24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 3d:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4e5,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious WinGo/Kryptik.ABY trojan Sample 01ec79ca328f… — Score 92/100 — Hybrid Analysis","description":"Malicious verdict for sample 01ec79ca328f…. Malware family: WinGo/Kryptik.ABY trojan. Threat score 92/100. 8/25 AV engines flagged this file. 4 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/01ec79ca328f90e03dd0c9ab0c115bacc279fa5eccea4cc03e4676dc9da78399","keywords":["Malicious","WinGo/Kryptik.ABY trojan","malware analysis","sandbox report","threat intelligence","01ec79ca328f90e03dd0c9ab0c115bacc279fa5eccea4cc03e4676dc9da78399"],"about":{"@type":"SoftwareApplication","name":"01ec79ca328f90e03dd0c9ab0c115bacc279fa5eccea4cc03e4676dc9da78399","applicationCategory":["peexe","64bits","executable"],"identifier":"01ec79ca328f90e03dd0c9ab0c115bacc279fa5eccea4cc03e4676dc9da78399","additionalType":"Malicious sample"},"threatScore":92,"malwareFamily":"WinGo/Kryptik.ABY trojan","antivirusDetections":{"malicious":8,"total":25},"behavioralIndicators":{"malicious":4,"suspicious":9},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T586,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "Bootrsraptler_42.2.62851.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "Bootrsraptler_42.2.62851.exe") file/memory contains long string with (Indicator: "FreeLibrary"; File: "Bootrsraptler_42.2.62851.exe") file/memory contains long string with (Indicator: "LoadLibrary"; File: "Bootrsraptler_42.2.62851.exe") Found reference to API "runtime.getLoadLibraryEx" (Indicator: "LoadLibrary"; File: "Bootrsraptler_42.2.62851.exe") Found reference to API "runtime.getLoadLibrary" (Indicator: "LoadLibrary"; File: "Bootrsraptler_42.2.62851.exe") Found reference to API "syscall.LoadLibrary" (Indicator: "LoadLibrary"; File: "Bootrsraptler_42.2.62851.exe") Found reference to API "syscall._LoadLibrary" (Indicator: "LoadLibrary"; File: "Bootrsraptler_42.2.62851.exe") Found reference to API "syscall.procLoadLibraryW" (Indicator: "LoadLibrary"; File: "Bootrsraptler_42.2.62851.exe") Found reference to API "syscall.LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00008156.00000000.177465.015DE000.00000002.mdmp") Found reference to API "syscall._LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00008156.00000000.177465.015DE000.00000002.mdmp") Found reference to API "syscall.procLoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00008156.00000000.177465.015DE000.00000002.mdmp")26:T4f82,Found api reference "bad g0 stackself-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchOpenServiceWRevertToSelfCreateEventWGetConsoleCPUnlockFileExVirtualQuerynot pollableunknown type no name space closed by status= pluginpath= runtime" (Indicator: "CertOpenStore"; File: "Bootrsraptler_42.2.62851.exe") Found api reference ": pid=: unknown pc called from GetTempPath2WModule32NextWRegDeleteKeyWRegEnumValueWunexpected EOF> closed by closed by work.nprocs, gp->atomicstatus=marking free object KiB work (eager), [controller reset]mspan.sweep: state=sysMemStat overflowbad sequence numberntdll.dll not foundwinmm.dll not foundruntime: g0 stack [panic during mallocpanic holding locksmissing deferreturnunexpected gp.parampanic during panic, g->atomicstatus=unexpected g statusbad runtime" (Indicator: "CryptReleaseContext"; File: "Bootrsraptler_42.2.62851.exe") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptiondodeltimer: wrong Padjusttimers: bad pSetTokenInformationMultiByteToWideCharfile already existsfile does not existfile already closedinvalid 23283064365386962890625device or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWreflect.Value.Interfacereflect.Value.NumMethodindex out of range [%x]ReadMemStatsSlow (test)runtimecontentionstackschan receive (nil chan)garbage collection scanmakechan: bad alignmentclose of closed channel) must be a power of 2system huge page size (runtime: s.allocCount= s.allocCount > s.nelemsmissing type in runfinqruntime: internal errorwork.nwait > work.nprocleft over markroot jobsgcDrain phase incorrectMB during sweep; swept bad profile stack countruntime: netpoll failedRtlGetNtVersionNumbers" (Indicator: "CertGetCertificateChain"; File: "Bootrsraptler_42.2.62851.exe") Found api reference "panic during preemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locksinvalid m->lockedInt = procresize: invalid argspan has no free stacksstack growth after forkshrinkstack at bad timereflect.methodValueCallDestroyEnvironmentBlock" missing CPU support116415321826934814453125582076609134674072265625connection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWreflect.Value.SetComplexhash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of queuefinalizer during GCupdate during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlapsstack trace unavailablebindm in unexpected GOOSrunqsteal: runq overflowdouble traceGCSweepStartbad use of trace.seqlockXML s" (Indicator: "CertFreeCertificateChain"; File: "Bootrsraptler_42.2.62851.exe") Found api reference "lock: lock countbad system huge page sizearena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of remaining pointer buffersslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p has runnable gsstoplockedm: not runnablereleasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStartinconsistent poll.fdMutexExpandEnvironmentStringsWGODEBUG: can not enable "binary.Read: invalid type reflect.Value.CanInterfaceGetFileInformationByHandle1455191522836685180664062572759576141834259033203125invalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextPostQueuedCompletionStatus using unaddressable valueunknown ABI parameter kindall goroutines stack tracecall from unknown functionnotewakeup - doub" (Indicator: "CertFreeCertificateContext"; File: "Bootrsraptler_42.2.62851.exe"), Found api reference "le wakeuppersistentalloc: size == 0negative idle mark workersuse of invalid sweepLockerruntime: bad span s.state=freedefer with d.fn != nilforEachP: P did not run fnwakep: negative nmspinningstartlockedm: locked to meentersyscall inconsistent inittask with no functionscorrupted semaphore ticketout of memory (stackalloc)shrinking stack in libcallruntime: pcHeader: magic= traceRegion: out of memorySetFileInformationByHandlexml: opening charset %q: %w363797880709171295166015625channel number out of rangecommunication error on sendkey was rejected by servicenot a XENIX named type fileCertEnumCertificatesInStorereflect.Value.UnsafePointer is not assignable to type PageCachePagesLeaked (test)makechan: size out of rangeG waiting list is corruptedruntime" (Indicator: "CertEnumCertificatesInStore"; File: "Bootrsraptler_42.2.62851.exe"), Found api reference "unlock: lock countprogToPointerMask: overflowfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: corrupted polldescruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcinternal lockOSThread errorruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for abi.NewName: tag too long: GetFileInformationByHandleEx18189894035458564758300781259094947017729282379150390625file descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextcomparing uncomparable type runtime: bad lfnode addre" (Indicator: "CertCreateCertificateContext"; File: "Bootrsraptler_42.2.62851.exe"), Found api reference "untime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangeunescaped < inside quoted string28421709430404007434844970703125resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyMapIter.Value called before Nextreflect.Value.Grow: negative lenbufio: tried to fill full bufferslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceGCProg for type that isn't largeruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max pages = WSAGetOverlappedResult not found_cgo_pthread_key_created missingruntime: sudog with non-nil elemruntime: sudog with non-nil nextruntime: sudog with non-nil prevrunt" (Indicator: "CertAddCertificateContextToStore"; File: "Bootrsraptler_42.2.62851.exe"), Found api reference "untime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangeunescaped < inside quoted string28421709430404007434844970703125resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyMapIter.Value called before Nextreflect.Value.Grow: negative lenbufio: tried to fill full bufferslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceGCProg for type that isn't largeruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max pages = WSAGetOverlappedResult not found_cgo_pthread_key_created missingruntime: sudog with non-nil elemruntime: sudog with non-nil nextruntime: sudog with non-nil prevrunt" (Indicator: "CertVerifyCertificateChainPolicy"; File: "Bootrsraptler_42.2.62851.exe"), Found api reference "bad g0 stackself-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchOpenServiceWRevertToSelfCreateEventWGetConsoleCPUnlockFileExVirtualQuerynot pollableunknown type no name space closed by status= pluginpath= runtim" (Indicator: "CertOpenStore"; File: "Bootrsraptler_42.2.62851.exe") Found api reference "panic during preemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locksinvalid m->lockedInt = procresize: invalid argspan has no free stacksstack growth after forkshrinkstack at bad timereflect.methodValueCallDestroyEnvironmentBlock" missing CPU support116415321826934814453125582076609134674072265625connection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWreflect.Value.SetComplexhash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of queuefinalizer during GCupdate during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlapsstack trace unavailablebindm in unexpected GOOSrunqsteal: runq overflowdouble traceGCSweepStartbad use of trace.seqlockXML" (Indicator: "CertFreeCertificateChain"; File: "Bootrsraptler_42.2.62851.exe") Found api reference "lock: lock countbad system huge page sizearena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of remaining pointer buffersslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p has runnable gsstoplockedm: not runnablereleasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStartinconsistent poll.fdMutexExpandEnvironmentStringsWGODEBUG: can not enable "binary.Read: invalid type reflect.Value.CanInterfaceGetFileInformationByHandle1455191522836685180664062572759576141834259033203125invalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextPostQueuedCompletionStatus using unaddressable valueunknown ABI parameter kindall goroutines stack tracecall from unknown functionnotewakeup - dou" (Indicator: "CertFreeCertificateContext"; File: "Bootrsraptler_42.2.62851.exe"), Found api reference "unlock: lock countprogToPointerMask: overflowfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: corrupted polldescruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcinternal lockOSThread errorruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for abi.NewName: tag too long: GetFileInformationByHandleEx18189894035458564758300781259094947017729282379150390625file descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextcomparing uncomparable type runtime: bad lfnode addr" (Indicator: "CertCreateCertificateContext"; File: "Bootrsraptler_42.2.62851.exe"), Found api reference "untime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangeunescaped < inside quoted string28421709430404007434844970703125resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyMapIter.Value called before Nextreflect.Value.Grow: negative lenbufio: tried to fill full bufferslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceGCProg for type that isn't largeruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max pages = WSAGetOverlappedResult not found_cgo_pthread_key_created missingruntime: sudog with non-nil elemruntime: sudog with non-nil nextruntime: sudog with non-nil prevrun" (Indicator: "CertAddCertificateContextToStore"; File: "Bootrsraptler_42.2.62851.exe"), Found api reference "untime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangeunescaped < inside quoted string28421709430404007434844970703125resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyMapIter.Value called before Nextreflect.Value.Grow: negative lenbufio: tried to fill full bufferslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceGCProg for type that isn't largeruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max pages = WSAGetOverlappedResult not found_cgo_pthread_key_created missingruntime: sudog with non-nil elemruntime: sudog with non-nil nextruntime: sudog with non-nil prevrun" (Indicator: "CertVerifyCertificateChainPolicy"; File: "Bootrsraptler_42.2.62851.exe")27:T7f8,Contains base64 string in header "POST" in header "POST /users HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedHost: github.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 89" Contains base64 string in header "Keep" in header "POST /users HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedHost: github.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 89" Contains base64 string in header "cacheContent" in header "POST /users HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedHost: github.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 89" Contains base64 string in header "Type" in header "POST /users HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedHost: github.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 89" Contains base64 string in header "form" in header "POST /users HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedHost: github.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 89" Contains base64 string in header "like" in header "POST /users HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedHost: github.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 89"28:Tb86,Found XOR loop in file "sample.bin" at offset 86352; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3357873; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5208384; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4010857; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4273001; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4341879; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4431938; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4807305; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8237024; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 166870; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 256111; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 327046; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 451374; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 451418; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 849951; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1678021; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1678083; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1678147; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1678210; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2188768; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2188867; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2561272; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2561351; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2561381; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2561411; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2561441; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2561471; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2561501; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2561662; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3803883; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8196672; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8206448; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8207460; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8228576; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8327400; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8431964; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8471460; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8493456; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8573911; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8578592; code bytes = 803029:Ta1e,"Bootrsraptler_42.2.62851.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000051a7d64efc7f00000000000000000000000000000000000040eb7f7969000000000000000000000090ea7f79690000001033e44efc7f000000000000000000009032e44efc7f00000400000000000000000000009b010000000000009b0100002c8d362cfc7f000080ed0cd69b01000008eb7f79690000002100220069000000b2af362cfc7f0000000000000000000010012d2cfc7f000040000000000000000000000000000000500b0dd69b01000000740cd69b010000c9eb7f79690000001ba0d64efc7f000000740cd69b01000030140cd69b0100000000000000000000c3f0d34efc7f0000da014eac00000000e884d44efc7f000018740cd6 (UID: 00000000-00008156) "Bootrsraptler_42.2.62851.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008156) "Bootrsraptler_42.2.62851.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008156) "Bootrsraptler_42.2.62851.exe" called "RtlGetVersion" with parameter 240100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008156)2a:Ta67,"Bootrsraptler_42.2.62851.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") "Bootrsraptler_42.2.62851.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\40078385-F676-4C61-9A9C-F9028599D6D3_IS1") "Bootrsraptler_42.2.62851.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\40078385-F676-4C61-9A9C-F9028599D6D3_IS1"; Key: "DISPLAYNAME") "Bootrsraptler_42.2.62851.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK") "Bootrsraptler_42.2.62851.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK"; Key: "DISPLAYNAME") "Bootrsraptler_42.2.62851.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CONNECTION MANAGER") "Bootrsraptler_42.2.62851.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CONNECTION MANAGER"; Key: "DISPLAYNAME") "Bootrsraptler_42.2.62851.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DIRECTDRAWEX") "Bootrsraptler_42.2.62851.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DIRECTDRAWEX"; Key: "DISPLAYNAME") "Bootrsraptler_42.2.62851.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DXM_RUNTIME") "Bootrsraptler_42.2.62851.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DXM_RUNTIME"; Key: "DISPLAYNAME") "Bootrsraptler_42.2.62851.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\FONTCORE") "Bootrsraptler_42.2.62851.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\FONTCORE"; Key: "DISPLAYNAME") "Bootrsraptler_42.2.62851.