.discovery.beta.steamserver.net" - Source: "00000000-00003888.00000001.78451.04080000.00000004.mdmp") Found URL "https://*.steamcontent.com" - Source: "00000000-00003888.00000001.78451.04080000.00000004.mdmp") Found URL "https://steambroadcast.akamaized.net" - Source: "00000000-00003888.00000001.78451.04080000.00000004.mdmp") Found URL "https://steambroadcast-test.akamaized.net" - Source: "00000000-00003888.00000001.78451.04080000.00000004.mdmp") Found URL "https://broadcast.st.dl.eccdnx.com" - Source: "00000000-00003888.00000001.78451.04080000.00000004.mdmp") Found URL "https://lv.queniujq.cn" - Source: "00000000-00003888.00000001.78451.04080000.00000004.mdmp") Found URL "https://steambroadcastchat.akamaized.net" - Source: "00000000-00003888.00000001.78451.04080000.00000004.mdmp") Found URL "http://127.0.0.1:27060" - Source: "00000000-00003888.00000001.78451.04080000.00000004.mdmp") Found URL "https://www.youtube.com" - Source: "00000000-00003888.00000001.78451.04080000.00000004.mdmp") Found URL "https://www.youtube-nocookie.com" - Source: "00000000-00003888.00000001.78451.04080000.00000004.mdmp") Found URL "https://www.google.com" - Source: "00000000-00003888.00000001.78451.04080000.00000004.mdmp") Found URL "https://sketchfab.com" - Source: "00000000-00003888.00000001.78451.04080000.00000004.mdmp") Found URL "https://player.vimeo.com" - Source: "00000000-00003888.00000001.78451.04080000.00000004.mdmp") Found URL "https://medal.tv" - Source: "00000000-00003888.00000001.78451.04080000.00000004.mdmp") Found URL "https://recaptcha.net/recaptcha/;" - Source: "00000000-00003888.00000001.78451.04080000.00000004.mdmp") Found URL "https://steamloopback.host" - Source: "00000000-00003888.00000001.78451.04080000.00000004.mdmp") Found URL "https://store.steampowered.com/;expires:" - Source: "00000000-00003888.00000001.78451.04080000.00000004.mdmp") Found URL "https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=g517uopauy8x&l=english&_cdn=akamai" - Source: "00000000-00003888.00000001.78451.04080000.00000004.mdmp") Found URL "https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=wgcgw2rjiiq0&l=english&_cdn=akamai" - Source: "00000000-00003888.00000001.78451.04080000.00000004.mdmp") Found URL "https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=5fbr3ly2nkik&l=english&_cdn=akamai" - Source: "00000000-00003888.00000001.78451.04080000.00000004.mdmp") Found URL "https://community.akamai.steamstatic.com/public/css/globalv2.css?v=driomtao1-6b&l=english&_cdn=akamai" - Source: "00000000-00003888.00000001.78451.04080000.00000004.mdmp") Found URL "https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=ofpptuz_etfk&l=english&_cdn=akamai" - Source: "00000000-00003888.00000001.78451.04080000.00000004.mdmp") Found URL "https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=iwtbnfm6geks&l=english&_cdn=akamai" - Source: "00000000-00003888.00000001.78451.04080000.00000004.mdmp") Found URL "https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=cmt0gkdqa1ot&l=english&_cdn=akamai" - Source: "00000000-00003888.00000001.78451.04080000.00000004.mdmp") Found URL "https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=npjelbnreo6w&l=english&_cdn=akamai" - Source: "00000000-00003888.00000001.78451.04080000.00000004.mdmp") Found URL "https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdakocdigbc&l=english&_cdn=akamai&load=effects,controls,slider,dragdrop" - Source: "00000000-00003888.00000001.78451.04080000.00000004.mdmp") Found URL "https://community.akamai.steamstatic.com/public/javascript/global.js?v=uixvhtqqsfxt&l=english&_cdn=akamai" - Source: "00000000-00003888.00000001.78451.04080000.00000004.mdmp") Found URL "https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=gqhvlrk4-jx-&l=english&_cdn=akamai" - Source: "00000000-00003888.00000001.78451.04080000.00000004.mdmp") Found URL "https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=a9q1reojmdbo&l=english&_cdn=akamai" - Source: "00000000-00003888.00000001.78451.04080000.00000004.mdmp") Found URL "https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=abyllorgn4b_&l=english&_cdn=akamai" - Source: "00000000-00003888.00000001.78451.04080000.00000004.mdmp") Found URL "https://community.akamai.steamstatic.com/public/shared/javascript/auth_refresh.js?v=w6qbwi-5-j2s&l=english&_cdn=akamai" - Source: "00000000-00003888.00000001.78451.04080000.00000004.mdmp") Found URL "https://community.akamai.steamstatic.com/public/javascript/modalcontent.js?v=ebc6wsfpyw7y&l=english&_cdn=akamai" - Source: "00000000-00003888.00000001.78451.04080000.00000004.mdmp") Found URL "https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=zbxeuexvq0fz&l=english&_cdn=akamai" - Source: "00000000-00003888.00000001.78451.04080000.00000004.mdmp") Found URL "https://community.akamai.steamstatic.com/public/javascript/profile.js?v=mi3ojmipybxa&l=english&_cdn=akamai" - Source: "00000000-00003888.00000001.78451.04080000.00000004.mdmp") Found URL "https://community.akamai.steamstatic.com/public/javascript/reportedcontent.js?v=qnay-krx3moe&l=english&_cdn=akamai" - Source: "00000000-00003888.00000001.78451.04080000.00000004.mdmp") Found URL "https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=asnznxt9kvqn&l=english&_cdn=akamai" - Source: "00000000-00003888.00000001.78451.04080000.00000004.mdmp") Found URL "https://community.akamai.steamstatic.com/public/shared/images/responsive/steam_share_image.jpg" - Source: "00000000-00003888.00000001.78451.04080000.00000004.mdmp") Found URL "https://steamcommunity.com/login/home/?goto=profiles%2f76561199724331900" - Source: "00000000-00003888.00000001.78451.04080000.00000004.mdmp") Found URL "https://store.steampowered.com/explore/" - Source: "00000000-00003888.00000001.78451.04080000.00000004.mdmp") Found URL "https://store.steampowered.com/wishlist/" - Source: "00000000-00003888.00000001.78451.04080000.00000004.mdmp") Found URL "https://store.steampowered.com/points/shop/" - Source: "00000000-00003888.00000001.78451.04080000.00000004.mdmp") Found URL "https://store.steampowered.com/news/" - Source: "00000000-00003888.00000001.78451.04080000.00000004.mdmp") Found URL "https://store.steampowered.com/stats/" - Source: "00000000-00003888.00000001.78451.04080000.00000004.mdmp") Found URL "https://steamcommunity.com/discussions/" - Source: "00000000-00003888.00000001.78451.04080000.00000004.mdmp") Found