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE40") "Bootrsraptler_42.2.62851.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE40"; Key: "DISPLAYNAME") "Bootrsraptler_42.2.62851.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE4DATA") "Bootrsraptler_42.2.62851.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE4DATA"; Key: "DISPLAYNAME") "Bootrsraptler_42.2.62851.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE5BAKEX") "Bootrsraptler_42.2.62851.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE5BAKEX"; Key: "DISPLAYNAME") "Bootrsraptler_42.2.62851.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IEDATA") "Bootrsraptler_42.2.62851.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IEDATA"; Key: "DISPLAYNAME") "Bootrsraptler_42.2.62851.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\MITMPROXY 12.2.3")2b:T571,"Bootrsraptler_42.2.62851.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00008156) "Bootrsraptler_42.2.62851.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00008156) "Bootrsraptler_42.2.62851.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00008156) "Bootrsraptler_42.2.62851.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00008156) "Bootrsraptler_42.2.62851.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00008156) "Bootrsraptler_42.2.62851.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00008156) "Bootrsraptler_42.2.62851.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00008156) "Bootrsraptler_42.2.62851.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00008156) "Bootrsraptler_42.2.62851.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00008156) "Bootrsraptler_42.2.62851.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00008156) "Bootrsraptler_42.2.62851.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00008156) "Bootrsraptler_42.2.62851.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00008156) "Bootrsraptler_42.2.62851.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00008156)2c:T1c11,"Bootrsraptler_42.2.62851.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00008156) "Bootrsraptler_42.2.62851.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00008156) "Bootrsraptler_42.2.62851.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00008156) "Bootrsraptler_42.2.62851.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00008156) "Bootrsraptler_42.2.62851.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00008156) "Bootrsraptler_42.2.62851.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00008156) "Bootrsraptler_42.2.62851.exe" called "GetProcAddress" with a parameter ProcessPrng (UID: 00000000-00008156) "Bootrsraptler_42.2.62851.exe" called "GetProcAddress" with a parameter RtlGetCurrentPeb (UID: 00000000-00008156) "Bootrsraptler_42.2.62851.exe" called "GetProcAddress" with a parameter RtlGetNtVersionNumbers (UID: 00000000-00008156) "Bootrsraptler_42.2.62851.exe" called "GetProcAddress" with a parameter timeBeginPeriod (UID: 00000000-00008156) "Bootrsraptler_42.2.62851.exe" called "GetProcAddress" with a parameter timeEndPeriod (UID: 00000000-00008156) "Bootrsraptler_42.2.62851.exe" called "GetProcAddress" with a parameter WSAGetOverlappedResult (UID: 00000000-00008156) "Bootrsraptler_42.2.62851.exe" called "GetProcAddress" with a parameter PowerRegisterSuspendResumeNotification (UID: 00000000-00008156) "Bootrsraptler_42.2.62851.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00008156) "Bootrsraptler_42.2.62851.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00008156) "Bootrsraptler_42.2.62851.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00008156) "Bootrsraptler_42.2.62851.exe" called "GetProcAddress" with a parameter SetFileCompletionNotificationModes (UID: 00000000-00008156) "Bootrsraptler_42.2.62851.exe" called "GetProcAddress" with a parameter WSAEnumProtocolsW (UID: 00000000-00008156) "Bootrsraptler_42.2.62851.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00008156) "Bootrsraptler_42.2.62851.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00008156) "Bootrsraptler_42.2.62851.exe" called "GetProcAddress" with a parameter GetCommandLineW (UID: 00000000-00008156) "Bootrsraptler_42.2.62851.exe" called "GetProcAddress" with a parameter GetProcessHeap (UID: 00000000-00008156) "Bootrsraptler_42.2.62851.exe" called "GetProcAddress" with a parameter TlsAlloc (UID: 00000000-00008156) "Bootrsraptler_42.2.62851.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00008156) "Bootrsraptler_42.2.62851.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00008156) "Bootrsraptler_42.2.62851.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00008156) "Bootrsraptler_42.2.62851.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00008156) "Bootrsraptler_42.2.62851.exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00008156) "Bootrsraptler_42.2.62851.exe" called "GetProcAddress" with a parameter GetComputerNameA (UID: 00000000-00008156) "Bootrsraptler_42.2.62851.exe" called "GetProcAddress" with a parameter GetComputerNameExA (UID: 00000000-00008156) "Bootrsraptler_42.2.62851.exe" called "GetProcAddress" with a parameter GlobalLock (UID: 00000000-00008156) "Bootrsraptler_42.2.62851.exe" called "GetProcAddress" with a parameter GlobalUnlock (UID: 00000000-00008156) "Bootrsraptler_42.2.62851.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00008156) "Bootrsraptler_42.2.62851.exe" called "GetProcAddress" with a parameter CoInitialize (UID: 00000000-00008156) "Bootrsraptler_42.2.62851.exe" called "GetProcAddress" with a parameter CoInitializeSecurity (UID: 00000000-00008156) "Bootrsraptler_42.2.62851.exe" called "GetProcAddress" with a parameter CoSetProxyBlanket (UID: 00000000-00008156) "Bootrsraptler_42.2.62851.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00008156) "Bootrsraptler_42.2.62851.exe" called "GetProcAddress" with a parameter CloseDesktop (UID: 00000000-00008156) "Bootrsraptler_42.2.62851.exe" called "GetProcAddress" with a parameter CreateDesktopW (UID: 00000000-00008156) "Bootrsraptler_42.2.62851.exe" called "GetProcAddress" with a parameter EnumDisplaySettingsW (UID: 00000000-00008156) "Bootrsraptler_42.2.62851.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00008156) "Bootrsraptler_42.2.62851.exe" called "GetProcAddress" with a parameter GetDC (UID: 00000000-00008156) "Bootrsraptler_42.2.62851.exe" called "GetProcAddress" with a parameter GetKeyboardLayout (UID: 00000000-00008156) "Bootrsraptler_42.2.62851.exe" called "GetProcAddress" with a parameter GetKeyboardLayoutNameW (UID: 00000000-00008156) "Bootrsraptler_42.2.62851.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00008156) "Bootrsraptler_42.2.62851.exe" called "GetProcAddress" with a parameter GetWindowDC (UID: 00000000-00008156) "Bootrsraptler_42.2.62851.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00008156) "Bootrsraptler_42.2.62851.exe" called "GetProcAddress" with a parameter OpenDesktopW (UID: 00000000-00008156) "Bootrsraptler_42.2.62851.exe" called "GetProcAddress" with a parameter ReleaseDC (UID: 00000000-00008156) "Bootrsraptler_42.2.62851.exe" called "GetProcAddress" with a parameter GetUserNameA (UID: 00000000-00008156) "Bootrsraptler_42.2.62851.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00008156) "Bootrsraptler_42.2.62851.exe" called "GetProcAddress" with a parameter BitBlt (UID: 00000000-00008156) "Bootrsraptler_42.2.62851.exe" called "GetProcAddress" with a parameter CreateCompatibleBitmap (UID: 00000000-00008156) "Bootrsraptler_42.2.62851.exe" called "GetProcAddress" with a parameter CreateCompatibleDC (UID: 00000000-00008156) "Bootrsraptler_42.2.62851.exe" called "GetProcAddress" with a parameter DeleteDC (UID: 00000000-00008156) "Bootrsraptler_42.2.62851.exe" called "GetProcAddress" with a parameter DeleteObject (UID: 00000000-00008156) "Bootrsraptler_42.2.62851.exe" called "GetProcAddress" with a parameter GetCurrentObject (UID: 00000000-00008156) "Bootrsraptler_42.2.62851.exe" called "GetProcAddress" with a parameter GetDIBits (UID: 00000000-00008156) "Bootrsraptler_42.2.62851.exe" called "GetProcAddress" with a parameter GetObjectW (UID: 00000000-00008156) "Bootrsraptler_42.2.62851.exe" called "GetProcAddress" with a parameter SelectObject (UID: 00000000-00008156) "Bootrsraptler_42.2.62851.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00008156) "Bootrsraptler_42.2.62851.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00008156) "Bootrsraptler_42.2.62851.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00008156)2d:T306b,Found reference to API (Indicator: "WriteFile"; File: "Bootrsraptler_42.2.62851.exe") Found reference to API (Indicator: "GetSystemInfo"; File: "Bootrsraptler_42.2.62851.exe") Found reference to API (Indicator: "GetQueuedCompletionStatusEx"; File: "Bootrsraptler_42.2.62851.exe") Found reference to API (Indicator: "WriteConsoleW"; File: "Bootrsraptler_42.2.62851.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "Bootrsraptler_42.2.62851.exe") Found reference to API (Indicator: "AddVectoredContinueHandler"; File: "Bootrsraptler_42.2.62851.exe") Found reference to API (Indicator: "GetErrorMode"; File: "Bootrsraptler_42.2.62851.exe") Found reference to API (Indicator: "VirtualFree"; File: "Bootrsraptler_42.2.62851.exe") Found reference to API (Indicator: "SetProcessPriorityBoost"; File: "Bootrsraptler_42.2.62851.exe") Found reference to API (Indicator: "CreateIoCompletionPort"; File: "Bootrsraptler_42.2.62851.exe") Found reference to API (Indicator: "CreateEventA"; File: "Bootrsraptler_42.2.62851.exe") Found reference to API (Indicator: "AddVectoredExceptionHandler"; File: "Bootrsraptler_42.2.62851.exe") Found reference to API (Indicator: "RtlLookupFunctionEntry"; File: "Bootrsraptler_42.2.62851.exe") Found reference to API (Indicator: "LoadLibraryExW"; File: "Bootrsraptler_42.2.62851.exe") Found reference to API (Indicator: "SuspendThread"; File: "Bootrsraptler_42.2.62851.exe") Found reference to API (Indicator: "VirtualQuery"; File: "Bootrsraptler_42.2.62851.exe") Found reference to API (Indicator: "PostQueuedCompletionStatus"; File: "Bootrsraptler_42.2.62851.exe") Found reference to API (Indicator: "DuplicateHandle"; File: "Bootrsraptler_42.2.62851.exe") Found reference to API (Indicator: "SetThreadContext"; File: "Bootrsraptler_42.2.62851.exe") Found reference to API (Indicator: "VirtualAlloc"; File: "Bootrsraptler_42.2.62851.exe") Found reference to API (Indicator: "GetSystemDirectoryA"; File: "Bootrsraptler_42.2.62851.exe") Found reference to API (Indicator: "RtlVirtualUnwind"; File: "Bootrsraptler_42.2.62851.exe") Found reference to API (Indicator: "SetWaitableTimer"; File: "Bootrsraptler_42.2.62851.exe") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "Bootrsraptler_42.2.62851.exe") Found reference to API (Indicator: "CreateThread"; File: "Bootrsraptler_42.2.62851.exe") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "Bootrsraptler_42.2.62851.exe") Found reference to API (Indicator: "WerGetFlags"; File: "Bootrsraptler_42.2.62851.exe") Found reference to API (Indicator: "CloseHandle"; File: "Bootrsraptler_42.2.62851.exe") Found reference to API (Indicator: "ResumeThread"; File: "Bootrsraptler_42.2.62851.exe") Found reference to API (Indicator: "CreateWaitableTimerExW"; File: "Bootrsraptler_42.2.62851.exe") Found reference to API (Indicator: "GetProcessAffinityMask"; File: "Bootrsraptler_42.2.62851.exe") Found reference to API (Indicator: "WerSetFlags"; File: "Bootrsraptler_42.2.62851.exe") Found reference to API (Indicator: "GetConsoleMode"; File: "Bootrsraptler_42.2.62851.exe") Found reference to API (Indicator: "WaitForMultipleObjects"; File: "Bootrsraptler_42.2.62851.exe") Found reference to API (Indicator: "LoadLibraryW"; File: "Bootrsraptler_42.2.62851.exe") Found reference to API (Indicator: "SwitchToThread"; File: "Bootrsraptler_42.2.62851.exe") Found reference to API (Indicator: "TlsAlloc"; File: "Bootrsraptler_42.2.62851.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "Bootrsraptler_42.2.62851.exe") Found reference to API (Indicator: "RaiseFailFastException"; File: "Bootrsraptler_42.2.62851.exe") Found reference to API (Indicator: "SetConsoleCtrlHandler"; File: "Bootrsraptler_42.2.62851.exe") Found reference to API (Indicator: "GetStdHandle"; File: "Bootrsraptler_42.2.62851.exe") Found reference to API (Indicator: "GetProcAddress"; File: "Bootrsraptler_42.2.62851.exe") Found reference to API (Indicator: "SetEvent"; File: "Bootrsraptler_42.2.62851.exe") Found reference to API (Indicator: "ExitProcess"; File: "Bootrsraptler_42.2.62851.exe") Found reference to API (Indicator: "SetErrorMode"; File: "Bootrsraptler_42.2.62851.exe") Found reference to API (Indicator: "GetThreadContext"; File: "Bootrsraptler_42.2.62851.exe") Found reference to API (Indicator: "CreateFileA"; File: "Bootrsraptler_42.2.62851.exe") Found reference to API (Indicator: "WSAIoctl"; File: "Bootrsraptler_42.2.62851.exe") Found reference to API (Indicator: "GetFileType"; File: "Bootrsraptler_42.2.62851.exe") Found reference to API (Indicator: "GetFileInformationByHandle"; File: "Bootrsraptler_42.2.62851.exe") Found reference to API (Indicator: "WSAGetOverlappedResult"; File: "Bootrsraptler_42.2.62851.exe") Found reference to API (Indicator: "GetWindowDC"; Source: "00000000-00008156.00000000.177465.00000000.00000004.mdmp, 00000000-00008156.00000000.177465.00400000.00000004.mdmp, 00000000-00008156.00000000.177465.40000000.00000040.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00008156.00000000.177465.00000000.00000004.mdmp, 00000000-00008156.00000000.177465.00400000.00000004.mdmp, 00000000-00008156.00000000.177465.40000000.00000040.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00008156.00000000.177465.00000000.00000004.mdmp, 00000000-00008156.00000000.177465.00400000.00000004.mdmp, 00000000-00008156.00000000.177465.40000000.00000040.mdmp") Found reference to API (Indicator: "CreateDesktopW"; Source: "00000000-00008156.00000000.177465.00000000.00000004.mdmp, 00000000-00008156.00000000.177465.00400000.00000004.mdmp, 00000000-00008156.00000000.177465.40000000.00000040.mdmp") Found reference to API (Indicator: "GetComputerNameA"; Source: "00000000-00008156.00000000.177465.00000000.00000004.mdmp, 00000000-00008156.00000000.177465.00400000.00000004.mdmp, 00000000-00008156.00000000.177465.40000000.00000040.mdmp") Found reference to API (Indicator: "GetComputerNameExA"; Source: "00000000-00008156.00000000.177465.00000000.00000004.mdmp, 00000000-00008156.00000000.177465.00400000.00000004.mdmp, 00000000-00008156.00000000.177465.40000000.00000040.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00008156.00000000.177465.00000000.00000004.mdmp, 00000000-00008156.00000000.177465.00400000.00000004.mdmp, 00000000-00008156.00000000.177465.40000000.00000040.mdmp") Found reference to API (Indicator: "CoInitializeSecurity"; Source: "00000000-00008156.00000000.177465.00000000.00000004.mdmp, 00000000-00008156.00000000.177465.00400000.00000004.mdmp, 00000000-00008156.00000000.177465.40000000.00000040.mdmp") Found reference to API (Indicator: "GetKeyboardLayout"; Source: "00000000-00008156.00000000.177465.00000000.00000004.mdmp, 00000000-00008156.00000000.177465.00400000.00000004.mdmp, 00000000-00008156.00000000.177465.40000000.00000040.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00008156.00000000.177465.00000000.00000004.mdmp, 00000000-00008156.00000000.177465.00400000.00000004.mdmp, 00000000-00008156.00000000.177465.40000000.00000040.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00008156.00000000.177465.00000000.00000004.mdmp, 00000000-00008156.00000000.177465.00400000.00000004.mdmp, 00000000-00008156.00000000.177465.40000000.00000040.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00008156.00000000.177465.00000000.00000004.mdmp, 00000000-00008156.00000000.177465.00400000.00000004.mdmp, 00000000-00008156.00000000.177465.40000000.00000040.mdmp") Found reference to API (Indicator: "BitBlt"; Source: "00000000-00008156.00000000.177465.00080000.00000004.mdmp, 00000000-00008156.00000000.177465.00400000.00000004.mdmp, 00000000-00008156.00000000.177465.40000000.00000040.mdmp") Found reference to API (Indicator: "CreateActCtxW"; Source: "00000000-00008156.00000000.177465.00100000.00000004.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueW"; Source: "00000000-00008156.00000000.177465.00100000.00000004.mdmp, 00000000-00008156.00000000.177465.00400000.00000004.mdmp, 00000000-00008156.00000000.177465.40000000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00008156.00000000.177465.00100000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00008156.00000000.177465.00100000.00000004.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00008156.00000000.177465.00100000.00000004.mdmp") Found reference to API (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00008156.00000000.177465.00100000.00000004.mdmp, 00000000-00008156.00000000.177465.00400000.00000004.mdmp, 00000000-00008156.00000000.177465.40000000.00000040.mdmp") Found reference to API (Indicator: "CreateCompatibleDC"; Source: "00000000-00008156.00000000.177465.00100000.00000004.mdmp, 00000000-00008156.00000000.177465.00400000.00000004.mdmp, 00000000-00008156.00000000.177465.40000000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentObject"; Source: "00000000-00008156.00000000.177465.00100000.00000004.mdmp, 00000000-00008156.00000000.177465.00400000.00000004.mdmp, 00000000-00008156.00000000.177465.40000000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentThread"; Source: "00000000-00008156.00000000.177465.00100000.00000004.mdmp") Found reference to API (Indicator: "AddVectoredExceptionHandler"; Source: "00000000-00008156.00000000.177465.00100000.00000004.mdmp") Found reference to API (Indicator: "GetDIBits"; Source: "00000000-00008156.00000000.177465.00100000.00000004.mdmp, 00000000-00008156.00000000.177465.00400000.00000004.mdmp, 00000000-00008156.00000000.177465.40000000.00000040.mdmp") Found reference to API (Indicator: "GetObjectW"; Source: "00000000-00008156.00000000.177465.00100000.00000004.mdmp, 00000000-00008156.00000000.177465.00400000.00000004.mdmp, 00000000-00008156.00000000.177465.40000000.00000040.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00008156.00000000.177465.00100000.00000004.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00008156.00000000.177465.00100000.00000004.mdmp, 00000000-00008156.00000000.177465.00400000.00000004.mdmp, 00000000-00008156.00000000.177465.40000000.00000040.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00008156.00000000.177465.00400000.00000004.mdmp, 00000000-00008156.00000000.177465.40000000.00000040.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00008156.00000000.177465.00400000.00000004.mdmp, 00000000-00008156.00000000.177465.40000000.00000040.mdmp") Found reference to API (Indicator: "CloseDesktop"; Source: "00000000-00008156.00000000.177465.00400000.00000004.mdmp, 00000000-00008156.00000000.177465.40000000.00000040.mdmp") Found reference to API (Indicator: "GetClientRect"; Source: "00000000-00008156.00000000.177465.00400000.00000004.mdmp, 00000000-00008156.00000000.177465.40000000.00000040.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00008156.00000000.177465.00400000.00000004.mdmp, 00000000-00008156.00000000.177465.40000000.00000040.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00008156.00000000.177465.00400000.00000004.mdmp, 00000000-00008156.00000000.177465.40000000.00000040.mdmp") Found reference to API (Indicator: "OpenDesktopW"; Source: "00000000-00008156.00000000.177465.00400000.00000004.mdmp, 00000000-00008156.00000000.177465.40000000.00000040.mdmp") Found reference to API (Indicator: "GetUserNameA"; Source: "00000000-00008156.00000000.177465.00400000.00000004.mdmp, 00000000-00008156.00000000.177465.40000000.00000040.mdmp") Found reference to API (Indicator: "DeleteDC"; Source: "00000000-00008156.00000000.177465.00400000.00000004.mdmp, 00000000-00008156.00000000.177465.40000000.00000040.mdmp") Found reference to API (Indicator: "DeleteObject"; Source: "00000000-00008156.00000000.177465.00400000.00000004.mdmp, 00000000-00008156.00000000.177465.40000000.00000040.mdmp") Found reference to API (Indicator: "SelectObject"; Source: "00000000-00008156.00000000.177465.00400000.00000004.mdmp, 00000000-00008156.00000000.177465.40000000.00000040.mdmp")2e:T958,"Bootrsraptler_42.2.62851.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffc2c2d0000 "Bootrsraptler_42.2.62851.exe" loaded module "BCRYPTPRIMITIVES.DLL" at base 7ffc4c180000 "Bootrsraptler_42.2.62851.exe" loaded module "NTDLL.DLL" at base 7ffc4ed30000 "Bootrsraptler_42.2.62851.exe" loaded module "WINMM.DLL" at base 7ffc43530000 "Bootrsraptler_42.2.62851.exe" loaded module "WS2_32.DLL" at base 7ffc4de60000 "Bootrsraptler_42.2.62851.exe" loaded module "POWRPROF.DLL" at base 7ffc4b0a0000 "Bootrsraptler_42.2.62851.exe" loaded module "KERNEL32.DLL" at base 7ffc4e210000 "Bootrsraptler_42.2.62851.exe" loaded module "OLE32.DLL" at base 19bd7db0000 "Bootrsraptler_42.2.62851.exe" loaded module "USER32.DLL" at base 7ffc4d640000 "Bootrsraptler_42.2.62851.exe" loaded module "ADVAPI32.DLL" at base 7ffc4e880000 "Bootrsraptler_42.2.62851.exe" loaded module "GDI32.DLL" at base 7ffc4d990000 "Bootrsraptler_42.2.62851.exe" loaded module "OLEAUT32.DLL" at base 7ffc4ea50000 "Bootrsraptler_42.2.62851.exe" loaded module "WINHTTP.DLL" at base 7ffc478c0000 "Bootrsraptler_42.2.62851.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffc496c0000 "Bootrsraptler_42.2.62851.exe" loaded module "RPCRT4.DLL" at base 7ffc4e930000 "Bootrsraptler_42.2.62851.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 7ffc4b380000 "Bootrsraptler_42.2.62851.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 7ffc40760000 "Bootrsraptler_42.2.62851.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 7ffc3f170000 "Bootrsraptler_42.2.62851.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 7ffc4b380000 "Bootrsraptler_42.2.62851.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 7ffc4b380000 "Bootrsraptler_42.2.62851.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 7ffc3f420000 "Bootrsraptler_42.2.62851.exe" loaded module "SSPICLI.DLL" at base 7ffc4afb0000 "Bootrsraptler_42.2.62851.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 7ffc2d260000 "Bootrsraptler_42.2.62851.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ffc4a910000 "Bootrsraptler_42.2.62851.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ffc43b80000 "Bootrsraptler_42.2.62851.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ffc449b00002f:T51e,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "Bootrsraptler_42.2.62851.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "Bootrsraptler_42.2.62851.exe") file/memory contains long string with (Indicator: "LoadLibrary"; File: "Bootrsraptler_42.2.62851.exe") Found reference to API "runtime.getLoadLibraryEx" (Indicator: "LoadLibrary"; File: "Bootrsraptler_42.2.62851.exe") Found reference to API "runtime.getLoadLibrary" (Indicator: "LoadLibrary"; File: "Bootrsraptler_42.2.62851.exe") Found reference to API "syscall.LoadLibrary" (Indicator: "LoadLibrary"; File: "Bootrsraptler_42.2.62851.exe") Found reference to API "syscall._LoadLibrary" (Indicator: "LoadLibrary"; File: "Bootrsraptler_42.2.62851.exe") Found reference to API "syscall.procLoadLibraryW" (Indicator: "LoadLibrary"; File: "Bootrsraptler_42.2.62851.exe") Found reference to API "syscall.LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00008156.00000000.177465.015DE000.00000002.mdmp") Found reference to API "syscall._LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00008156.00000000.177465.015DE000.00000002.mdmp") Found reference to API "syscall.procLoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00008156.00000000.177465.015DE000.00000002.mdmp")30:T5cb,"Bootrsraptler_42.2.62851.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SQMSERVICELIST"; Key: ""; Value: "") "Bootrsraptler_42.2.62851.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: ""; Value: "") "Bootrsraptler_42.2.62851.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: ""; Value: "") "Bootrsraptler_42.2.62851.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS NT\DNSCLIENT"; Key: ""; Value: "") "Bootrsraptler_42.2.62851.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEM\DNSCLIENT"; Key: ""; Value: "") "Bootrsraptler_42.2.62851.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNS"; Key: ""; Value: "") "Bootrsraptler_42.2.62851.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\SETUP"; Key: ""; Value: "") "Bootrsraptler_42.2.62851.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "Bootrsraptler_42.2.62851.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: ""; Value: "") "Bootrsraptler_42.2.62851.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: ""; Value: "") "Bootrsraptler_42.2.62851.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\BOOTRSRAPTLER_42.2.62851.EXE"; Key: ""; Value: "")31:Tbd6,"Bootrsraptler_42.2.62851.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SQMSERVICELIST"; Key: "SQMSERVICELIST"; Value: "") "Bootrsraptler_42.2.62851.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "Bootrsraptler_42.2.62851.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "AUTODIALDLL"; Value: "") "Bootrsraptler_42.2.62851.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "Bootrsraptler_42.2.62851.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "Bootrsraptler_42.2.62851.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "QUERYADAPTERNAME"; Value: "") "Bootrsraptler_42.2.62851.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DISABLEADAPTERDOMAINNAME"; Value: "") "Bootrsraptler_42.2.62851.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "Bootrsraptler_42.2.62851.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "Bootrsraptler_42.2.62851.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DOMAINNAMEDEVOLUTIONLEVEL"; Value: "") "Bootrsraptler_42.2.62851.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: "") "Bootrsraptler_42.2.62851.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: "") "Bootrsraptler_42.2.62851.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "ALLOWUNQUALIFIEDQUERY"; Value: "") "Bootrsraptler_42.2.62851.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "ALLOWUNQUALIFIEDQUERY"; Value: "") "Bootrsraptler_42.2.62851.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "APPENDTOMULTILABELNAME"; Value: "") "Bootrsraptler_42.2.62851.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENBADTLDS"; Value: "") "Bootrsraptler_42.2.62851.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENUNREACHABLESERVERS"; Value: "") "Bootrsraptler_42.2.62851.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENDEFAULTSERVERS"; Value: "") "Bootrsraptler_42.2.62851.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DYNAMICSERVERQUERYORDER"; Value: "")32:T435,"Bootrsraptler_42.2.62851.exe" trying to access non-existent file "C:\FLTLIB.DLL" "Bootrsraptler_42.2.62851.exe" trying to access non-existent file "C:\MSVCP140.DLL" "Bootrsraptler_42.2.62851.exe" trying to access non-existent file "C:\MSVCP140.dll" "Bootrsraptler_42.2.62851.exe" trying to access non-existent file "C:\VCRUNTIME140.DLL" "Bootrsraptler_42.2.62851.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "Bootrsraptler_42.2.62851.exe" trying to access non-existent file "C:\VCRUNTIME140_1.DLL" "Bootrsraptler_42.2.62851.exe" trying to access non-existent file "C:\VCRUNTIME140_1.dll" "Bootrsraptler_42.2.62851.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "Bootrsraptler_42.2.62851.exe" trying to access non-existent file "C:\Windows\System32\wbem\WBEMCOMN.DLL" "Bootrsraptler_42.2.62851.exe" trying to access non-existent file "C:\Windows\System32\wbem\BCRYPT.DLL" "Bootrsraptler_42.2.62851.exe" trying to access non-existent file "C:\SSPICLI.DLL" "Bootrsraptler_42.2.62851.exe" trying to access non-existent file "C:\WINNLSRES.DLL"33:T6e5,file/memory contains long string with (Indicator: "WSARecv"; File: "Bootrsraptler_42.2.62851.exe") file/memory contains long string with (Indicator: "WSASend"; File: "Bootrsraptler_42.2.62851.exe") file/memory contains long string with (Indicator: "WSAStartup"; File: "Bootrsraptler_42.2.62851.exe") Found reference to API "syscall.WSARecv" (Indicator: "WSARecv"; File: "Bootrsraptler_42.2.62851.exe") Found reference to API "syscall.WSASend" (Indicator: "WSASend"; File: "Bootrsraptler_42.2.62851.exe") Found reference to API "syscall.WSAStartup" (Indicator: "WSAStartup"; File: "Bootrsraptler_42.2.62851.exe") Found reference to API "syscall.procWSARecv" (Indicator: "WSARecv"; File: "Bootrsraptler_42.2.62851.exe") Found reference to API "syscall.procWSASend" (Indicator: "WSASend"; File: "Bootrsraptler_42.2.62851.exe") Found reference to API "syscall.procWSAStartup" (Indicator: "WSAStartup"; File: "Bootrsraptler_42.2.62851.exe") Found reference to API "syscall.WSARecv" (Indicator: "WSARecv"; Source: "00000000-00008156.00000000.177465.015DE000.00000002.mdmp") Found reference to API "syscall.WSASend" (Indicator: "WSASend"; Source: "00000000-00008156.00000000.177465.015DE000.00000002.mdmp") Found reference to API "syscall.WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00008156.00000000.177465.015DE000.00000002.mdmp") Found reference to API "syscall.procWSARecv" (Indicator: "WSARecv"; Source: "00000000-00008156.00000000.177465.015DE000.00000002.mdmp") Found reference to API "syscall.procWSASend" (Indicator: "WSASend"; Source: "00000000-00008156.00000000.177465.015DE000.00000002.mdmp") Found reference to API "syscall.procWSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00008156.00000000.177465.015DE000.00000002.mdmp")34:T755,file/memory contains long string with (Indicator: "WSARecv"; File: "Bootrsraptler_42.2.62851.exe") file/memory contains long string with (Indicator: "WSASend"; File: "Bootrsraptler_42.2.62851.exe") file/memory contains long string with (Indicator: "WSAStartup"; File: "Bootrsraptler_42.2.62851.exe") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00008156-00000C2C-1761670864") Found reference to API "syscall.WSARecv" (Indicator: "WSARecv"; File: "Bootrsraptler_42.2.62851.exe") Found reference to API "syscall.WSASend" (Indicator: "WSASend"; File: "Bootrsraptler_42.2.62851.exe") Found reference to API "syscall.WSAStartup" (Indicator: "WSAStartup"; File: "Bootrsraptler_42.2.62851.exe") Found reference to API "syscall.procWSARecv" (Indicator: "WSARecv"; File: "Bootrsraptler_42.2.62851.exe") Found reference to API "syscall.procWSASend" (Indicator: "WSASend"; File: "Bootrsraptler_42.2.62851.exe") Found reference to API "syscall.procWSAStartup" (Indicator: "WSAStartup"; File: "Bootrsraptler_42.2.62851.exe") Found reference to API "syscall.WSARecv" (Indicator: "WSARecv"; Source: "00000000-00008156.00000000.177465.015DE000.00000002.mdmp") Found reference to API "syscall.WSASend" (Indicator: "WSASend"; Source: "00000000-00008156.00000000.177465.015DE000.00000002.mdmp") Found reference to API "syscall.WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00008156.00000000.177465.015DE000.00000002.mdmp") Found reference to API "syscall.procWSARecv" (Indicator: "WSARecv"; Source: "00000000-00008156.00000000.177465.015DE000.00000002.mdmp") Found reference to API "syscall.procWSASend" (Indicator: "WSASend"; Source: "00000000-00008156.00000000.177465.015DE000.00000002.mdmp") Found reference to API "syscall.procWSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00008156.00000000.177465.015DE000.00000002.mdmp")35:T466,file/memory contains long string with (Indicator: "wsastartup"; File: "Bootrsraptler_42.2.62851.exe") file/memory contains long string with (Indicator: "wsacleanup"; File: "Bootrsraptler_42.2.62851.exe") file/memory contains long string with (Indicator: "gethostbyname"; File: "Bootrsraptler_42.2.62851.exe") file/memory contains long string with (Indicator: " send "; File: "Bootrsraptler_42.2.62851.exe") file/memory contains long string with (Indicator: " socket "; File: "Bootrsraptler_42.2.62851.exe") Found reference to API "WSAStartup" (Indicator: "wsastartup"; Source: "00000000-00008156-00000C2C-1761670864") Found reference to API "syscall.WSAStartup" (Indicator: "wsastartup"; File: "Bootrsraptler_42.2.62851.exe") Found reference to API "syscall.procWSAStartup" (Indicator: "wsastartup"; File: "Bootrsraptler_42.2.62851.exe") Found reference to API "syscall.WSAStartup" (Indicator: "wsastartup"; Source: "00000000-00008156.00000000.177465.015DE000.00000002.mdmp") Found reference to API "syscall.procWSAStartup" (Indicator: "wsastartup"; Source: "00000000-00008156.00000000.177465.015DE000.00000002.mdmp")36:T5fe,Heuristic match: "*xml.name" Heuristic match: "*abi.name" Heuristic match: "*[]xml.name" Heuristic match: "internal/abi.name.name" Heuristic match: "runtime.(*bucket).mp" Heuristic match: "runtime.(*polldesc).info" Heuristic match: "runtime.srcfunc.name" Heuristic match: "github.com" Heuristic match: "trenthamsrealty.com" Pattern match: "eq.sync/atomic.uint32" Pattern match: "eq.sync/atomic.uint64" Heuristic match: "internal/reflectlite.rtype.name" Heuristic match: "internal/reflectlite.(*rtype).name" Heuristic match: "errors.is" Heuristic match: "sync.(*once).do" Pattern match: "eq.sync/atomic.pointer[interface" Heuristic match: "unicode.is" Heuristic match: "unicode.to" Heuristic match: "reflect.(*rtype).name" Heuristic match: "internal/abi.(*functype).in" Heuristic match: "reflect.flag.ro" Heuristic match: "reflect.value.int" Heuristic match: "syscall.errno.is" Heuristic match: "syscall.(*errno).is" Pattern match: "eq.io/fs.patherror" Heuristic match: "os.(*file).name" Heuristic match: "encoding/xml.(*decoder).name" Heuristic match: "type:.eq.encoding/xml.name" Heuristic match: "3p.bz" Heuristic match: "yg.cr" Heuristic match: "n#m.qa" Heuristic match: "v .ag" Pattern match: "http://trenthamsrealty.com:4326/users" Heuristic match: "st: github.com" Pattern match: "http://cdnnthamsrealty.com:4326/" Heuristic match: "renthamsrealty.com" Pattern match: "http://www.w3.org/2001/xmlschema-instance" Heuristic match: "0000trenthamsrealty.com" Heuristic match: "host: github.com"37:T7b2,Found reference to API "d downown):********* ******* ***** *** *GetDCGetDC" (Indicator: "GetDC"; Source: "00000000-00008156.00000000.177465.00000000.00000004.mdmp") Found reference to API "d downown):********* ******* ***** *** *GetWindowDC" (Indicator: "GetWindowDC"; Source: "00000000-00008156.00000000.177465.00000000.00000004.mdmp") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; Source: "00000000-00008156.00000000.177465.00000000.00000004.mdmp, 00000000-00008156.00000000.177465.00400000.00000004.mdmp, 00000000-00008156.00000000.177465.40000000.00000040.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00008156.00000000.177465.00080000.00000004.mdmp, 00000000-00008156.00000000.177465.00400000.00000004.mdmp, 00000000-00008156.00000000.177465.40000000.00000040.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00008156.00000000.177465.00100000.00000004.mdmp, 00000000-00008156.00000000.177465.00400000.00000004.mdmp, 00000000-00008156.00000000.177465.40000000.00000040.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00008156.00000000.177465.00100000.00000004.mdmp, 00000000-00008156.00000000.177465.00400000.00000004.mdmp, 00000000-00008156.00000000.177465.40000000.00000040.mdmp") Found reference to API "d downown):********* ******* ***** *** *GetDIBits" (Indicator: "GetDIBits"; Source: "00000000-00008156.00000000.177465.00100000.00000004.mdmp") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; Source: "00000000-00008156.00000000.177465.00100000.00000004.mdmp, 00000000-00008156.00000000.177465.00400000.00000004.mdmp, 00000000-00008156.00000000.177465.40000000.00000040.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00008156.00000000.177465.00400000.00000004.mdmp, 00000000-00008156.00000000.177465.40000000.00000040.mdmp")38:Tada,Found string "chacha8" (Indicator: "chacha"; File: "Bootrsraptler_42.2.62851.exe") Found string "*chacha8rand.State" (Indicator: "chacha"; File: "Bootrsraptler_42.2.62851.exe") Found string "internal/chacha8rand" (Indicator: "chacha"; File: "Bootrsraptler_42.2.62851.exe") file/memory contains long string with (Indicator: "aes"; File: "Bootrsraptler_42.2.62851.exe") Found string "internal/chacha8rand.(*State).Init" (Indicator: "chacha"; File: "Bootrsraptler_42.2.62851.exe") Found string "internal/chacha8rand.leUint64" (Indicator: "chacha"; File: "Bootrsraptler_42.2.62851.exe") Found string "internal/chacha8rand.(*State).Init64" (Indicator: "chacha"; File: "Bootrsraptler_42.2.62851.exe") Found string "internal/chacha8rand.(*State).Refill" (Indicator: "chacha"; File: "Bootrsraptler_42.2.62851.exe") Found string "internal/chacha8rand.(*State).Reseed" (Indicator: "chacha"; File: "Bootrsraptler_42.2.62851.exe") Found string "internal/chacha8rand.