URL "https://steamcommunity.com/workshop/" - Source: "00000000-00003888.00000001.78451.04080000.00000004.mdmp") Found URL "https://steamcommunity.com/market/" - Source: "00000000-00003888.00000001.78451.04080000.00000004.mdmp") Found URL "https://steamcommunity.com/?subsection=broadcasts" - Source: "00000000-00003888.00000001.78451.04080000.00000004.mdmp") Found URL "https://store.steampowered.com/about/" - Source: "00000000-00003888.00000001.78451.04080000.00000004.mdmp") Found URL "https://help.steampowered.com/en/" - Source: "00000000-00003888.00000001.78451.04080000.00000004.mdmp") Found URL "https://store.steampowered.com/mobile" - Source: "00000000-00003888.00000001.78451.04080000.00000004.mdmp") Found URL "https://community.akamai.steamstatic.com/public/shared/images/responsive/footerlogo_valve_new.png" - Source: "00000000-00003888.00000001.78451.04080000.00000004.mdmp") Found URL "https://store.steampowered.com/privacy_agreement/" - Source: "00000000-00003888.00000001.78451.04080000.00000004.mdmp") Found URL "http://www.valvesoftware.com/legal.htm" - Source: "00000000-00003888.00000001.78451.04080000.00000004.mdmp") Found URL "https://help.steampowered.com/faqs/view/10bb-d27a-6378-4436" - Source: "00000000-00003888.00000001.78451.04080000.00000004.mdmp") Found URL "https://store.steampowered.com/subscriber_agreement/" - Source: "00000000-00003888.00000001.78451.04080000.00000004.mdmp") Found URL "https://store.steampowered.com/steam_refunds/" - Source: "00000000-00003888.00000001.78451.04080000.00000004.mdmp") Found URL "https://store.steampowered.com/account/cookiepreferences/" - Source: "00000000-00003888.00000001.78451.04080000.00000004.mdmp") Found URL "https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png" - Source: "00000000-00003888.00000001.78451.04080000.00000004.mdmp") Found URL "https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png" - Source: "00000000-00003888.00000001.78451.04080000.00000004.mdmp") Found URL "https://community.akamai.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016" - Source: "00000000-00003888.00000001.78451.04080000.00000004.mdmp") Found URL "https://www.valvesoftware.com/contact?contact-person=translation%20team%20feedback" - Source: "00000000-00003888.00000001.78451.04080000.00000004.mdmp") Found URL "https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=oimk9sdo4iqn&l=english&_cdn=akamai" - Source: "00000000-00003888.00000001.78451.04080000.00000004.mdmp") Found URL "https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=6inmyk2ncgk7&l=english&_cdn=akamai" - Source: "00000000-00003888.00000001.78451.04080000.00000004.mdmp") Found URL "https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries" - Source: "00000000-00003888.00000001.78451.04080000.00000004.mdmp") Found URL "https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=ycibdwvvdr3r&l=english&_cdn=akamai" - Source: "00000000-00003888.00000001.78451.04080000.00000004.mdmp") Found URL "https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg" - Source: "00000000-00003888.00000001.78451.04080000.00000004.mdmp") Found URL "https://community.akamai.steamstatic.com/public/images/skin_1/arrowdn9x5.gif" - Source: "00000000-00003888.00000001.78451.04080000.00000004.mdmp")34:Tcb0,"00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGLEVEL"; Value: "") "00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGMATCHANYMASK"; Value: "") "00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: "") "00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\PSCHED\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\PSCHED"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") "00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "") "00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "USEDELAYEDACCEPTANCE"; Value: "") "00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "HELPERDLLNAME"; Value: "") "00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP6"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") "00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "") "00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "USEDELAYEDACCEPTANCE"; Value: "")35:T10a7,"00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES") "00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS") "00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS") "00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE")1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1792561733113,"unified_at":"2026-10-21T05:48:53.113Z","metadata":{"hashes":{"sha256":"00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b","sha1":"377340f26b240648cf165fe4187896850281f576","md5":"501847eb502fb6641620bce360885248","sha512":"1c58489722ee798783262e72ebfab3d9a6668f1611b04c06d237ba69e70b7f5b3bd395937e94e3d4a40a112badd78bd66c42c7c3e2c2662831215a126fa7f46b","ssdeep":"49152:xlniBG7iIlC0RbrZRdmAVF0EnG1xrTILgg8Z7:xQBGeMdmiA1xAggC7","ssdeep_chunks":["49152:xlniBG7","49152:lniBG7i","49152:niBG7iI","49152:iBG7iIl","49152:BG7iIlC","49152:G7iIlC0","49152:7iIlC0R","49152:iIlC0Rb","49152:IlC0Rbr","49152:lC0RbrZ","49152:C0RbrZR","49152:0RbrZRd","49152:RbrZRdm","49152:brZRdmA","49152:rZRdmAV","49152:ZRdmAVF","49152:RdmAVF0","49152:dmAVF0E","49152:mAVF0En","49152:AVF0EnG","49152:VF0EnG1","49152:F0EnG1x","49152:0EnG1xr","49152:EnG1xrT","49152:nG1xrTI","49152:G1xrTIL","49152:1xrTILg","49152:xrTILgg","49152:rTILgg8","49152:TILgg8Z","49152:ILgg8Z7","98304:xlniBG7","98304:lniBG7i","98304:niBG7iI","98304:iBG7iIl","98304:BG7iIlC","98304:G7iIlC0","98304:7iIlC0R","98304:iIlC0Rb","98304:IlC0Rbr","98304:lC0RbrZ","98304:C0RbrZR","98304:0RbrZRd","98304:RbrZRdm","98304:brZRdmA","98304:rZRdmAV","98304:ZRdmAVF","98304:RdmAVF0","98304:dmAVF0E","98304:mAVF0En","98304:AVF0EnG","98304:VF0EnG1","98304:F0EnG1x","98304:0EnG1xr","98304:EnG1xrT","98304:nG1xrTI","98304:G1xrTIL","98304:1xrTILg","98304:xrTILgg","98304:rTILgg8","98304:TILgg8Z","98304:ILgg8Z7","49152:xQBGeMd","49152:QBGeMdm","49152:BGeMdmi","49152:GeMdmiA","49152:eMdmiA1","49152:MdmiA1x","49152:dmiA1xA","49152:miA1xAg","49152:iA1xAgg","49152:A1xAggC","49152:1xAggC7"],"imphash":"2eabe9054cad5152567f0699947a2c5b"},"file_info":{"file_name":"file","file_type":["peexe","executable"],"file_type_id":"exe","file_size":1846784,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1728780260000,"last_seen":1786180125000,"last_multi_scan":1786180125000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["evasive","credentialharvesting","commodity","lummastealer","criminal","informationstealer","malicious"]},"stats":{"av":{"malicious_count":15,"suspicious_count":0,"total_engines":24},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":51},"sandbox_signatures":{"informative_count":96,"suspicious_count":14,"malicious_count":6,"total":116},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Packed]/Win32.Themida","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Crypt.ZPACK.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKDZ.108241","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKDZ.108241 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Packed.Themida.HZB trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Trojan.Heur!.03A120A1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Riskware ( 005cdebc1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"high_entropy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Agent.JPN.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Genus.WQR","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Themida.Win32.116868","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"}],"sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"},{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"},{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"},{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"},{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"suspicious","value":"Entrypoint in PE header is within an uncommon section"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Able to utilize the Windows bcrypt cryptographic API"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"PE file contains zero-sized sections"},{"type":"informative","value":"PE file contains zero-size sections"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains CRYPTO related strings"}],"sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"},{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"suspicious","value":"Tries to detect debugger using ProcessDebugPort"},{"type":"suspicious","value":"Sets the 'ThreadHideFromDebugger' thread data structure"}],"sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"},{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"suspicious","value":"Contains ability to detect virtual environment"}],"sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"},{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"},{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"section contains high entropy"},{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"},{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"},{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"},{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Read system defined device setup information from registry"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Reads system-defined device setup information from registry"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"malicious","value":"Reads the system/video BIOS version"}],"sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"},{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"}],"sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"},{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"},{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"suspicious","value":"Queries process information"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Spawns new processes"},{"type":"suspicious","value":"Calls an API typically used to enumerate process encountered in a system snapshot"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"}],"sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"},{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Scanning for window names"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to get active windows title"}],"sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"},{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contains references to network communication API (string)"}],"sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"},{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"},{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains reference to Sysinternals URL"}],"sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"},{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"},{"type":"malicious","value":"Makes HTTPS connections using an insecure TLS/SSL version"},{"type":"informative","value":"Uses HTTPS for communication"}],"sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"},{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","identifiers":[{"type":"malicious","value":"Application communicates with a malicious domain"}],"sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"suspicious","value":"Modifies Software Policy Settings"},{"type":"informative","value":"Writes registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"tactic":"Defense Evasion","technique":"Junk Code Insertion","attack_id":"T1027.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/016","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – Anomalous PE file structure"}],"sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to query security token membership for user discovery (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Found User Agent related strings"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Calls an API typically used to send the specified request to the HTTP server"},{"type":"informative","value":"Calls an API typically used to to receive the response to a HTTP requests"}],"sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"tactic":"Command and Control","technique":"Dead Drop Resolver","attack_id":"T1102.