(*State).Next" (Indicator: "chacha"; File: "Bootrsraptler_42.2.62851.exe") Found string "internal/chacha8rand.block" (Indicator: "chacha"; File: "Bootrsraptler_42.2.62851.exe") Found string "type:.eq.internal/chacha8rand.State" (Indicator: "chacha"; File: "Bootrsraptler_42.2.62851.exe") Found string "runtime.initAlgAES" (Indicator: "aes"; File: "Bootrsraptler_42.2.62851.exe") Found string "aeshashbody" (Indicator: "aes"; File: "Bootrsraptler_42.2.62851.exe") Found string "internal/chacha8rand/chacha8.go" (Indicator: "chacha"; File: "Bootrsraptler_42.2.62851.exe") Found string "internal/chacha8rand/chacha8_amd64.s" (Indicator: "chacha"; File: "Bootrsraptler_42.2.62851.exe") Found string "runtime.useAeshash" (Indicator: "aes"; File: "Bootrsraptler_42.2.62851.exe") Found string "runtime.aeskeysched" (Indicator: "aes"; File: "Bootrsraptler_42.2.62851.exe") file/memory contains long string with (Indicator: "aes"; Source: "00000000-00008156.00000000.177465.00400000.00000004.mdmp") Found string "internal/chacha8rand.(*State).Init" (Indicator: "chacha"; Source: "00000000-00008156.00000000.177465.015DE000.00000002.mdmp") Found string "internal/chacha8rand.(*State).Refill" (Indicator: "chacha"; Source: "00000000-00008156.00000000.177465.015DE000.00000002.mdmp") Found string "internal/chacha8rand.(*State).Reseed" (Indicator: "chacha"; Source: "00000000-00008156.00000000.177465.015DE000.00000002.mdmp") Found string "internal/chacha8rand.block" (Indicator: "chacha"; Source: "00000000-00008156.00000000.177465.015DE000.00000002.mdmp") Found string "type:.eq.internal/chacha8rand.State" (Indicator: "chacha"; Source: "00000000-00008156.00000000.177465.015DE000.00000002.mdmp") Found string "aeshashbody" (Indicator: "aes"; Source: "00000000-00008156.00000000.177465.015DE000.00000002.mdmp")39:T40a,Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "Bootrsraptler_42.2.62851.exe") file/memory contains long string with (Indicator: "Process32Next"; File: "Bootrsraptler_42.2.62851.exe") file/memory contains long string with (Indicator: "Module32Next"; File: "Bootrsraptler_42.2.62851.exe") file/memory contains long string with (Indicator: "Process32First"; File: "Bootrsraptler_42.2.62851.exe") file/memory contains long string with (Indicator: "Module32First"; File: "Bootrsraptler_42.2.62851.exe") file/memory contains long string with (Indicator: "GetCurrentProcess"; File: "Bootrsraptler_42.2.62851.exe") file/memory contains long string with (Indicator: "GetEnvironmentStrings"; File: "Bootrsraptler_42.2.62851.exe") file/memory contains long string with (Indicator: "CreateToolhelp32Snapshot"; File: "Bootrsraptler_42.2.62851.exe") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00008156.00000000.177465.00100000.00000004.mdmp")3a:T598,Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; File: "Bootrsraptler_42.2.62851.exe") file/memory contains long string with (Indicator: "GetProcAddress"; File: "Bootrsraptler_42.2.62851.exe") Found reference to API "runtime.getGetProcAddress" (Indicator: "GetProcAddress"; File: "Bootrsraptler_42.2.62851.exe") Found reference to API "syscall.GetProcAddress" (Indicator: "GetProcAddress"; File: "Bootrsraptler_42.2.62851.exe") Found reference to API "syscall._GetProcAddress" (Indicator: "GetProcAddress"; File: "Bootrsraptler_42.2.62851.exe") Found reference to API "syscall.procGetProcAddress" (Indicator: "GetProcAddress"; File: "Bootrsraptler_42.2.62851.exe") Found reference to API "yramyramGetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00008156.00000000.177465.00100000.00000004.mdmp") Found reference to API "FABCDETiTiGetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00008156.00000000.177465.00100000.00000004.mdmp") Found reference to API "syscall.GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00008156.00000000.177465.015DE000.00000002.mdmp") Found reference to API "syscall._GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00008156.00000000.177465.015DE000.00000002.mdmp") Found reference to API "syscall.procGetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00008156.00000000.177465.015DE000.00000002.mdmp")3b:Tbdd,"Bootrsraptler_42.2.62851.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "Bootrsraptler_42.2.62851.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "AUTODIALDLL"; Value: "") "Bootrsraptler_42.2.62851.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "Bootrsraptler_42.2.62851.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "Bootrsraptler_42.2.62851.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "QUERYADAPTERNAME"; Value: "") "Bootrsraptler_42.2.62851.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DISABLEADAPTERDOMAINNAME"; Value: "") "Bootrsraptler_42.2.62851.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "Bootrsraptler_42.2.62851.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "Bootrsraptler_42.2.62851.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DOMAINNAMEDEVOLUTIONLEVEL"; Value: "") "Bootrsraptler_42.2.62851.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: "") "Bootrsraptler_42.2.62851.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: "") "Bootrsraptler_42.2.62851.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "ALLOWUNQUALIFIEDQUERY"; Value: "") "Bootrsraptler_42.2.62851.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "ALLOWUNQUALIFIEDQUERY"; Value: "") "Bootrsraptler_42.2.62851.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "APPENDTOMULTILABELNAME"; Value: "") "Bootrsraptler_42.2.62851.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENBADTLDS"; Value: "") "Bootrsraptler_42.2.62851.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENUNREACHABLESERVERS"; Value: "") "Bootrsraptler_42.2.62851.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENDEFAULTSERVERS"; Value: "") "Bootrsraptler_42.2.62851.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DYNAMICSERVERQUERYORDER"; Value: "") "Bootrsraptler_42.2.62851.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "FILTERCLUSTERIP"; Value: "")3c:T5a2f,"0085230084172135119029215091099102006073192064055119191143005000107248096079105244128234032127153147185074021129008171223095020193182178180107225222048034229222156099183033007145237018205130253218211228177229051208248203233245215233196035176123093051161053144092144040041051022036249133160054081110084215094111158181045063051199135044151013056217174101044206077045069225162003206060038239090125041010194235070157205231033225105158209079086244013013079213231184148028053005056190245105234115216208180218105086110109046105024058062133042005090187232245118197139195023010099140238249041009161144041176021237085061071016094158208064151215154038122123168007225036133126239155172005109061087074211184007147117204187038071016102236208070002059094216203207042040027152159185148068011175053156245118021091155223211191151005204242235129103105139107052184197212041189121136211031054035062192017150214043109005080105031254114208041119095024002008232001215217039242112021006099073173248044135155236047032054024068057199087095234224079145" (Indicator: "005056") "5019198201040068075118004069136015114123125120125078240128131140170156120213134211011090244035246240003097106235160145148058056046225057208130090039069002022221125022046164121228032049028040227253210010167108016154080144002078204033226001216210159158110106111223227103153009170113041017045241159099090113228164062104221090218080027186200032158036016042048171098167090004169208118204053050090019247098011093003138179058173136153017066199164127110207118176085147171094186033037206121222004084217254199230010221146156109082011231201235109240041087012242169228040188173141090178220247011021053081037198104210012251078236015056153124053062240204057081230009047127226141207158000064166130207090037155220176214230098014042011046095158231090046248145107131045064128004070174141229078055046250237188111081126199135213129174123194182023230000166044044059042015064091103097232058250090244107122069022072199100127055004040155108200150112149037191086104030144222084241246055031204001194062246204165093191075033251204178093225191067011010" (Indicator: "080027") "1661581701260200721171330321741570611592030010940802442441351631461962242522350440171500821450090570821291811952310751541221880970302470971862462261270240330492221310640940361700522110071631151900351470761770632461950121341142361141190770510340510092180270122000562120771770820572141260000240990500180730410942372191662502330520422142290091070121481240480760691372441622442362071052000182460040861930850122500580750842382250830951141460540360231431620830241871650571180560261071091282360721171880990851181160081841461711471150720900110032172170661562500261620221091510401640591600332002272132092210831590742141432340740801070510092091591252181441261450092031741401970471600370810980001791992521261590830310580602011081050830640650912120152390721230050950520981431841982372420071930542192491021081542302470870842451462322391631961282051300221160050560271291920300451711010420701561552141200421192101151251500120560831691421772110930190212140340180192271750251092050770980531221981752460851992071222480831901580900810000201782" (Indicator: "005056") "6172117155135038069132195205203105037001232110049106008120132136156037156245155013225156175098000204173228154075130245110115087048022141040017024223170253096114059026011046028038143181140181087207157072250121244158032166236130166089130017064033061209031031228164202187240176083186062053136016180005056129224125108091031199083165186120205228202131071045053122174078151040146113070070032243202209212168007109087007119129097080093244069155243022004028060175184151194090220084029130162237139165034220247168136091014198142091075064203072035141061076026119244193104056218201132120040254055131060086132117221039054239087200221104099218058189208139237113219060191249078199116035145167107109202202015084024047085128117123156252082052224080018212234176010247157145188141174252214250128059173012019079099077048121055039139093207091005016165227118040154201172061124069111122070127049162244095135179065227229118028024237104100254059206192173247222131126148248054107178191052036024027141018117188119071015013008197109255178021221073198141" (Indicator: "005056") "3016322109925414218317604918117315410619708724502121118209816417300814425425016302516503011009201009300315901420812722725420712211422808307710707316702318314217811705419513008411202920021603507221915308614918303020520922616305403701613006802410608104618609718603207408822703901209415504700414612416118901222704715720523713201314422820918712706209213521121910202507003309816324424624521816504410321624423510204803000505608824602703805523116002209615803312315425520306017416016417225223707003914508616802515521406921606723817019411522618008710512713503614016109216401403112518024508609805010516614103008819701719404313309918724414421507705000309403606816011922104222921203112013111416408124502603123120809312717800803104108403602715716706821814505115122016517218016920905608713711320611602300804008113306014513017011320914012421020114723210319012812414014109123719920814110504421608519006104925017109724020313320610609617912608923610310925322821514005323612418013013922224121813811512618413817913601417317216105805601118304120" (Indicator: "005056") "1971302040930651042322531290872211870640701011091400571641922330970650050560420240352261051002510180022170170950510371902170680771781480880732250902341470351300910392390591351020131270540831581490922211082281570560422000552340101501761960242162540750250151770290890291371840231661320780212210281821261272490371520891410691101460782131451470430620360212372061741871200212330762412080670762140431732310590700022421641821720061022361681631602522040000082152550960962322402461532182030211360631620150200471041881940110242010480952211241291272471731751311230322471031412411860830881451082130762061120380230311251581471182191680262492142090931270340051091061860451031741301630150741550672120791451292491511031470421621261550511770360651032280711382061081370270961250602220570831781381091842002442230070050201321671371961881981570931461421822131740171451181971611840181610800200681032311072491921430292380210311212080250470191591980991231911082012461711351211872541482522221390461312461601282530202521210331940120590310850001821000" (Indicator: "005056") "1108005614013402623220414224219921614113006917119114616614517612923917900521723925110809610403202604911622516911718708716214210808023703523902711114014324918409615316604910620021113909017421312525514019819612812205304524307112813509124623823918106718304722322300019202500020906324922008004423322218210800607908720015002612809117803701903601516224016502601817812010003525506007915006402318011524410819520201001412021100123123410218221018813501313220516902718815300821508104018702404508000012213609313514400123505614502721614017717007512922609722008300809522417118819102920120018723922206414920110509402811107910908114009905212908211122808002706222309120315903821320809323018323214504717425407819916514705411419301720008618910723702717123910411000114703802503625216909803512116811017023602906600908419613814115411715516512504324816305403307302117609120509416210424116313123721109318314924804500508402313401307018604113300508320119000707713718621717000601705804004317622913913813425408505623524112800216305801524525023013804021" (Indicator: "080027") "1616307324022610016017017303024515622011125401021607818407006912522602218821211201515824718106811914719902516603112211302523111408525213814121723216615924000100118408124704523501506018907221616923011409117302815425119310321824601107100005500703114813806111909710313812123310115111922803111307103103124212221221719605518206322723701620921723322222719419113814505215310801514624519702510009202624305902601108924616312412016908421700225518611806401619600400401812517301600121104002619121919009921923811022112001817119210301800319416912707015216818917916422307206510801216622704210615303323722802404004712720300103311408125118406209121723708402908213801412503823611020910920307207814805919405400318223015203501114610517221016320301418820311519120911705010718620811019213616616210802518706821922224617810400319111807700012222413211608222601212719221904101419506513525300613107518811105308403423808521912814206813525110319315503223600207208707107202700901701103607519508606024207715705623309807708002716213219121516204413405206400" (Indicator: "080027") "1816901505205604311905802317500810303302725213721600119815713513624916318322615824511002522506510603308115716205304920425306305300200902514218800319207821422516708002708311501409018312700324311403905812624414022109313901821300724508225405017224723718520015920002408023411509925020515801208902802709815422206518008307812718606901812716100915412002705119413300619922821624319212708317125212200906002920604808822303802323923109714723507705301109614412506606922721214822600608015700114010311320522112911902024420703224910621518806410424905716214507618825414207520511222518616402706711803408800308302519116120217019400418518310515503623602518923119705907408004012405617222902514323723814609517300524817112509815718304822725303406719601910012600514214314113304401009412210918220714011412418911619600010914819512714710006416303406523211218220024215501214217315303321621418307501102123511600609009120712514214116401504409720311316504916404304809919716104421024916625409502716517124220220623804321109121801410303100712417019512106714" (Indicator: "080027") "6047053147125100202063082122139062090120027241127004086011238169239083135219251123006102161161055250240043040141198140051001003121005244092029015223052038047239015194116119252137202059062176124014123245096116230232012184224205232129166096177189103021167043030240211160136037190117122026021179215103006203061052147064214057005040254247102119090172006130219193156145182119090141162175238080161223092047074191155067054000052129193176239136183143079165068039240239220248009145052151027075067184086180132152240163085198247121212013190064026080027244042231241159058191164167012045090065187186219174221202198084243139112237134118227135219184074071067172236184244198171141238067069232084032016040142021154066251042138029222217121222031171196115015212105004205248239072088196240241105022063012190217040180218022121221079065050253019045151145042003141100237252075114138242177133169009005011104132034176146250023054121102226222228025242252231017190061144050033247062079136087125125251043095168070198207218189051134117158028156187171041" (Indicator: "080027") "0890731122551411841260791342271511552231362550501770520911380282311790790792141200391562232320732071981240171920470030441531011032120661380690550482362282491651992492262130980660640250291060631200931722250631950351941912051510932340401771942191600830871681462170531850230061540110192301150990311171461992310861552171910271622281010302040311822521891210711921772150771230060910151360071130031350570821060560060560622541571731381551780011111950170430830050561970511411362401891701851840120971861320992121290070911841390011712531741320391382460921701720830311020221430900570410232340840700950591391630440230531040401310712350900981821371051190671491620151541841640731891651882151161790722150872241331180041930740331621531171872010441732410341371651521501721510941640781671530021061060110292271801570501060372520851431750110501230230351751830262020711450940862140081211410582442500062201781850140531372201920621082462491970330761331850950090241260531012200121151641350481760251120320141471510431350780132501012382491750292451500" (Indicator: "005056") "008523008417213511902921509109910200607319206405511919114300500010724809607910524412823403212715314718507402112900817122309502019318217818010722522204803422922215609918303300714523701820513025321821122817722905120824820323324521523319603517612309305116105314409214404004105102203624913316005408111008421509411115818104506305119913504415101305621717410104420607704506922516200320606003823909012504101019423507015720523103322510515820907908624401301307921323118414802805300505619024510523411521620818021810508611010904610502405806213304200509018723224511819713919502301009914023824904100916114404117602123708506107101609415820806415121515403812212316800722503613312623915517200510906108707421118400714711720418703807101610223620807000205909421620320704204002715215918514806801117505315624511802109115522321119115100520424223512910310513910705218419721204118912113621103105403506219201715021404310900508010503125411420804111909502400200823200121521703924211202100609907317324804413515523604703205402406805719908709523422407914" (Indicator: "005056") "501919820104006807511800406913601511412312512012507824012813114017015612021313421101109024403524624000309710623516014514805805604622505720813009003906900202222112502204616412122803204902804022725321001016710801615408014400207820403322600121621015915811010611122322710315300917011304101704524115909909011322816406210422109021808002718620003215803601604204817109816709000416920811820405305009001924709801109300313817905817313615301706619916412711020711817608514717109418603303720612122200408421725419923001022114615610908201123120123510924004108701224216922804018817314109017822024701102105308103719810421001225107823601505615312405306224020405708123000904712722614120715800006416613020709003715522017621423009801404201104609515823109004624814510713104506412800407017414122907805504625023718811108112619913521312917412319418202323000016604404405904201506409110309723205825009024410712206902207219910012705500404015510820015011214903719108610403014422208424124605503120400119406224620416509319107503325120417809322519106701101" (Indicator: "080027") "166158170126020072117133032174157061159203001094080244244135163146196224252235044017150082145009057082129181195231075154122188097030247097186246226127024033049222131064094036170052211007163115190035147076177063246195012134114236114119077051034051009218027012200056212077177082057214126000024099050018073041094237219166250233052042214229009107012148124048076069137244162244236207105200018246004086193085012250058075084238225083095114146054036023143162083024187165057118056026107109128236072117188099085118116008184146171147115072090011003217217066156250026162022109151040164059160033200227213209221083159074214143234074080107051009209159125218144126145009203174140197047160037081098000179199252126159083031058060201108105083064065091212015239072123005095052098143184198237242007193054219249102108154230247087084245146232239163196128205130022116005056027129192030045171101042070156155214120042119210115125150012056083169142177211093019021214034018019227175025109205077098053122198175246085199207122248083190158090081000020178" (Indicator: "005056") "617211715513503806913219520520310503700123211004910600812013213615603715624515501322515617509800020417322815407513024511011508704802214104001702422317025309611405902601104602803814318114018108720715707225012124415803216623613016608913001706403306120903103122816420218724017608318606205313601618000505612922412510809103119908316518612020522820213107104505312217407815104014611307007003224320220921216800710908700711912909708009324406915524302200402806017518415119409022008402913016223713916503422024716813609101419814209107506420307203514106107602611924419310405621820113212004025405513106008613211722103905423908720022110409921805818920813923711321906019124907819911603514516710710920220201508402404708512811712315625208205222408001821223417601024715714518814117425221425012805917301201907909907704812105503913909320709100501616522711804015420117206112406911112207012704916224409513517906522722911802802423710410025405920619217324722213112614824805410717819105203602402714101811718811907101501300819710925517802122107319814" (Indicator: "005056") "301632210992541421831760491811731541061970872450212111820981641730081442542501630251650301100920100930031590142081272272542071221142280830771070731670231831421781170541951300841120292002160350722191530861491830302052092261630540370161300680241060810461860971860320740882270390120941550470041461241611890122270471572052371320131442282091871270620921352112191020250700330981632442462452181650441032162442351020480300050560882460270380552311600220961580331231542552030601741601641722522370700391450861680251552140692160672381701941152261800871051271350361401610921640140311251802450860980501051661410300881970171940431330991872441442150770500030940360681601192210422292120311201311141640812450260312312080931271780080310410840360271571670682181450511512201651721801692090560871371132061160230080400811330601451301701132091401242102011472321031901281241401410912371992081411050442160851900610492501710972402031332061060961791260892361031092532282151400532361241801301392222412181381151261841381791360141731721610580560111830412" (Indicator: "005056") "197130204093065104232253129087221187064070101109140057164192233097065005056042024035226105100251018002217017095051037190217068077178148088073225090234147035130091039239059135102013127054083158149092221108228157056042200055234010150176196024216254075025015177029089029137184023166132078021221028182126127249037152089141069110146078213145147043062036021237206174187120021233076241208067076214043173231059070002242164182172006102236168163160252204000008215255096096232240246153218203021136063162015020047104188194011024201048095221124129127247173175131123032247103141241186083088145108213076206112038023031125158147118219168026249214209093127034005109106186045103174130163015074155067212079145129249151103147042162126155051177036065103228071138206108137027096125060222057083178138109184200244223007005020132167137196188198157093146142182213174017145118197161184018161080020068103231107249192143029238021031121208025047019159198099123191108201246171135121187254148252222139046131246160128253020252121033194012059031085000182100" (Indicator: "005056") "110800561401340262322041422421992161411300691711911461661451761292391790052172392511080961040320260491162251691171870871621421080802370352390271111401432491840961531660491062002111390901742131252551401981961281220530452430711281350912462382391810671830472232230001920250002090632492200800442332221821080060790872001500261280911780370190360151622401650260181781201000352550600791500640231801152441081952020100141202110012312341021822101881350131322051690271881530082150810401870240450800001221360931351440012350561450272161401771700751292260972200830080952241711881910292012001872392220641492011050940281110791090811400990521290821112280800270622230912031590382132080932301832321450471742540781991651470541141930172000861891072370271712391041100011470380250362521690980351211681101702360290660090841961381411541171551651250432481630540330730211760912050941621042411631312372110931831492480450050840231340130701860411330050832011900070771371862171700060170580400431762291391381342540850562352411280021630580152452502301380402" (Indicator: "080027") "161630732402261001601701730302451562201112540102160781840700691252260221882121120151582471810681191471990251660311221130252311140852521381412172321661592400010011840812470452350150601890722161692301140911730281542511931032182460110710000550070311481380611190971031381212331011511192280311130710310312421222122171960551820632272370162092172332222271941911381450521531080151462451970251000920262430590260110892461631241201690842170022551861180640161960040040181251730160012110400261912191900992192381102211200181711921030180031941691270701521681891791642230720651080121662270421061530332372280240400471272030010331140812511840620912172370840290821380141250382361102091092030720781480591940540031822301520350111461051722101632030141882031151912091170501071862081101921361661621080251870682192222461781040031911180770001222241321160822260121271922190410141950651352530061310751881110530840342380852191281420681352511031931550322360020720870710720270090170110360751950860602420771570562330980770800271621321912151620441340520640" (Indicator: "080027") "181690150520560431190580231750081030330272521372160011981571351362491631832261582451100252250651060330811571620530492042530630530020090251421880031920782142251670800270831150140901831270032431140390581262441402210931390182130072450822540501722472371852001592000240802341150992502051580120890280270981542220651800830781271860690181271610091541200270511941330061992282162431921270831712521220090600292060480882230380232392310971472350770530110961441250660692272121482260060801570011401031132052211291190202442070322491062151880641042490571621450761882541420752051122251861640270671180340880030830251911612021701940041851831051550362360251892311970590740800401240561722290251432372381460951730052481711250981571830482272530340671960191001260051421431411330440100941221091822071401141241891161960001091481951271471000641630340652321121822002421550121421731530332162141830750110212351160060900912071251421411640150440972031131650491640430480991971610442102491662540950271651712422022062380432110912180141030310071241701951210671" (Indicator: "080027") "604705314712510020206308212213906209012002724112700408601123816923908313521925112300610216116105525024004304014119814005100100312100524409202901522305203804723901519411611925213720205906217612401412324509611623023201218422420523212916609617718910302116704303024021116013603719011712202602117921510300620306105214706421405700504025424710211909017200613021919315614518211909014116217523808016122309204707419115506705400005212919317623913618314307916506803924023922024800914505215102707506718408618013215224016308519824712121201319006402608002724404223124115905819116416701204509006518718621917422120219808424313911223713411822713521918407407106717223618424419817114123806706923208403201604014202115406625104213802922221712122203117119611501521210500420524823907208819624024110502206301219021704018021802212122107906505025301904515114504200314110023725207511413824217713316900900501110413203417614625002305412110222622222802524225223101719006114405003324706207913608712512525104309516807019820721818905113411715802815618717104" (Indicator: "080027") "089073112255141184126079134227151155223136255050177052091138028231179079079214120039156223232073207198124017192047003044153101103212066138069055048236228249165199249226213098066064025029106063120093172225063195035194191205151093234040177194219160083087168146217053185023006154011019230115099031117146199231086155217191027162228101030204031182252189121071192177215077123006091015136007113003135057082106056006056062254157173138155178001111195017043083005056197051141136240189170185184012097186132099212129007091184139001171253174132039138246092170172083031102022143090057041023234084070095059139163044023053104040131071235090098182137105119067149162015154184164073189165188215116179072215087224133118004193074033162153117187201044173241034137165152150172151094164078167153002106106011029227180157050106037252085143175011050123023035175183026202071145094086214008121141058244250006220178185014053137220192062108246249197033076133185095009024126053101220012115164135048176025112032014147151043135078013250101238249175029245150" (Indicator: "005056")1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"01ec79ca328f90e03dd0c9ab0c115bacc279fa5eccea4cc03e4676dc9da78399","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":92,"unified_at_epoch_ms":1791577795838,"unified_at":"2026-10-09T20:29:55.838Z","metadata":{"hashes":{"sha256":"01ec79ca328f90e03dd0c9ab0c115bacc279fa5eccea4cc03e4676dc9da78399","sha1":"7b8bf5e97e85caa5ef9889b78d6a72ea476d242a","md5":"6e4e02fb56c5d5f6b825b83f78543b45","sha512":"2f746d34979792a2ba6610bd08ab21cbe754e0d763e8340768608bdf824a9a11db98d7d9e3035d131efb04eac13b90346e244ae417fb804a2d93ee7948de8c56","ssdeep":"49152:xlEsII1cUvsVuAzM+bNQi6LFqWnJIeqpjsq1hs6Bheu:t1cqhWFWqIu","ssdeep_chunks":["49152:xlEsII1","49152:lEsII1c","49152:EsII1cU","49152:sII1cUv","49152:II1cUvs","49152:I1cUvsV","49152:1cUvsVu","49152:cUvsVuA","49152:UvsVuAz","49152:vsVuAzM","49152:sVuAzM+","49152:VuAzM+b","49152:uAzM+bN","49152:AzM+bNQ","49152:zM+bNQi","49152:M+bNQi6","49152:+bNQi6L","49152:bNQi6LF","49152:NQi6LFq","49152:Qi6LFqW","49152:i6LFqWn","49152:6LFqWnJ","49152:LFqWnJI","49152:FqWnJIe","49152:qWnJIeq","49152:WnJIeqp","49152:nJIeqpj","49152:JIeqpjs","49152:Ieqpjsq","49152:eqpjsq1","49152:qpjsq1h","49152:pjsq1hs","49152:jsq1hs6","49152:sq1hs6B","49152:q1hs6Bh","49152:1hs6Bhe","49152:hs6Bheu","98304:xlEsII1","98304:lEsII1c","98304:EsII1cU","98304:sII1cUv","98304:II1cUvs","98304:I1cUvsV","98304:1cUvsVu","98304:cUvsVuA","98304:UvsVuAz","98304:vsVuAzM","98304:sVuAzM+","98304:VuAzM+b","98304:uAzM+bN","98304:AzM+bNQ","98304:zM+bNQi","98304:M+bNQi6","98304:+bNQi6L","98304:bNQi6LF","98304:NQi6LFq","98304:Qi6LFqW","98304:i6LFqWn","98304:6LFqWnJ","98304:LFqWnJI","98304:FqWnJIe","98304:qWnJIeq","98304:WnJIeqp","98304:nJIeqpj","98304:JIeqpjs","98304:Ieqpjsq","98304:eqpjsq1","98304:qpjsq1h","98304:pjsq1hs","98304:jsq1hs6","98304:sq1hs6B","98304:q1hs6Bh","98304:1hs6Bhe","98304:hs6Bheu","49152:t1cqhWF","49152:1cqhWFW","49152:cqhWFWq","49152:qhWFWqI","49152:hWFWqIu"],"imphash":"c2d457ad8ac36fc9f18d45bffcd450c2","pehash":"9479a63af3bd07263e148a3be15c1a4b3355c887"},"file_info":{"file_name":"01ec79ca328f90e03dd0c9ab0c115bacc279fa5eccea4cc03e4676dc9da78399","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":8581040,"entropy":5.36,"compile_timestamp":"1970-01-01T00:00:00","is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1791360979000,"last_seen":1791452535000,"last_multi_scan":1791452535000},"pe_metadata":{"is_dll":false,"is_packed":false,"section_count":8,"import_count":0,"export_count":0,"embedded_file_count":1,"sections":[{"name":".text","virtual_address":"0x1000","virtual_size":4855755,"raw_size":4855808},{"name":".rdata","virtual_address":"0x4a3000","virtual_size":3510664,"raw_size":3510784},{"name":".data","virtual_address":"0x7fd000","virtual_size":630216,"raw_size":61952},{"name":".pdata","virtual_address":"0x897000","virtual_size":19860,"raw_size":19968},{"name":".xdata","virtual_address":"0x89c000","virtual_size":180,"raw_size":512},{"name":".idata","virtual_address":"0x89d000","virtual_size":1364,"raw_size":1536},{"name":".reloc","virtual_address":"0x89e000","virtual_size":15228,"raw_size":15360},{"name":".symtab","virtual_address":"0x8a2000","virtual_size":105466,"raw_size":105472}],"section_names":[".text",".rdata",".data",".pdata",".xdata",".idata",".reloc",".symtab"],"imported_dlls":null,"imported_functions":null}},"detections":{"summary":{"verdict":"malicious","score":92,"tags":["remusstealer","commodity","criminal","informationstealer","evasive"]},"stats":{"av":{"malicious_count":8,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":2,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":74},"sandbox_signatures":{"informative_count":150,"suspicious_count":9,"malicious_count":4,"total":163},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Resmus","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Downloader]/Win32.Remus","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W64.Evo","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.Generic.40636386","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"malicious","threat_name":"Trojan_Win32_Wacatac_B_ml","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.Generic.40636386 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of WinGo/Kryptik.ABY trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W64/WinGo.J.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"WinGo/Kryptik.ABY trojan","sources":[{"report_type":"quickscan","report_id":""}]},{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"}],"sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"informative","value":"Contains ability to execute a WMI query"},{"type":"informative","value":"Executes WMI queries"}],"sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"suspicious","value":"Executes WMI queries to gather system information"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to read software policies"}],"sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"}],"sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"tactic":"Discovery","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"}],"sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"},{"type":"informative","value":"Contains ability to query network adapter information (API string)"},{"type":"informative","value":"Contains ability to free the memory used by network management functions (API string)"},{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"}],"sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Found registry location strings in memory"}],"sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"tactic":"Discovery","technique":"Local Account","attack_id":"T1087.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1087/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about user accounts on a server (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Able to query service configuration on system (API string)"},{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"tactic":"Discovery","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","identifiers":[{"type":"informative","value":"Contains ability to retrieve SID for the specified name (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"tactic":"Discovery","technique":"Domain Groups","attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"Able to enumerate permission groups in the domain"}],"sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"malicious","value":"Executes WMI queries in order to detect local security applications"},{"type":"suspicious","value":"May attempt to implement anti-virtualization techniques using MAC address detection"}],"sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"tactic":"Discovery","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"tactic":"Discovery","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"The input sample contains the RDTSCP instruction"}],"sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/techniques/T1120","identifiers":[{"type":"malicious","value":"Queries firmware table information (may be used to fingerprint/evade)"}],"sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"},{"type":"informative","value":"References server/domain address with port number"}],"sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Employs a browser-related User Agent without launching browser"},{"type":"informative","value":"Found User Agent related strings"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Calls an API typically used to send the specified request to the HTTP server"},{"type":"informative","value":"Calls an API typically used to to receive the response to a HTTP requests"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"}],"sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"tactic":"Command and Control","technique":"Web Service","attack_id":"T1102","attack_id_wiki":"https://attack.mitre.org/techniques/T1102","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"malicious","value":"Collects system information using POST request"},{"type":"suspicious","value":"POSTs data to a web server"}],"sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Web Service","attack_id":"T1567","attack_id_wiki":"https://attack.mitre.org/techniques/T1567","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"}],"sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"},{"type":"informative","value":"Possibly references Golang binary related string"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"tactic":"Stealth","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"tactic":"Stealth","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"tactic":"Stealth","technique":"Stripped Payloads","attack_id":"T1027.