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1102/001","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Web Service","attack_id":"T1567","attack_id_wiki":"https://attack.mitre.org/techniques/T1567","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"},{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00008132.00000000.200405.00790000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \".rsrc\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.948885981882291","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"},{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"},{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00008132-00000C29-2133715095\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"},{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"file.exe\" called \"GetForegroundWindow\" (UID: 00000000-00008132)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"},{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"file.exe\" called \"IsWow64Process\" with parameter \"8132\" - (UID: 00000000-00008132)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"},{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"file.exe\" called \"GetWindowTextA\" (UID: 00000000-00008132)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"},{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"file.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00008132)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"},{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$27","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"},{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"file.exe\" called \"GetVersionExA\" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008132)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"},{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"file.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"},{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"informative","category":"General","name":"An application crash occurred","description":"Report process \"WerFault.exe\" was created by \"svchost.exe\"\n Report process \"WerFault.exe\" was created by \"file.exe\"","origin":"Monitored Target","id":"target-2","sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$28","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"},{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$29","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"},{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"Found reference to API (Indicator: \"lstrcpy\"; File: \"file\")\n Found reference to API (Indicator: \"CloseClipboard\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"},{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"informative","category":"General","name":"Contains reference to Sysinternals URL","description":"Found string \"ess Monitor - Sysinternals: www.sysinternals.com\" (Indicator: \"www.sysinternals.com\"; Source: \"00000000-00008132.00000000.200405.00790000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-262","sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"},{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"SM0:8132:168:WilStaging_02\"\n \"Local\\SM0:8132:168:WilStaging_02\"\n \"DBWinMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"},{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$2a","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"},{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"file.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 767B0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"},{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"file.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 74370000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"},{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"file\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"},{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"file\" has an executable section named \"\"\n \"file\" has an executable section named \"afkpfgdx\"\n \"file\" has an executable section named \"yvwfweni\"\n \"file\" has an executable section named \".taggant\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"},{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"file\" has an writable section named \"\"\n \"file\" has an writable section named \".rsrc\"\n \"file\" has an writable section named \".idata\"\n \"file\" has an writable section named \"afkpfgdx\"\n \"file\" has an writable section named \"yvwfweni\"\n \"file\" has an writable section named \".taggant\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"},{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"file\" file has an entrypoint instructions - \"jmp\t0x8a200a,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"},{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \"afkpfgdx\" is \"0x199600\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"},{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \"\" is \"0x2a7000\" greater than 0x100000\n Virtual size of \"afkpfgdx\" is \"0x19a000\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"},{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"file.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"file.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"file.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"},{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"WerFault.exe\" with commandline \"-pss -s 452 -p 8132 -ip 8132\" (UID: 00000000-00007628)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 8132 -s 748\" (UID: 00000000-00007976)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 8132 -s 748\" (UID: 00000000-00005796)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"WerFault.exe\" with commandline \"-pss -s 452 -p 8132 -ip 8132\" (UID: 00000000-00007628)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 8132 -s 748\" (UID: 00000000-00007976)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 8132 -s 748\" (UID: 00000000-00005796)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"file\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"},{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"file.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"\"file.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\"; Key: \"\"; Value: \"\")\n \"file.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TIME ZONES\\PACIFIC STANDARD TIME\\DYNAMIC DST\"; Key: \"\"; Value: \"\")\n \"file.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\"; Key: \"\"; Value: \"\")\n \"file.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\\SEGMENT HEAP\"; Key: \"\"; Value: \"\")\n \"file.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WOW64\\X86\"; Key: \"\"; Value: \"\")\n \"file.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SAFEBOOT\\OPTION\"; Key: \"\"; Value: \"\")\n \"file.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SRP\\GP\\DLL\"; Key: \"\"; Value: \"\")\n \"file.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"},{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"file.exe\" queries basic process information of the \"C:\\file.exe\" (UID: 8132)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$2b","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"},{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"file.exe\" reads file \"c:\\windows\\syswow64\\ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"},{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to detect virtual environment\n Matched sigs: Able to identify virtual environment by using API string","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"},{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"file.exe\" trying to touch file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"file.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\apphelp.dll\"\n \"file.exe\" trying to touch file \"C:\\file.exe\"\n \"file.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ntdll.dll\"\n \"file.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\kernel32.dll\"\n \"file.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \"file.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"file.exe\" trying to touch file \"C:\\Windows\\Temp\\VxSSL32.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"},{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"\"file.exe\" trying to access non-existent file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"file.exe\" trying to access non-existent file \"C:\\FLTLIB.DLL\"\n \"file.exe\" trying to access non-existent file \"C:\\CRYPTSP.DLL\"\n \"file.exe\" trying to access non-existent file \"C:\\WINMM.DLL\"\n \"file.exe\" trying to access non-existent file \"C:\\winmm.dll\"\n \"file.exe\" trying to access non-existent file \"C:\\WINMMBASE.DLL\"\n \"file.exe\" trying to access non-existent file \"C:\\WINMMBASE.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"},{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"mx.p.\" [Source: file]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"},{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"r.fo/+i\"\n Heuristic match: \"lg.cz\"\n Heuristic match: \"c>.br\"\n Heuristic match: \"au(.sb\"\n Heuristic match: \"'a~m.py\"\n Heuristic match: \"@+lk.tf\"\n Heuristic match: \")6.tw\"\n Heuristic match: \"o,?.il\"\n Pattern match: \"www.sysinternals.com\"\n Pattern match: \"http://www.w3.org/2001/xmlschema-instance\"\n Heuristic match: \"u(.sb\"\n Heuristic match: \"eq0.sh\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"},{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e\n Observed JA3 fingerprint: bd0bf25947d4a37404f0424edf4db9ad","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"},{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"file.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"file.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"15\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"},{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"file.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"},{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"[AEs\" (Indicator: \"aes\"; Source: \"00000000-00008132.00000000.200405.01448000.00000080.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"},{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Read system defined device setup information from registry","description":"\"file.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0000\"; Key: \"DRIVERDESC\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00008132.00000000.200405.00790000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"file.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\"file.exe\" queried SystemProcessInformation at 00000000-00008132-00000C13-2132718937 [PID: 8132]\n \"file.exe\" queried SystemProcessInformation at 00000000-00008132-00000C13-2132728302 [PID: 8132]\n \"file.exe\" queried SystemProcessInformation at 00000000-00008132-00000C13-2132979900 [PID: 8132]\n \"file.exe\" queried SystemProcessInformation at 00000000-00008132-00000C13-2132988449 [PID: 8132]\n \"file.exe\" queried SystemProcessInformation at 00000000-00008132-00000C13-2133731114 [PID: 8132]\n \"file.exe\" queried SystemProcessInformation at 00000000-00008132-00000C13-2133740112 [PID: 8132]\n \"file.exe\" queried SystemProcessInformation at 00000000-00008132-00000C13-2133875030 [PID: 8132]\n \"file.exe\" queried SystemProcessInformation at 00000000-00008132-00000C13-2133884529 [PID: 8132]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"},{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"section contains high entropy","description":"\"file\" has section name with entropy \"7.98158841202\"\n \"file\" has section name afkpfgdx with entropy \"7.95314152386\"\n \"file\" has section name yvwfweni with entropy \"6.43624805315\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to detect virtual environment","description":"\"file.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"SYSTEMBIOSVERSION\")\n \"file.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"VIDEOBIOSVERSION\")","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-87","sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"},{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate process encountered in a system snapshot","description":"\"file.exe\" called \"Process32FirstW with parameter [System Process]\" (UID: 00000000-00008132)\n \"file.exe\" called \"Process32NextW with parameter System\" (UID: 00000000-00008132)","origin":"API Call","mitre_attack_id":"T1057","relevance":5,"id":"api-104","sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"},{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"file\" claimed CRC 1880493 while the actual is CRC 1851422","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"},{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"file\" has an entrypoint in section \".taggant\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"},{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"malicious","category":"Environment Awareness","name":"Reads the system/video BIOS version","description":"\"file.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"SYSTEMBIOSVERSION\")\n \"file.