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/008","identifiers":[{"type":"suspicious","value":"PE file has no resource directory"}],"sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"tactic":"Stealth","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"tactic":"Stealth","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"},{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"tactic":"Stealth","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"tactic":"Stealth","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"tactic":"Stealth","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"tactic":"Defense Impairment","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"tactic":"Defense Impairment","technique":"Disable or Modify Tools","attack_id":"T1685","attack_id_wiki":"https://attack.mitre.org/techniques/T1685","identifiers":[{"type":"informative","value":"Contains ability to modify process attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"tactic":"Defense Impairment","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to enumerate permission groups in the domain","description":"file/memory contains long string with (Indicator: \"netusergetlocalgroups\"; File: \"Bootrsraptler_42.2.62851.exe\")","origin":"File/Memory","mitre_attack_id":"T1069.002","relevance":1,"id":"string-981","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"Bootrsraptler_42.2.62851.exe\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"Bootrsraptler_42.2.62851.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"Bootrsraptler_42.2.62851.exe\")\n file/memory contains long string with (Indicator: \"VirtualFree\"; File: \"Bootrsraptler_42.2.62851.exe\")\n file/memory contains long string with (Indicator: \"VirtualAlloc\"; File: \"Bootrsraptler_42.2.62851.exe\")\n Found reference to API \": : : : : : : : VirtualAllocGetPMirrMirrororeded Py PyramramididGetProcessHeap\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00008156.00000000.177465.00100000.00000004.mdmp\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00008156.00000000.177465.00100000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; File: \"Bootrsraptler_42.2.62851.exe\")\n Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; File: \"Bootrsraptler_42.2.62851.exe\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"Bootrsraptler_42.2.62851.exe\")\n Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; File: \"Bootrsraptler_42.2.62851.exe\")\n file/memory contains long string with (Indicator: \"OpenThread\"; File: \"Bootrsraptler_42.2.62851.exe\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"SetWaitableTimer\" (Indicator: \"SetWaitableTimer\"; File: \"Bootrsraptler_42.2.62851.exe\")\n Found reference to API \"WaitForMultipleObjects\" (Indicator: \"WaitForMultipleObjects\"; File: \"Bootrsraptler_42.2.62851.exe\")\n Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; File: \"Bootrsraptler_42.2.62851.exe\")\n file/memory contains long string with (Indicator: \"WaitForSingleObject\"; File: \"Bootrsraptler_42.2.62851.exe\")\n file/memory contains long string with (Indicator: \"GetSystemTimeAsFileTime\"; File: \"Bootrsraptler_42.2.62851.exe\")\n Found reference to API \"ing do down):********* ******* GetTickCount64\" (Indicator: \"GetTickCount64\"; Source: \"00000000-00008156.00000000.177465.00100000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"file/memory contains long string with (Indicator: \"OpenProcessToken\"; File: \"Bootrsraptler_42.2.62851.exe\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$25","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"file/memory contains long string with (Indicator: \"RegSetValue\"; File: \"Bootrsraptler_42.2.62851.exe\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"file/memory contains long string with (Indicator: \"OpenService\"; File: \"Bootrsraptler_42.2.62851.exe\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"file/memory contains long string with (Indicator: \"SetFileTime\"; File: \"Bootrsraptler_42.2.62851.exe\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"runtime.useAeshash\" (Indicator: \"Aes\"; File: \"Bootrsraptler_42.2.62851.exe\")\n Found reference to \"runtime.useAeshash\" (Indicator: \"Aes\"; Source: \"00000000-00008156.00000000.177465.015DE000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00008156.00000000.177465.00400000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00008156.00000000.177465.40000000.00000040.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$26","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"Assembly shows XOR instruction xor rax\n 02h in Stream UID: 49320-30738-0044915C\n Assembly shows XOR instruction xor eax\n 02h in Stream UID: 49320-30738-0044915C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"file/memory contains long string with (Indicator: \"CertCloseStore\"; File: \"Bootrsraptler_42.2.62851.exe\")\n file/memory contains long string with (Indicator: \"CryptReleaseContext\"; File: \"Bootrsraptler_42.2.62851.exe\")\n file/memory contains long string with (Indicator: \"CertOpenSystemStore\"; File: \"Bootrsraptler_42.2.62851.exe\")\n file/memory contains long string with (Indicator: \"CryptAcquireContext\"; File: \"Bootrsraptler_42.2.62851.exe\")\n file/memory contains long string with (Indicator: \"CertFreeCertificateContext\"; File: \"Bootrsraptler_42.2.62851.exe\")\n file/memory contains long string with (Indicator: \"CertEnumCertificatesInStore\"; File: \"Bootrsraptler_42.2.62851.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00008156.00000000.177465.D60C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$27","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Contains ability to perform AES/RC4 encryption (API string)\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains reference to crypto DLLs\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - ChaCha20 encryption algorithm\n Matched sigs: YARA signature match – cryptographic algorithms","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$28","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"Found string \"github.com\" (Indicator: \"github.com\"; File: \"PCAP\")\n file/memory contains long string with (Indicator: \"github.com\"; File: \"PCAP\")\n Found string \"st: github.com\" (Indicator: \"github.com\"; Source: \"00000000-00008156.00000000.177465.7A5F5000.00000004.mdmp\")\n Found string \"github.com\" (Indicator: \"github.com\"; Source: \"00000000-00008156.00000000.177465.D60C0000.00000004.mdmp, 00000000-00008156.00000000.177465.D6149000.00000004.mdmp\")\n Found string \"Host: github.com\" (Indicator: \"github.com\"; Source: \"00000000-00008156.00000000.177465.D6149000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"GetUserNameAGetUserNameA\" (Source: \"00000000-00008156.00000000.177465.00080000.00000004.mdmp\")\n Found string \"GetUserNameA\" (Source: \"00000000-00008156.00000000.177465.00400000.00000004.mdmp, 00000000-00008156.00000000.177465.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"Bootrsraptler_42.2.62851.exe\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00008156-00000C2C-1761684853\")\n Found string \"syscall.GetCommandLine\" (Indicator: \"GetCommandLine\"; File: \"Bootrsraptler_42.2.62851.exe\")\n Found string \"syscall.procGetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"Bootrsraptler_42.2.62851.exe\")\n Found string \"syscall.GetCommandLine\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00008156.00000000.177465.015DE000.00000002.mdmp\")\n Found string \"syscall.procGetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00008156.00000000.177465.015DE000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query service configuration on system (API string)","description":"file/memory contains long string(File: \"Bootrsraptler_42.2.62851.exe\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-910","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"file/memory contains long string with (Indicator: \"getaddrinfo\"; File: \"Bootrsraptler_42.2.62851.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetSystemInfo\" in file \"Bootrsraptler_42.2.62851.exe\"\n Found system information discovery API: \"GetEnvironmentStringsW\" in file \"Bootrsraptler_42.2.62851.exe\"\n Found system information discovery API: \"GetEnvironmentStrings (in long string)\" in file \"Bootrsraptler_42.2.62851.exe\"\n Found system information discovery API: \"ExpandEnvironmentStrings (in long string)\" in file \"Bootrsraptler_42.2.62851.exe\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; Source: \"00000000-00008156.00000000.177465.00000000.00000004.mdmp, 00000000-00008156.00000000.177465.00400000.00000004.mdmp, 00000000-00008156.00000000.177465.40000000.00000040.mdmp\")\n Found reference to API \"GetKeyboardLayoutNameW\" (Indicator: \"GetKeyboardLayout\"; Source: \"00000000-00008156.00000000.177465.00000000.00000004.mdmp, 00000000-00008156.00000000.177465.00400000.00000004.mdmp, 00000000-00008156.00000000.177465.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"Bootrsraptler_42.2.62851.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00008156)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"Bootrsraptler_42.2.62851.exe\" called \"GetComputerNameExA\" with parameters (UID: 00000000-00008156)\n \"Bootrsraptler_42.2.62851.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00008156)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"Bootrsraptler_42.2.62851.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00008156)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"Bootrsraptler_42.2.62851.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00008156)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$29","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"Found string \"SELECT * FROM Win32_OperatingSystem\" (Indicator: \"select * from \"; Source: \"00000000-00008156-00002714-1762062310\")\n Found string \"SELECT * FROM Win32_VideoController\" (Indicator: \"select * from \"; Source: \"00000000-00008156-00002714-1762085166\")\n Found string \"SELECT * FROM AntiVirusProduct\" (Indicator: \"select * from \"; Source: \"00000000-00008156-00002714-1762104087\")\n Found string \"909102718,\"SELECT * FROM AntiVirusProduct\"\" (Indicator: \"select * from \"; Source: \"00000000-00008156.00000000.177465.7A5F5000.00000004.mdmp\")\n Found string \"SELECT * FROM AntiVirusProduct\" (Indicator: \"select * from \"; Source: \"00000000-00008156.00000000.177465.D60C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"Bootrsraptler_42.2.62851.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"file/memory contains long string with (Indicator: \"GetSystemTimeAsFileTime\"; File: \"Bootrsraptler_42.2.62851.exe\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"file/memory contains long string with (Indicator: \"GetTimeZoneInformation\"; File: \"Bootrsraptler_42.2.62851.exe\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"file/memory contains long string with (Indicator: \"GetVersion\"; File: \"Bootrsraptler_42.2.62851.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"file/memory contains long string with (Indicator: \"GetStartupInfo\"; File: \"Bootrsraptler_42.2.62851.exe\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"file/memory contains long string with (Indicator: \"GetVolumeInformation\"; File: \"Bootrsraptler_42.2.62851.exe\")\n file/memory contains long string with (Indicator: \"GetVolumeNameForVolumeMountPoint\"; File: \"Bootrsraptler_42.2.62851.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Environment Awareness","name":"Executes WMI queries","description":"\"Bootrsraptler_42.2.62851.exe\" issued a query \"SELECT * FROM Win32_OperatingSystem\"\n \"Bootrsraptler_42.2.62851.exe\" issued a query \"SELECT * FROM Win32_VideoController\"\n \"Bootrsraptler_42.2.62851.exe\" issued a query \"SELECT * FROM AntiVirusProduct\"","origin":"API Call","mitre_attack_id":"T1047","relevance":10,"id":"api-56","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"Bootrsraptler_42.2.62851.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"$2a","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKey (in long string)\" in file \"Bootrsraptler_42.2.62851.exe\"\n Found registry modification API: \"RegLoadMUIString (in long string)\" in file \"Bootrsraptler_42.2.62851.exe\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"file/memory contains long string with (Indicator: \"OpenSCManager\"; File: \"Bootrsraptler_42.2.62851.exe\")\n file/memory contains long string with (Indicator: \"QueryServiceStatus\"; File: \"Bootrsraptler_42.2.62851.exe\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"file/memory contains long string with (Indicator: \"MoveFileW\"; File: \"Bootrsraptler_42.2.62851.exe\")\n file/memory contains long string with (Indicator: \"MoveFileExW\"; File: \"Bootrsraptler_42.2.62851.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"Found string \"syscall.GetCommandLine\" (Source: \"00000000-00008156.00000000.177465.015DE000.00000002.mdmp\")\n Found string \"syscall.procGetCommandLineW\" (Source: \"00000000-00008156.00000000.177465.015DE000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2b","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2c","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"github.com\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"87.232.123.60:4326\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"SELECT * FROM Win32_OperatingSystem\" (Source: 00000000-00008156-00002714-1762062310, Indicator: \"select * from win32_operatingsystem\")\n \"SELECT * FROM Win32_VideoController\" (Source: 00000000-00008156-00002714-1762085166, Indicator: \"select * from win32_videocontroller\")\n \"SELECT * FROM AntiVirusProduct\" (Source: 00000000-00008156-00002714-1762104087, Indicator: \"select * from antivirusproduct\")\n \"SELECT * FROM AntiVirusProduct\" (Source: 00000000-00008156.00000000.177465.D60C0000.00000004.mdmp, Indicator: \"select * from antivirusproduct\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"file/memory contains long string with (Indicator: \"CreateProcess\"; File: \"Bootrsraptler_42.2.62851.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"file/memory contains long string with (Indicator: \"CreateDirectory\"; File: \"Bootrsraptler_42.2.62851.exe\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"file/memory contains long string with (Indicator: \"DeviceIoControl\"; File: \"Bootrsraptler_42.2.62851.exe\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; File: \"Bootrsraptler_42.2.62851.exe\")\n file/memory contains long string with (Indicator: \"CreateFile\"; File: \"Bootrsraptler_42.2.62851.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"file/memory contains long string with (Indicator: \"RegCloseKey\"; File: \"Bootrsraptler_42.2.62851.exe\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"file/memory contains long string with (Indicator: \"MoveFile\"; File: \"Bootrsraptler_42.2.62851.exe\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"Bootrsraptler_42.2.62851.exe\")\n file/memory contains long string with (Indicator: \"CommandLineToArgv\"; File: \"Bootrsraptler_42.2.62851.exe\")\n Found reference to API \"syscall.GetCommandLine\" (Indicator: \"GetCommandLine\"; File: \"Bootrsraptler_42.2.62851.exe\")\n Found reference to API \"syscall.procGetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"Bootrsraptler_42.2.62851.exe\")\n Found reference to API \"syscall.GetCommandLine\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00008156.00000000.177465.015DE000.00000002.mdmp\")\n Found reference to API \"syscall.procGetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00008156.00000000.177465.015DE000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; File: \"Bootrsraptler_42.2.62851.exe\")\n Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; File: \"Bootrsraptler_42.2.62851.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"Bootrsraptler_42.2.62851.exe\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"Bootrsraptler_42.2.62851.exe\")\n Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; File: \"Bootrsraptler_42.2.62851.exe\")\n file/memory contains long string with (Indicator: \"OpenThread\"; File: \"Bootrsraptler_42.2.62851.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"file/memory contains long string with (Indicator: \"GetLastError\"; File: \"Bootrsraptler_42.2.62851.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"\\REGISTRY\\USER\\S-1-5-21-735145574-\\Registry\\Machine\\Software\\Classes\\WOW6432Node\\CLSID\\{4590F811-1D3A-11D0-891F-00AA004B2\" in Source: 00000000-00008156.00000000.177465.D60C0000.00000004.mdmp\n \"4-\\Registry\\Machine\\Software\\Classes\\WOW6432Node\\CLSID\\{8\" in Source: 00000000-00008156.00000000.177465.D60C0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"Bootrsraptler_42.2.62851.exe\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"General","name":"Found User Agent related strings","description":"Found string \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36\" (Indicator: \"mozilla/5.0 (\"; Source: \"00000000-00008156.00000000.177465.D60C0000.00000004.mdmp, 00000000-00008156.00000000.177465.D6149000.00000004.mdmp\")\n Found string \"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36\" (Indicator: \"mozilla/5.0 (\"; Source: \"00000000-00008156.00000000.177465.D6149000.00000004.mdmp\")\n Found string \"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36\" (Indicator: \"user-agent: \"; Source: \"00000000-00008156.00000000.177465.D6149000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"\"\\REGISTRY\\USER\\S-1-5-21-735145574-\\Registry\\Machine\\Software\\Classes\\WOW6432Node\\CLSID\\{4590F811-1D3A-11D0-891F-00AA004B2\" in Source: 00000000-00008156.00000000.177465.D60C0000.00000004.mdmp\n \"4-\\Registry\\Machine\\Software\\Classes\\WOW6432Node\\CLSID\\{8\" in Source: 00000000-00008156.00000000.177465.D60C0000.00000004.mdmp","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"\"st: github.com\" (Indicator: \"github.com\")\n \"github.com\" (Indicator: \"github.com\")\n \"Host: github.com\" (Indicator: \"github.com\")","origin":"File/Memory","relevance":1,"id":"string-135","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$2e","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"Bootrsraptler_42.2.62851.