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"VIDEOBIOSVERSION\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":9,"id":"registry-6","sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"},{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (D)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"},{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"Found string \"decompression failed or archive is corrupted\" (Source: \"00000000-00003888.00000001.78451.00F11000.00000040.mdmp\")\n Found string \"compression failed\" (Source: \"00000000-00003888.00000001.78451.00F11000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"CryptCNGInitHMAC\" (Indicator: \"HMAC\"; Source: \"00000000-00003888.00000000.78156.00350000.00000004.mdmp, 00000000-00003888.00000001.78451.00350000.00000004.mdmp\")\n Found reference to \"SA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00003888.00000001.78451.00350000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$2d","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-sized sections","description":"Raw size of \".rsrc\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to utilize the Windows bcrypt cryptographic API","description":"Found reference to API \"BCryptOpenAlgorithmProvider\" (Indicator: \"BCryptOpenAlgorithmProvider\"; Source: \"00000000-00003888-00000C2C-232191514\")\n Found reference to API \"BCryptImportKeyPair\" (Indicator: \"BCryptImportKey\"; Source: \"00000000-00003888-00000C2C-233025182\")\n Found reference to API \"BCryptDestroyKey\" (Indicator: \"BCryptDestroyKey\"; Source: \"00000000-00003888-00000C2C-233026210\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-927","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$2e","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00003888.00000000.78156.00350000.00000004.mdmp, 00000000-00003888.00000001.78451.00350000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00003888.00000001.78451.00350000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2f","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"file/memory contains long string with (Indicator: \"youtube.com\"; Source: \"00000000-00003888.00000001.78451.04080000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00003888-00000C2C-225752233\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00003888-00000C2C-232894191\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00003888-00000C2C-232894326\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00003888-00000C2C-228146013\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00003888)\n \"00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00003888)\n \"00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe\" called \"Process32FirstW\" with parameters (UID: 00000000-00003888)\n \"00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe\" called \"Process32NextW\" with parameters (UID: 00000000-00003888)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00003888)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO Server Hello with Downgrade Request to TLS 1.1 or Lower\" (SID: 2071343, Rev: 1, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$30","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"3.250.92.156:443\"\n \"23.54.184.97:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"info@diginotar.nl\"\n Pattern match: \"cps-requests@verisign.com\"\n Pattern match: \"premium-server@thawte.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"informative","category":"General","name":"Found User Agent related strings","description":"Found string \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36\" (Indicator: \"mozilla/5.0 (\"; Source: \"00000000-00003888.00000000.78156.00350000.00000004.mdmp\")\n Found string \"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36\" (Indicator: \"mozilla/5.0 (\"; Source: \"00000000-00003888.00000001.78451.00350000.00000004.mdmp\")\n Found string \"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36\" (Indicator: \"user-agent: \"; Source: \"00000000-00003888.00000001.78451.00350000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"1300140054f43477@RPCRT4.dll\"\n \"1800190068e80c6c@api-ms-win-core-synch-l1-2-0.dll\"\n \"1800190088e80c6c@api-ms-win-core-synch-l1-2-0.dll\"\n \"0d000e00cc5f0c6c@ntdll.dll\"\n \"1500160020730d6e@ADVAPI32.dll\"\n \"0e000f00e4730d6e@ADVAPI32.dll\"\n \"0e000f0050740d6e@ADVAPI32.dll\"\n \"11001200d47d0d6e@ADVAPI32.dll\"\n \"110012007c7e0d6e@ADVAPI32.dll\"\n \"12001300cc7e0d6e@ADVAPI32.dll\"\n \"12001300387f0d6e@ADVAPI32.dll\"\n \"14001500e4b70d6e@ADVAPI32.dll\"\n \"1400150000b80d6e@ADVAPI32.dll\"\n \"140015001cb80d6e@ADVAPI32.dll\"\n \"1700180038b80d6e@ADVAPI32.dll\"\n \"0d000e0054b80d6e@ADVAPI32.dll\"\n \"1100120064b80d6e@ADVAPI32.dll\"\n \"110012007cb80d6e@ADVAPI32.dll\"\n \"0f001000ecb90d6e@ADVAPI32.dll\"\n \"1400150038ba0d6e@ADVAPI32.dll\"\n \"1400150054ba0d6e@ADVAPI32.dll\"\n \"0c000d00a8ba0d6e@ADVAPI32.dll\"\n \"0c000d00b8ba0d6e@ADVAPI32.dll\"\n \"0e000f00c8ba0d6e@ADVAPI32.dll\"\n \"0e000f00dcba0d6e@ADVAPI32.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"bathdoomgaz.store\"\n \"clearancek.site\"\n \"dissapoiznw.store\"\n \"eaglepawnoy.store\"\n \"licendfilteo.site\"\n \"mobbipenju.store\"\n \"spirittunek.store\"\n \"steamcommunity.com\"\n \"studennotediw.store\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\system32\\bcryptprimitives.dll\" [Source: 00000000-00003888-00000C2B-231793348]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"$31","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=DigiCert EV RSA CA G2, O=DigiCert Inc, C=US\" (SHA1: 41:3C:40:63:B9:78:68:32:EB:FA:54:6A:05:DA:00:4C:70:48:C6:F6; see report for more information)\n The input sample is signed with a certificate issued by \"CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US\" (SHA1: 09:0A:16:F9:BA:16:00:1B:2E:C1:30:F8:05:23:E5:B5:EB:25:91:58; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to send the specified request to the HTTP server","description":"$32","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-190","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to to receive the response to a HTTP requests","description":"\"00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"3d9e88\"\n \"lpReserved\": \"0\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-191","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSASend\" (Indicator: \"WSASend\"; Source: \"00000000-00003888-00000C2C-228583294\")\n Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; Source: \"00000000-00003888-00000C2C-228583588\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"AUTHUI.DLL: Shutdown Choices Message Window\" (Indicator: \" shutdown \"; Source: \"00000000-00003888.00000000.78156.013C0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"2.5.29.35\"\n Potential IP \"127.0.0.1\" found in string \"ttp://127.0.0.1:\"\n Potential IP \"2.5.29.35\" found in string \"#2.5.29.35\"\n \"2.5.29.14\"\n \"2.5.29.17\"\n \"2.5.29.32\"\n \"2.5.29.15\"\n Potential IP \"2.5.29.37\" found in string \"%2.5.29.37\"\n \"2.5.29.31\"\n \"2.5.29.19\"\n \"2.5.29.1\"\n \"2.5.4.3\"\n \"2.5.29.4\"\n \"2.5.29.10\"\n \"2.5.29.16\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$33","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"T /profiles/76561199724331900 HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00003888.00000001.78451.00350000.00000004.mdmp\")\n Found string \"HTTP/1.1 200 OK\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00003888.00000001.78451.04080000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"bathdoomgaz.store\" has high entropy\n Contacted domain: \"dissapoiznw.store\" has high entropy\n Contacted domain: \"eaglepawnoy.store\" has high entropy\n Contacted domain: \"mobbipenju.store\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"3.250.92.156\" on port \"443\"\n HTTPS traffic to \"23.54.184.97\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \":\\Windows\\system32\\kerberos.DLL\" (Indicator: \"kerberos\"; Source: \"00000000-00003888.00000000.78156.00350000.00000004.mdmp\")\n Found string \"icrosoft Kerberos V1.0\" (Indicator: \"kerberos\"; Source: \"00000000-00003888.00000000.78156.00350000.00000004.mdmp\")\n Found string \"Microsoft Kerberos V1.0\" (Indicator: \"kerberos\"; Source: \"00000000-00003888.00000000.78156.00350000.00000004.mdmp\")\n Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00003888.00000000.78156.00350000.00000004.mdmp\")\n Found string \"\\Windows\\system32\\kerberos.DLL\" (Indicator: \"kerberos\"; Source: \"00000000-00003888.00000001.78451.00350000.00000004.mdmp\")\n Found string \"crosoft Kerberos V1.0\" (Indicator: \"kerberos\"; Source: \"00000000-00003888.00000001.78451.00350000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"\"00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe\" called \"FindFirstFileW\" with parameter %APPDATA%\\Microsoft\\SystemCertificates\\My\\Certificates\\* (UID: 00000000-00003888)\n \"00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe\" called \"FindNextFileW\" with parameter .. (UID: 00000000-00003888)\n \"00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe\" called \"FindFirstFileW\" with parameter %APPDATA%\\Microsoft\\SystemCertificates\\My\\CRLs\\* (UID: 00000000-00003888)\n \"00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe\" called \"FindFirstFileW\" with parameter %APPDATA%\\Microsoft\\SystemCertificates\\My\\CTLs\\* (UID: 00000000-00003888)","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0000\"; Key: \"DRIVERDESC\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$34","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"\"00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\LOCAL SETTINGS\\MUICACHE\\137\\52C64B7E\"; Key: \"LANGUAGELIST\"; Value: \"en-US\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"CloseClipboard\" (Source: 00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b, API is part of module: USER32.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b\" has section name with entropy \"7.98158841202185\"\n \"00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b\" has section name afkpfgdx with entropy \"7.953141523858513\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Sets the 'ThreadHideFromDebugger' thread data structure","description":"\"00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe\" is setting \"ThreadHideFromDebugger\" data for thread ID 0xfffffffe","origin":"API Call","mitre_attack_id":"T1622","relevance":10,"id":"api-84","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Tries to detect debugger using ProcessDebugPort","description":"\"00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b.exe queries ProcessDebugPort (UID: 3888)","origin":"API Call","mitre_attack_id":"T1622","relevance":5,"id":"api-238","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"14/23 Antivirus vendors marked sample as malicious (60% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 3.250.92.156 on port 443 is sent without HTTP header\n TCP traffic to 23.54.184.97 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – Anomalous PE file structure","description":"YARA signature for null IAT Directory of PE file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":1,"id":"yara-153","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found an instant messenger related domain","description":"\"login.skype.com0\" (Indicator: \"skype.com\")\n \"login.skype.com\" (Indicator: \"skype.com\")\n \"www.login.skype.com0\" (Indicator: \"skype.com\")","origin":"File/Memory","relevance":10,"id":"string-61","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$35","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"14/23 Antivirus vendors marked sample as malicious (60% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"malicious","category":"Network Related","name":"Application communicates with a malicious domain","description":"Contacted Domain: \"clearancek.site\" has been identified as malicious","origin":"Network Traffic","mitre_attack_id":"T1566","relevance":10,"id":"network-88","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"level":"malicious","category":"Network Related","name":"Makes HTTPS connections using an insecure TLS/SSL version","description":"Connection was made using TLSv1.0 [tls.handshake.version: 0x0301]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":10,"id":"network-53","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"},{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Queries process information"},{"detail":"Reads the system/video BIOS version"}],"sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"},{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Sets the 'ThreadHideFromDebugger' thread data structure"}],"sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"},{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 