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 4C180000\n \"Bootrsraptler_42.2.62851.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 4ABE0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"Bootrsraptler_42.2.62851.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 4E930000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a006900000040c74f4bfc7f0000@ntdll.dll\"\n \"\"#i@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"Bootrsraptler_42.2.62851.exe\" was detected as \"Go\" and name: \"Compiler\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"Bootrsraptler_42.2.62851.exe\" touched \"WBEM Locator\" (Path: \"HKCU\\CLSID\\{4590F811-1D3A-11D0-891F-00AA004B2E24}\")\n \"Bootrsraptler_42.2.62851.exe\" touched \"Windows Management and Instrumentation\" (Path: \"HKCU\\CLSID\\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\\TREATAS\")\n \"Bootrsraptler_42.2.62851.exe\" touched \"PSFactoryBuffer\" (Path: \"HKCU\\CLSID\\{7C857801-7381-11CF-884D-00AA004B2E24}\\TREATAS\")\n \"Bootrsraptler_42.2.62851.exe\" touched \"Microsoft WBEM (non)Standard Marshaling for IWbemServices\" (Path: \"HKCU\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\TREATAS\")\n \"Bootrsraptler_42.2.62851.exe\" touched \"Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject\" (Path: \"HKCU\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\TREATAS\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"Bootrsraptler_42.2.62851.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"Bootrsraptler_42.2.62851.exe\" has an writable section named \".data\"\n \"Bootrsraptler_42.2.62851.exe\" has an writable section named \".idata\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"Bootrsraptler_42.2.62851.exe\" file has an entrypoint instructions - \"jmp\t0x461c40,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,push\trbp,mov\trbp, rsp,pushfq\t,cld\t,sub\trsp, 0xe0,mov\tqword ptr [rsp], rdi,mov\tqword ptr [rsp + 8], rsi,mov\tqword ptr [rsp + 0x10], rbp,mov\tqword ptr [rsp + 0x18], rbx,mov\tqword ptr [rsp + 0x20], r12,mov\tqword ptr [rsp + 0x28], r13,mov\tqword ptr [rsp + 0x30], r14,mov\tqword ptr [rsp + 0x38], r15,movups\txmmword ptr [rsp + 0x40], xmm6,movups\txmmword ptr [rsp + 0x50], xmm7,movups\txmmword ptr [rsp + 0x60], xmm8,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x4a1800\" greater than 0x100000\n Raw size of \".rdata\" is \"0x359200\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x4a17cb\" greater than 0x100000\n Virtual size of \".rdata\" is \"0x359188\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"General","name":"Possibly references Golang binary related string","description":"\"Go build ID: \"jLYRxDBWzvqXJznxNsT0/7cLkB20ZnbuH04rf3cXU/9njm1AjF7GK0yQy2eamK/D1-5r50LmmmqyqtvBqiS\"\" (Indicator: \"Go build ID: \"jLYRxDBWzvqXJznxNsT0/7cLkB20ZnbuH04rf3cXU/9njm1AjF7GK0yQy2eamK/D1-5r50LmmmqyqtvBqiS\")\" in Source: Bootrsraptler_42.2.62851.exe","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-74","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"github.com\"\n \"trenthamsrealty.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"Bootrsraptler_42.2.62851.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"Bootrsraptler_42.2.62851.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"Bootrsraptler_42.2.62851.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")\n \"Bootrsraptler_42.2.62851.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"General","name":"The input sample contains the RDTSCP instruction","description":"Found VM detection artifact \"RDTSCP trick\" in \"sample.bin\" (Offset: 406441)","origin":"Binary File","mitre_attack_id":"T1497","relevance":5,"id":"binary-26","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=Ember Works Analytics, O=Ember Works Analytics, C=US\" (SHA1: 43:58:E7:63:5C:B1:20:D7:57:E6:2F:5E:F2:0A:40:DF:2E:A2:33:D0; see report for more information)\n The input sample is signed with a certificate issued by \"CN=DigiCert Assured ID Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US\" (SHA1: A9:9D:5B:79:E9:F1:CD:A5:9C:DA:B6:37:31:69:D5:35:3F:58:74:C6; see report for more information)\n The input sample is signed with a certificate issued by \"CN=DigiCert Trusted Root G4, OU=www.digicert.com, O=DigiCert Inc, C=US\" (SHA1: 07:89:4D:00:FC:19:4A:17:DB:27:3A:EB:5C:F8:FA:CE:F1:44:23:A4; see report for more information)\n The input sample is signed with a certificate issued by \"CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1, O=\"DigiCert\n Inc.\", C=US\" (SHA1: 51:D9:AB:DA:03:49:73:D8:4F:42:66:AC:A4:82:48:E6:B3:69:C4:39; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"Bootrsraptler_42.2.62851.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$30","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"Bootrsraptler_42.2.62851.exe\" queries basic process information of the \"C:\\Bootrsraptler_42.2.62851.exe\" (UID: 8156)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$31","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: The input sample contains the RDTSCP instruction","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"Bootrsraptler_42.2.62851.exe\" trying to touch file \"C:\\Windows\\System32\\apphelp.dll\"\n \"Bootrsraptler_42.2.62851.exe\" trying to touch file \"C:\\WINDOWS\\SYSTEM32\\apphelp.dll\"\n \"Bootrsraptler_42.2.62851.exe\" trying to touch file \"C:\\Bootrsraptler_42.2.62851.exe\"\n \"Bootrsraptler_42.2.62851.exe\" trying to touch file \"C:\\Windows\\System32\\ntdll.dll\"\n \"Bootrsraptler_42.2.62851.exe\" trying to touch file \"C:\\Windows\\System32\\kernel32.dll\"\n \"Bootrsraptler_42.2.62851.exe\" trying to touch file \"C:\\Windows\\System32\\KernelBase.dll\"\n \"Bootrsraptler_42.2.62851.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"Bootrsraptler_42.2.62851.exe\" trying to touch file \"C:\\windows\\temp\\VxSSL64.dll\"\n \"Bootrsraptler_42.2.62851.exe\" trying to touch file \"C:\\FLTLIB.DLL\"\n \"Bootrsraptler_42.2.62851.exe\" trying to touch file \"C:\\Windows\\System32\\fltLib.dll\"\n \"Bootrsraptler_42.2.62851.exe\" trying to touch file \"C:\\WINDOWS\\SYSTEM32\\FLTLIB.DLL\"\n \"Bootrsraptler_42.2.62851.exe\" trying to touch file \"C:\\MSVCP140.DLL\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$32","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"Bootrsraptler_42.2.62851.exe\" trying to access non-existent file \"\\Device\\RasAcd\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Network Related","name":"Able to determine NetBIOS or DNS name associated with the local computer","description":"file/memory contains long string with (Indicator: \"getcomputernameexw\"; File: \"Bootrsraptler_42.2.62851.exe\")\n Found reference to API \"GetComputerNameExA\" (Indicator: \"getcomputernameexa\"; Source: \"00000000-00008156-00000C2C-1761752224\")\n Found reference to API \"GetComputerNameExA\" (Indicator: \"getcomputernameexa\"; Source: \"00000000-00008156.00000000.177465.00000000.00000004.mdmp, 00000000-00008156.00000000.177465.00400000.00000004.mdmp, 00000000-00008156.00000000.177465.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-736","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"SetsockoptInt\" (Indicator: \"setsockopt\"; File: \"Bootrsraptler_42.2.62851.exe\")\n Found reference to API \"SetsockoptIPMreq\" (Indicator: \"setsockopt\"; File: \"Bootrsraptler_42.2.62851.exe\")\n Found reference to API \"SetsockoptLinger\" (Indicator: \"setsockopt\"; File: \"Bootrsraptler_42.2.62851.exe\")\n Found reference to API \"SetsockoptIPv6Mreq\" (Indicator: \"setsockopt\"; File: \"Bootrsraptler_42.2.62851.exe\")\n Found reference to API \"SetsockoptInet4Addr\" (Indicator: \"setsockopt\"; File: \"Bootrsraptler_42.2.62851.exe\")\n file/memory contains long string with (Indicator: \"setsockopt\"; File: \"Bootrsraptler_42.2.62851.exe\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to send the specified request to the HTTP server","description":"\"Bootrsraptler_42.2.62851.exe\" called \"WinHttpSendRequest\" with parameters {\"hRequest\": \"19bd6125a90\"\n \"lpszHeaders\": \"Content-Type: application/x-www-form-urlencoded\"\n \"dwHeadersLength\": \"4294967295\"\n \"lpOptional\": \"tag=639d58bc468d7960cf903761cf7acf92&exp=1791121311&hwid=8c4563a5315800e1a483831575787673\"\n \"dwOptionalLength\": \"89\"\n \"dwTotalLength\": \"89\"\n \"dwContext\": \"0\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-190","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to to receive the response to a HTTP requests","description":"\"Bootrsraptler_42.2.62851.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"19bd6125a90\"\n \"lpReserved\": \"0\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-191","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"Found http requests in header \"POST /users\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"file/memory contains long string with (Indicator: \"CreatePipe\"; File: \"Bootrsraptler_42.2.62851.exe\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"file/memory contains long string with (Indicator: \"setsockopt\"; File: \"Bootrsraptler_42.2.62851.exe\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve information about user accounts on a server (API string)","description":"file/memory contains long string with (Indicator: \"NetUserGetInfo\"; File: \"Bootrsraptler_42.2.62851.exe\")\n file/memory contains long string with (Indicator: \"NetUserGetLocalGroups\"; File: \"Bootrsraptler_42.2.62851.exe\")","origin":"File/Memory","mitre_attack_id":"T1087.001","relevance":1,"id":"string-112","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"192.168.0.2\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$36","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"Found URL \"http://trenthamsrealty.com:4326/users!this\" - Source: \"00000000-00008156.00000000.177465.40000000.00000040.mdmp\")\n Found URL \"http://cdnnthamsrealty.com:4326/trenthamsrealty.comilesmffu2:66e6:bf83:f318355-1clsid\\\" - Source: \"00000000-00008156.00000000.177465.D60C0000.00000004.mdmp\")\n Found URL \"http://www.w3.org/2001/xmlschema-instance\" - Source: \"00000000-00008156.00000000.177465.D60C0000.00000004.mdmp\")\n Found URL \"http://trenthamsrealty.com:4326/userstrenthamsrealty.comtrenthamsrealty.comtrenthamsrealty.compmappernsresolvern-uspmappertcpipyper-v\" - Source: \"00000000-00008156.00000000.177465.D6149000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"POST /users HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00008156.00000000.177465.D6149000.00000004.mdmp\")\n Found string \"HTTP/1.1 405 Not Allowed\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00008156.00000000.177465.D6149000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"trenthamsrealty.com\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Network Related","name":"References server/domain address with port number","description":"Found ip/domain with port number \"http://trenthamsrealty.com:4326\"Found ip/domain with port number \"http://cdnnthamsrealty.com:4326\"","origin":"Indicator Combinations","mitre_attack_id":"T1571","id":"summary-25","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to create/switch the desktop (API string)","description":"Found reference to API \"EFABCDTilTilCreateDesktopW\" (Indicator: \"CreateDesktop\"; Source: \"00000000-00008156.00000000.177465.00000000.00000004.mdmp\")\n Found reference to API \"CreateDesktopW\" (Indicator: \"CreateDesktop\"; Source: \"00000000-00008156.00000000.177465.00000000.00000004.mdmp, 00000000-00008156.00000000.177465.00400000.00000004.mdmp, 00000000-00008156.00000000.177465.40000000.00000040.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-541","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"9ncalrpc:[epmapper,Security=Impersonation Dynamic False]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00008156.00000000.177465.D60C0000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLEA2B351A44A9275D56D657BAEDC64]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00008156.00000000.177465.D60C0000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE79AEB2477CBCF91CF0094E16A02B]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00008156.00000000.177465.D60C0000.00000004.mdmp\")\n Found string \"B+ncalrpc:[OLEA2B351A44A9275D56D657BAEDC64]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00008156.00000000.177465.D60C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00008156.00000000.177465.D60C0000.00000004.mdmp\")\n Found string \"icrosoft Kerberos V1.0\" (Indicator: \"kerberos\"; Source: \"00000000-00008156.00000000.177465.D60C0000.00000004.mdmp\")\n Found string \"Microsoft Kerberos V1.0\" (Indicator: \"kerberos\"; Source: \"00000000-00008156.00000000.177465.D60C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"file/memory contains long string with (Indicator: \"RtlGetNtVersionNumbers\"; File: \"Bootrsraptler_42.2.62851.exe\")\n Found reference to API \"syscall.procRtlGetNtVersionNumbers\" (Indicator: \"RtlGetNtVersionNumbers\"; File: \"Bootrsraptler_42.2.62851.exe\")\n Found reference to API \"syscall.procRtlGetNtVersionNumbers\" (Indicator: \"RtlGetNtVersionNumbers\"; Source: \"00000000-00008156.00000000.177465.015DE000.00000002.mdmp\")\n Found reference to API \"runtime._RtlGetNtVersionNumbers\" (Indicator: \"RtlGetNtVersionNumbers\"; Source: \"00000000-00008156.00000000.177465.015DE000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegOpenKey (in long string)\" in file \"Bootrsraptler_42.2.62851.exe\"\n Found registry query API: \"RegEnumValue (in long string)\" in file \"Bootrsraptler_42.2.62851.exe\"\n Found registry query API: \"RegQueryValue (in long string)\" in file \"Bootrsraptler_42.2.62851.exe\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"file/memory contains long string with (Indicator: \"GetUserName\"; File: \"Bootrsraptler_42.2.62851.exe\")\n file/memory contains long string with (Indicator: \"NetUserGetInfo\"; File: \"Bootrsraptler_42.2.62851.exe\")\n file/memory contains long string with (Indicator: \"LookupAccountSid\"; File: \"Bootrsraptler_42.2.62851.exe\")\n file/memory contains long string with (Indicator: \"LookupAccountName\"; File: \"Bootrsraptler_42.2.62851.exe\")\n file/memory contains long string with (Indicator: \"GetTokenInformation\"; File: \"Bootrsraptler_42.2.62851.exe\")\n file/memory contains long string with (Indicator: \"NetGetJoinInformation\"; File: \"Bootrsraptler_42.2.62851.exe\")\n Found reference to API \"GetUserNameAGetUserNameA\" (Indicator: \"GetUserName\"; Source: \"00000000-00008156.00000000.177465.00080000.00000004.mdmp\")\n Found reference to API \"GetUserNameA\" (Indicator: \"GetUserName\"; Source: \"00000000-00008156.00000000.177465.00400000.00000004.mdmp, 00000000-00008156.00000000.177465.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"Bootrsraptler_42.2.62851.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"Bootrsraptler_42.2.62851.exe\" called \"GetComputerNameA\" (UID: 00000000-00008156)\n \"Bootrsraptler_42.2.62851.exe\" called \"GetComputerNameW\" (UID: 00000000-00008156)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"Bootrsraptler_42.2.62851.exe\" called \"GetUserNameA\" (UID: 00000000-00008156)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$38","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"file/memory contains long string with (Indicator: \"FindNextFile\"; File: \"Bootrsraptler_42.2.62851.exe\")\n file/memory contains long string with (Indicator: \"FindFirstFile\"; File: \"Bootrsraptler_42.2.62851.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$39","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query network adapter information (API string)","description":"file/memory contains long string with (Indicator: \"GetAdaptersInfo\"; File: \"Bootrsraptler_42.2.62851.exe\")\n file/memory contains long string with (Indicator: \"GetAdaptersAddresses\"; File: \"Bootrsraptler_42.2.62851.exe\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-118","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve SID for the specified name (API string)","description":"file/memory contains long string with (Indicator: \"LookupAccountName\"; File: \"Bootrsraptler_42.2.62851.exe\")","origin":"File/Memory","mitre_attack_id":"T1087","relevance":1,"id":"string-452","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetSystemDirectoryA\" (Indicator: \"GetSystemDirectory\"; File: \"Bootrsraptler_42.2.62851.exe\")\n Found reference to API \"GetFileInformationByHandle\" (Indicator: \"GetFileInformationByHandle\"; File: \"Bootrsraptler_42.2.62851.exe\")\n file/memory contains long string with (Indicator: \"GetTempPath\"; File: \"Bootrsraptler_42.2.62851.exe\")\n file/memory contains long string with (Indicator: \"GetFileAttributes\"; File: \"Bootrsraptler_42.2.62851.exe\")\n file/memory contains long string with (Indicator: \"GetCurrentDirectory\"; File: \"Bootrsraptler_42.2.62851.exe\")\n file/memory contains long string with (Indicator: \"ReadDirectoryChange\"; File: \"Bootrsraptler_42.2.62851.exe\")\n file/memory contains long string with (Indicator: \"GetFileInformationByHandle\"; File: \"Bootrsraptler_42.2.62851.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"file/memory contains long string with (Indicator: \"GetComputerName\"; File: \"Bootrsraptler_42.2.62851.exe\")\n Found reference to API \"GetComputerNameA\" (Indicator: \"GetComputerName\"; Source: \"00000000-00008156.00000000.177465.00000000.00000004.mdmp, 00000000-00008156.00000000.177465.00400000.00000004.mdmp, 00000000-00008156.00000000.177465.40000000.00000040.mdmp\")\n Found reference to API \"GetComputerNameExA\" (Indicator: \"GetComputerName\"; Source: \"00000000-00008156.00000000.177465.00000000.00000004.mdmp, 00000000-00008156.00000000.177465.00400000.00000004.mdmp, 00000000-00008156.00000000.177465.40000000.00000040.mdmp\")\n Found reference to API \"ABCDEFTilTilGetComputerNameAt Swt Switchitch St Stateate\" (Indicator: \"GetComputerName\"; Source: \"00000000-00008156.00000000.177465.00000000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"file/memory contains long string with (Indicator: \"GetModuleFileName\"; File: \"Bootrsraptler_42.2.62851.exe\")\n Found reference to API \"internal/syscall/windows.GetModuleFileName\" (Indicator: \"GetModuleFileName\"; File: \"Bootrsraptler_42.2.62851.exe\")\n Found reference to API \"internal/syscall/windows.GetModuleFileName\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00008156.00000000.177465.015DE000.00000002.mdmp\")\n Found reference to API \"internal/syscall/windows.procGetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00008156.00000000.177465.015DE000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"file/memory contains long string with (Indicator: \"GetEnvironmentVariable\"; File: \"Bootrsraptler_42.2.62851.