9 domains and 9 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]}]},"activity":{"stats":{"process_count":4,"spawned_processes_count":4,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":4,"imported_dlls_count":82,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":32,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":32,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":9,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["evasive","credentialharvesting","commodity","lummastealer","criminal","informationstealer","malicious"],"sample_flags":["Sample Crashed","Network Traffic"],"sandbox_reports":[{"id":"6a76f21c400267284f09b7c0","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Packed.Themida","contacted_countries":["IRL","USA"],"submit_name":"00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b","analysis_start_time":"2026-08-08T09:08:45+00:00","indicators_count":{"informative":85,"suspicious":30,"malicious":6},"tags":["Network Traffic"],"is_in_unified_schema":true},{"id":"670b17e4e6bcb0cc610a84ae","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"submit_name":"file","analysis_start_time":"2024-10-13T00:44:20+00:00","indicators_count":{"informative":50,"suspicious":12,"malicious":2},"tags":["Sample Crashed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"3.250.92.156","port":443,"protocol":"TCP","country":"Ireland","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"address":"23.54.184.97","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]}],"dns_resolutions":[{"domain":"bathdoomgaz.store","ttl":218,"country":"-","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"domain":"clearancek.site","address":"3.250.92.156","ttl":7,"country":"Ireland","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"domain":"dissapoiznw.store","ttl":98,"country":"-","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"domain":"eaglepawnoy.store","ttl":38,"country":"-","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"domain":"licendfilteo.site","ttl":158,"country":"-","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"domain":"mobbipenju.store","ttl":278,"country":"-","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"domain":"spirittunek.store","ttl":158,"country":"-","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"domain":"steamcommunity.com","address":"23.54.184.97","ttl":20,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"domain":"studennotediw.store","ttl":38,"country":"-","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"}],"processes":[{"pid":8132,"ppid":0,"name":"file.exe","command_line":"","sha256":"00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b","normalized_path":"C:\\file.exe","uid":"00000000-00008132","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":7976,"ppid":8132,"name":"WerFault.exe","command_line":"-u -p 8132 -s 748","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00008132","uid":"00000000-00007976"},{"pid":5796,"ppid":8132,"name":"WerFault.exe","command_line":"-u -p 8132 -s 748","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00008132","uid":"00000000-00005796"},{"pid":7628,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 452 -p 8132 -ip 8132","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00007628","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="}],"all_imported_dlls":["ws2_32.dll","bcryptprimitives.dll","combase.dll","shlwapi.dll","kernel.appcore.dll","profapi.dll","KernelBase.dll","fltLib.dll","gdi32full.dll","msvcp_win.dll","SHCore.dll","kernel32.dll","rpcrt4.dll","ucrtbase.dll","ole32.dll","cfgmgr32.dll","wow64.dll","win32u.dll","advapi32.dll","cryptsp.dll","wow64cpu.dll","cryptbase.dll","gdi32.dll","msvcrt.dll","winmm.dll","winmmbase.dll","wow64win.dll","user32.dll","sspicli.dll","sechost.dll","windows.storage.dll","ntdll.dll","VxSSL32.dll","oleaut32.dll","imm32.dll","powrprof.dll","shell32.dll","apphelp.dll","api-ms-win-core-synch-l1-2-0.dll","secur32.dll","api-ms-win-crt-runtime-l1-1-0.dll","api-ms-win-core-file-l2-1-0.dll","winhttp.dll","lpk.dll","api-ms-win-core-localization-l1-2-0.dll","api-ms-win-crt-heap-l1-1-0.dll","api-ms-win-crt-string-l1-1-0.dll","api-ms-win-crt-stdio-l1-1-0.dll","crypt32.dll","mswsock.dll","gpapi.dll","usp10.dll","FWPUCLNT.DLL","api-ms-win-crt-math-l1-1-0.dll","msvcp140.dll","IPHLPAPI.DLL","nsi.dll","vcruntime140.dll","api-ms-win-crt-convert-l1-1-0.dll","api-ms-win-crt-locale-l1-1-0.dll","WSHTCPIP.DLL","dnsapi.dll","rasadhlp.dll","bcrypt.dll","winnsi.dll","api-ms-win-crt-environment-l1-1-0.dll","api-ms-win-crt-utility-l1-1-0.dll","wship6.dll","api-ms-win-core-timezone-l1-1-0.dll","api-ms-win-core-processthreads-l1-1-1.dll","api-ms-win-core-file-l1-2-0.dll","api-ms-win-crt-filesystem-l1-1-0.dll","userenv.dll","rsaenh.dll","wshqos.dll","webio.dll","credssp.dll","schannel.dll","msasn1.dll","api-ms-win-crt-time-l1-1-0.dll","msctf.dll","ncrypt.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"},{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\MY\\","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"SM0:8132:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"}]},{"name":"Local\\SM0:8132:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"}]},{"name":"DBWinMutex","sources":[{"report_type":"sandbox","report_id":"670b17e4e6bcb0cc610a84ae"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"6a76f21c400267284f09b7c0"}]}]}},"report_ids":{"sandbox_job_ids":["6a76f21c400267284f09b7c0","670b17e4e6bcb0cc610a84ae"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 00ffb53eeccb… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 00ffb53eeccb…. Malware family: Trojan.Generic. Threat score 100/100. 15/24 AV engines flagged this file. 6 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 00ffb53eeccb… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 00ffb53eeccb…. Malware family: Trojan.Generic. Threat score 100/100. 15/24 AV engines flagged this file. 6 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/00ffb53eeccbf175fee55d66119d997ed732aaa3d7aec64919a8c5726dd9301b"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 00ffb53eeccb… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 00ffb53eeccb…. Malware family: Trojan.Generic. Threat score 100/100. 15/24 AV engines flagged this file. 6 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L36","11",{}]]