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"file/memory contains long string with (Indicator: \"getsockname\"; File: \"Bootrsraptler_42.2.62851.exe\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-224","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"EFABCDTilTilGetSystemMetricst Swt Switchitch St Stateate\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00008156.00000000.177465.00000000.00000004.mdmp\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00008156.00000000.177465.00000000.00000004.mdmp, 00000000-00008156.00000000.177465.00400000.00000004.mdmp, 00000000-00008156.00000000.177465.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"ing do down):********* ******* GetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"00000000-00008156.00000000.177465.00100000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"file/memory contains long string with (Indicator: \"route\"; File: \"Bootrsraptler_42.2.62851.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"Found string \"SELECT * FROM Win32_OperatingSystem\" (Indicator: \" Win32_OperatingSystem\"; Source: \"00000000-00008156-00002714-1762062310\")\n Found string \"SELECT * FROM Win32_VideoController\" (Indicator: \" Win32_VideoController\"; Source: \"00000000-00008156-00002714-1762085166\")\n Found string \"SELECT * FROM AntiVirusProduct\" (Indicator: \"antivirusproduct\"; Source: \"00000000-00008156-00002714-1762104087\")\n Found string \"909102718,\"SELECT * FROM AntiVirusProduct\"\" (Indicator: \"antivirusproduct\"; Source: \"00000000-00008156.00000000.177465.7A5F5000.00000004.mdmp\")\n Found string \"AntiVirusProduct\" (Indicator: \"antivirusproduct\"; Source: \"00000000-00008156.00000000.177465.D60C0000.00000004.mdmp\")\n Found string \"SELECT * FROM AntiVirusProduct\" (Indicator: \"antivirusproduct\"; Source: \"00000000-00008156.00000000.177465.D60C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteKey (in long string)\" in file \"Bootrsraptler_42.2.62851.exe\"\n Found registry deletion API: \"RegDeleteValue (in long string)\" in file \"Bootrsraptler_42.2.62851.exe\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00008156.00000000.177465.D60C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"file/memory contains long string with (Indicator: \"CreateProcessAsUser\"; File: \"Bootrsraptler_42.2.62851.exe\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"file/memory contains long string with (Indicator: \"DeleteFile\"; File: \"Bootrsraptler_42.2.62851.exe\")\n file/memory contains long string with (Indicator: \"RemoveDirectory\"; File: \"Bootrsraptler_42.2.62851.exe\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"file/memory contains long string with (Indicator: \"AdjustTokenPrivileges\"; File: \"Bootrsraptler_42.2.62851.exe\")\n Found reference to API \"LookupPrivilegeValueW\" (Indicator: \"LookupPrivilegeValue\"; Source: \"00000000-00008156.00000000.177465.00100000.00000004.mdmp, 00000000-00008156.00000000.177465.00400000.00000004.mdmp, 00000000-00008156.00000000.177465.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"file/memory contains long string with (Indicator: \"SetFileAttributes\"; File: \"Bootrsraptler_42.2.62851.exe\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify process attributes (API string)","description":"file/memory contains long string with (Indicator: \"UpdateProcThreadAttribute\"; File: \"Bootrsraptler_42.2.62851.exe\")\n file/memory contains long string with (Indicator: \"InitializeProcThreadAttributeList\"; File: \"Bootrsraptler_42.2.62851.exe\")","origin":"File/Memory","mitre_attack_id":"T1685","relevance":1,"id":"string-402","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"file/memory contains long string with (Indicator: \"CopySid\"; File: \"Bootrsraptler_42.2.62851.exe\")\n file/memory contains long string with (Indicator: \"GetLengthSid\"; File: \"Bootrsraptler_42.2.62851.exe\")\n file/memory contains long string with (Indicator: \"RevertToSelf\"; File: \"Bootrsraptler_42.2.62851.exe\")\n file/memory contains long string with (Indicator: \"ImpersonateSelf\"; File: \"Bootrsraptler_42.2.62851.exe\")\n file/memory contains long string with (Indicator: \"DuplicateToken\"; File: \"Bootrsraptler_42.2.62851.exe\")\n file/memory contains long string with (Indicator: \"DuplicateTokenEx\"; File: \"Bootrsraptler_42.2.62851.exe\")\n file/memory contains long string with (Indicator: \"GetTokenInformation\"; File: \"Bootrsraptler_42.2.62851.exe\")\n file/memory contains long string with (Indicator: \"SetTokenInformation\"; File: \"Bootrsraptler_42.2.62851.exe\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"Shutdown\" (Indicator: \"shutdown\") in Source: Bootrsraptler_42.2.62851.exe","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"Bootrsraptler_42.2.62851.exe\")\n file/memory contains long string with (Indicator: \"ExitProcess\"; File: \"Bootrsraptler_42.2.62851.exe\")\n file/memory contains long string with (Indicator: \"TerminateProcess\"; File: \"Bootrsraptler_42.2.62851.exe\")\n Found reference to API \"d downown):********* ******* ***** *** *ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00008156.00000000.177465.00000000.00000004.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00008156.00000000.177465.00000000.00000004.mdmp, 00000000-00008156.00000000.177465.00400000.00000004.mdmp, 00000000-00008156.00000000.177465.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"Bootrsraptler_42.2.62851.exe\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"Bootrsraptler_42.2.62851.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$3b","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to free the memory used by network management functions (API string)","description":"file/memory contains long string with (Indicator: \"NetApiBufferFree\"; File: \"Bootrsraptler_42.2.62851.exe\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-223","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"ungetc\" (Source: Bootrsraptler_42.2.62851.exe, API is part of module: MSVCRT.DLL)\n Found string \"remove\" (Source: Bootrsraptler_42.2.62851.exe, API is part of module: MSVCRT.DLL)\n Found string \"WSAIoctl\" (Source: Bootrsraptler_42.2.62851.exe, API is part of module: WS2_32.DLL)\n Found string \"GetFileType\" (Source: Bootrsraptler_42.2.62851.exe, API is part of module: KERNELBASE.DLL)\n Found string \"GetFileInformationByHandle\" (Source: Bootrsraptler_42.2.62851.exe, API is part of module: KERNELBASE.DLL)\n Found string \"WSAGetOverlappedResult\" (Source: Bootrsraptler_42.2.62851.exe, API is part of module: WS2_32.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"Bootrsraptler_42.2.62851.exe\" was detected as \"tElock v1.0 (private) -> tE!\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"PE file has no resource directory","description":"\"Bootrsraptler_42.2.62851.exe\" has no resource directory","origin":"Static Parser","mitre_attack_id":"T1027.008","relevance":7,"id":"static-9002","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"suspicious","category":"Environment Awareness","name":"May attempt to implement anti-virtualization techniques using MAC address detection","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":3,"id":"string-2","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"8/23 Antivirus vendors marked sample as malicious (34% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"suspicious","category":"General","name":"POSTs data to a web server","description":"\"POST /users HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nContent-Type: application/x-www-form-urlencoded\nHost: github.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36\nContent-Length: 89\" with payload::==> \"tag=639d58bc468d7960cf903761cf7acf92&exp=1791121311&hwid=8c4563a5315800e1a483831575787673\" HTTP/1.1 405 Not Allowed\nDate: Thu\n 08 Oct 2026 09:42:50 GMT\nContent-Type: text/html\nContent-Length: 55\nConnection: keep-alive\nServer: nginx\nAllow: GET\n HEAD with response body ==>5B17C3964FC2B30225C2BB4FC3AF462900C3BB572FC3B322C3B1C389C2BF2F6508C2ACC29DC3B6C285C3AC197C1110C2B7C3992E11C28AC389C383604BC28DC3.......","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"suspicious","category":"Network Related","name":"Employs a browser-related User Agent without launching browser","description":"Found User Agent(s): Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"ROOT\\CIMV2\" (Indicator: \"root\\cimv2\"; in Source: \"00000000-00008156-00002713-1762051956\")\n Found string \"ROOT\\CIMV2\" (Indicator: \"root\\cimv2\"; in Source: \"00000000-00008156.00000000.177465.D60C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Executes WMI queries to gather system information","description":"\"Bootrsraptler_42.2.62851.exe\" issued a query \"SELECT * FROM Win32_OperatingSystem\"\n \"Bootrsraptler_42.2.62851.exe\" issued a query \"SELECT * FROM Win32_VideoController\"\n \"Bootrsraptler_42.2.62851.exe\" issued a query \"SELECT * FROM AntiVirusProduct\"","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-183","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"WriteFile\n GetSystemInfo\n LoadLibraryExW\n VirtualAlloc\n GetSystemDirectoryA\n CreateThread\n LoadLibraryW\n GetProcAddress\n GetThreadContext\n CreateFileA","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"Bootrsraptler_42.2.62851.exe\" claims program is from Thu Jan 1 00:00:00 1970","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Queries firmware table information (may be used to fingerprint/evade)","description":"\"Bootrsraptler_42.2.62851.exe\" at 00000000-00008156-00000C15-1762107441\n \"Bootrsraptler_42.2.62851.exe\" at 00000000-00008156-00000C15-1762111383","origin":"API Call","mitre_attack_id":"T1120","relevance":10,"id":"api-65","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Collects system information using POST request","description":"\"POST /users HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nContent-Type: application/x-www-form-urlencoded\nHost: github.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36\nContent-Length: 89\" with payload:==> \"tag=639d58bc468d7960cf903761cf7acf92&exp=1791121311&hwid=8c4563a5315800e1a483831575787673\"","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":10,"id":"network-40","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"level":"malicious","category":"System Security","name":"Executes WMI queries in order to detect local security applications","description":"\"Bootrsraptler_42.2.62851.exe\" issued a query \"SELECT * FROM AntiVirusProduct\"","origin":"API Call","mitre_attack_id":"T1518.001","relevance":7,"id":"api-80","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]}],"incidents":[{"name":"Spyware","details_count":2,"details":[{"detail":"POSTs data to a web server"},{"detail":"Collects system information using POST request"}],"sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Queries firmware table information (may be used to fingerprint/evade)"},{"detail":"Executes WMI queries in order to detect local security applications"}],"sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"name":"Evasive","details_count":3,"details":[{"detail":"Executes WMI queries known to be used for VM detection"},{"detail":"May attempt to implement anti-virtualization techniques using MAC address detection"},{"detail":"Found a reference to a WMI query string known to be used for VM detection"}],"sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]}],"intel_graph":{"map":{"Domain:github.com":{"type":"Domain","value":"github.com"},"Domain:trenthamsrealty.com":{"type":"Domain","value":"trenthamsrealty.com"},"File:01ec79ca328f90e03dd0c9ab0c115bacc279fa5eccea4cc03e4676dc9da78399":{"type":"File","value":"01ec79ca328f90e03dd0c9ab0c115bacc279fa5eccea4cc03e4676dc9da78399","filetype":"PE32+ executable (GUI) x86-64, for MS Windows, 8 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:4f3d067325d3fae86cac6d07575453d75cc8c58bcd092acae8de392dd3a5c6fe":{"type":"File","value":"4f3d067325d3fae86cac6d07575453d75cc8c58bcd092acae8de392dd3a5c6fe","filetype":"DER Encoded PKCS#7 Signed Data","filetype_short":"PKCS7","mime_type":"application/x-x509-ca-cert"},"Ip:87.232.123.60":{"type":"Ip","value":"87.232.123.60"},"Url:/users":{"type":"Url","value":"/users"}},"chains":[{"id":"1557689651011237383","root":"File:01ec79ca328f90e03dd0c9ab0c115bacc279fa5eccea4cc03e4676dc9da78399","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:01ec79ca328f90e03dd0c9ab0c115bacc279fa5eccea4cc03e4676dc9da78399","to_key":"File:4f3d067325d3fae86cac6d07575453d75cc8c58bcd092acae8de392dd3a5c6fe"}],"verdict":{"verdict":"unknown"}},{"id":"sandbox_network","root":"File:01ec79ca328f90e03dd0c9ab0c115bacc279fa5eccea4cc03e4676dc9da78399","edges":[{"edge_kind":"contacted_ip","from_key":"File:01ec79ca328f90e03dd0c9ab0c115bacc279fa5eccea4cc03e4676dc9da78399","to_key":"Ip:87.232.123.60"},{"edge_kind":"contacted_domain","from_key":"File:01ec79ca328f90e03dd0c9ab0c115bacc279fa5eccea4cc03e4676dc9da78399","to_key":"Domain:github.com"},{"edge_kind":"contacted_domain","from_key":"File:01ec79ca328f90e03dd0c9ab0c115bacc279fa5eccea4cc03e4676dc9da78399","to_key":"Domain:trenthamsrealty.com"},{"edge_kind":"resolves_to","from_key":"Domain:trenthamsrealty.com","to_key":"Ip:87.232.123.60"},{"edge_kind":"contacted_url","from_key":"File:01ec79ca328f90e03dd0c9ab0c115bacc279fa5eccea4cc03e4676dc9da78399","to_key":"Url:/users"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:01ec79ca328f90e03dd0c9ab0c115bacc279fa5eccea4cc03e4676dc9da78399","edges":[{"edge_kind":"extracted","from_key":"File:01ec79ca328f90e03dd0c9ab0c115bacc279fa5eccea4cc03e4676dc9da78399","to_key":"File:4f3d067325d3fae86cac6d07575453d75cc8c58bcd092acae8de392dd3a5c6fe"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":50,"dropped_files_count":0,"extracted_files_count":1,"files_written_count":1,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":2,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":2,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["remusstealer","commodity","criminal","informationstealer","evasive"],"sample_flags":["Network Traffic"],"sandbox_reports":[{"id":"6ac7657663cf91587206b06b","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":92,"malware_family":"Trojan.Generic","contacted_countries":["FIN"],"submit_name":"Bootrsraptler_42.2.62851.exe","analysis_start_time":"2026-10-08T09:42:15+00:00","indicators_count":{"informative":150,"suspicious":29,"malicious":4},"tags":["Network Traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"87.232.123.60","port":4326,"protocol":"TCP","country":"Finland","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]}],"dns_resolutions":[{"domain":"github.com","country":"-","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"domain":"trenthamsrealty.com","address":"87.232.123.60","ttl":3600,"country":"Finland","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]}],"http_requests":[{"host":"github.com","host_ip":"87.232.123.60:4326","url":"/users","method":"POST","response_code":"405","response_phrase":"Not Allowed","header":"POST /users HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nContent-Type: application/x-www-form-urlencoded\nHost: github.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36\nContent-Length: 89","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}],"processes":[{"pid":8156,"ppid":0,"name":"Bootrsraptler_42.2.62851.exe","command_line":"","sha256":"01ec79ca328f90e03dd0c9ab0c115bacc279fa5eccea4cc03e4676dc9da78399","normalized_path":"C:\\Bootrsraptler_42.2.62851.exe","uid":"00000000-00008156","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAA6UgIhRBPKvFtlTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50refsbU/OstCIAAAAASUVORK5CYII="}],"all_imported_dlls":["kernel32.dll","user32.dll","msvcp_win.dll","imm32.dll","bcryptprimitives.dll","fastprox.dll","webio.dll","IPHLPAPI.DLL","KernelBase.dll","VxSSL64.dll","ucrtbase.dll","winmm.dll","kernel.appcore.dll","bcrypt.dll","rasadhlp.dll","apphelp.dll","combase.dll","clbcatq.dll","mswsock.dll","FWPUCLNT.DLL","win32u.dll","vcruntime140_1.dll","powrprof.dll","wbemprox.dll","wbemcomn.dll","wbemsvc.dll","OnDemandConnRouteHelper.dll","gdi32.dll","msvcp140.dll","winhttp.dll","dnsapi.dll","rpcrt4.dll","msvcrt.dll","sechost.dll","ole32.dll","winmmbase.dll","winnsi.dll","ws2_32.dll","fltLib.dll","gdi32full.dll","oleaut32.dll","cryptsp.dll","uxtheme.dll","sspicli.dll","ntdll.dll","vcruntime140.dll","advapi32.dll","shlwapi.dll","cfgmgr32.dll","nsi.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"4f3d067325d3fae86cac6d07575453d75cc8c58bcd092acae8de392dd3a5c6fe","sha256":"4f3d067325d3fae86cac6d07575453d75cc8c58bcd092acae8de392dd3a5c6fe","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]}],"files_written":[{"path":"\"C:\\Bootrsraptler_42.2.62851.exe\"","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"6ac7657663cf91587206b06b"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["6ac7657663cf91587206b06b"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious WinGo/Kryptik.ABY trojan Sample 01ec79ca328f… — Score 92/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 01ec79ca328f…. Malware family: WinGo/Kryptik.ABY trojan. Threat score 92/100. 8/25 AV engines flagged this file. 4 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/01ec79ca328f90e03dd0c9ab0c115bacc279fa5eccea4cc03e4676dc9da78399"}],["$","meta","4",{"property":"og:title","content":"Malicious WinGo/Kryptik.ABY trojan Sample 01ec79ca328f… — Score 92/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 01ec79ca328f…. Malware family: WinGo/Kryptik.ABY trojan. Threat score 92/100. 8/25 AV engines flagged this file. 4 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/01ec79ca328f90e03dd0c9ab0c115bacc279fa5eccea4cc03e4676dc9da78399"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious WinGo/Kryptik.ABY trojan Sample 01ec79ca328f… — Score 92/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 01ec79ca328f…. Malware family: WinGo/Kryptik.ABY trojan. Threat score 92/100. 8/25 AV engines flagged this file. 4 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L3d","11",{}]]