26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 4b:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4b2,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Dacic.3347.Generic Sample 032894933fc4… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 032894933fc4…. Malware family: Dacic.3347.Generic. Threat score 100/100. 16/25 AV engines flagged this file. 7 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f","keywords":["Malicious","Dacic.3347.Generic","malware analysis","sandbox report","threat intelligence","032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f"],"about":{"@type":"SoftwareApplication","name":"CC-CREDIT CARD-itineraries.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Dacic.3347.Generic","antivirusDetections":{"malicious":16,"total":25},"behavioralIndicators":{"malicious":7,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:Tf48,Found reference to API "CreateThreadpoolIo" (Indicator: "CreateThread"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "VirtualAllocExNuma" (Indicator: "VirtualAlloc"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "VirtualAllocExNuma" (Indicator: "VirtualAllocEx"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "ClrVirtualFree" (Indicator: "VirtualFree"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "$CreateThreadpoolIo" (Indicator: "CreateThread"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "ZwWriteVirtualMemory" (Indicator: "WriteVirtualMemory"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "ZwWriteVirtualMemory" (Indicator: "ZwWriteVirtualMemory"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "(ZwWriteVirtualMemory" (Indicator: "WriteVirtualMemory"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "(ZwWriteVirtualMemory" (Indicator: "ZwWriteVirtualMemory"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "2RefreshCurrentProcessorId2ProcessorNumberSpeedCheck*UninlinedThreadStatic8CreateThreadLocalCountObject$get_SafeWaitHandle@" (Indicator: "CreateThread"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "BindHandle(FreeNativeOverlapped0GetNativeOverlappedStateLCreateThreadLocalCompletionCountObject" (Indicator: "CreateThread"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "ClrVirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "$CreateThreadpoolIo" (Indicator: "CreateThread"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "ZwWriteVirtualMemory" (Indicator: "WriteVirtualMemory"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "ZwWriteVirtualMemory" (Indicator: "ZwWriteVirtualMemory"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "CreateThreadpoolIo" (Indicator: "CreateThread"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "VirtualAllocExNuma" (Indicator: "VirtualAlloc"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "VirtualAllocExNuma" (Indicator: "VirtualAllocEx"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp")28:Ta0e,Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "Failed to get thread context GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "Failed to get thread context Wow64GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "Wow64GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "Wow64SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "*Wow64SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "SetThreadContext*Wow64GetThreadContext GetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "SetThreadContext*Wow64GetThreadContext GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp")29:T10e3,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "SleepEx" (Indicator: "SleepEx"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "8GetSystemSupportsLeapSeconds>GetGetSystemTimeAsFileTimeFnPtr" (Indicator: "GetSystemTimeAsFileTime"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "0NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "8GetSystemSupportsLeapSeconds>GetGetSystemTimeAsFileTimeFnPtr" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "6ThrowInvalidHandleExceptionRWaitForMultipleObjectsIgnoringSyncContext" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "0NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "SleepEx" (Indicator: "SleepEx"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp")2a:T7d0,Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API ".LoadLibraryCallbackStub" (Indicator: "LoadLibrary"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "FreeLibrary4GetFileAttributesExPrivate" (Indicator: "FreeLibrary"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "LoadLibraryEx" (Indicator: "LoadLibrary"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API ""LoadLibraryByName" (Indicator: "LoadLibrary"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp"), Found reference to API ""LoadLibraryHelper" (Indicator: "LoadLibrary"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API ".LoadLibraryCallbackStub" (Indicator: "LoadLibrary"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "FreeLibrary4GetFileAttributesExPrivate" (Indicator: "FreeLibrary"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "LoadLibraryEx" (Indicator: "LoadLibrary"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp")2b:Tf53,Found api reference "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found api reference "BCryptDestroyKey" (Indicator: "CryptDestroyKey"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found api reference "BCryptGenRandom" (Indicator: "BCryptGenRandom"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found api reference "BCryptGenRandom" (Indicator: "CryptGenRandom"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found api reference "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found api reference "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found api reference "BCryptGenerateSymmetricKey" (Indicator: "BCryptGenerateSymmetricKey"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found api reference "6BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found api reference "4BCryptGenerateSymmetricKey" (Indicator: "BCryptGenerateSymmetricKey"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found api reference "8BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found api reference "DecryptFileW" (Indicator: "DecryptFileW"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found api reference "EncryptFileW" (Indicator: "EncryptFileW"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found api reference "BCryptDecrypt" (Indicator: "BCryptDecrypt"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found api reference "BCryptDecrypt" (Indicator: "CryptDecrypt"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found api reference "6BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found api reference "4BCryptGenerateSymmetricKey" (Indicator: "BCryptGenerateSymmetricKey"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found api reference "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found api reference "BCryptDestroyKey" (Indicator: "CryptDestroyKey"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found api reference "8BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found api reference "DecryptFileW" (Indicator: "DecryptFileW"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found api reference "EncryptFileW" (Indicator: "EncryptFileW"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found api reference "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found api reference "BCryptGenRandom" (Indicator: "BCryptGenRandom"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found api reference "BCryptGenRandom" (Indicator: "CryptGenRandom"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found api reference "BCryptGenerateSymmetricKey" (Indicator: "BCryptGenerateSymmetricKey"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found api reference "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp")2c:Ta07,Found reference to API "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "BCryptGenerateSymmetricKey" (Indicator: "BCryptGenerateSymmetricKey"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "6BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "4BCryptGenerateSymmetricKey" (Indicator: "BCryptGenerateSymmetricKey"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "8BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "BCryptDecrypt" (Indicator: "BCryptDecrypt"; Source: "00000000-00005828-00000C2C-2174032236") Found reference to API "BCryptDecrypt" (Indicator: "BCryptDecrypt"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "6BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "4BCryptGenerateSymmetricKey" (Indicator: "BCryptGenerateSymmetricKey"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "8BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "BCryptGenerateSymmetricKey" (Indicator: "BCryptGenerateSymmetricKey"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp")2d:T13a6,Assembly shows XOR instruction xor rax rsp in Stream UID: 18091-3413-0000000140067A50 Assembly shows XOR instruction xor eax esp in Stream UID: 18091-3413-0000000140067A50 Assembly shows XOR instruction xor rcx rsp in Stream UID: 18091-3413-0000000140067A50 Assembly shows XOR instruction xor ecx esp in Stream UID: 18091-3413-0000000140067A50 Assembly shows XOR instruction xor rax rsp in Stream UID: 18091-3415-0000000140064A00 Assembly shows XOR instruction xor eax esp in Stream UID: 18091-3415-0000000140064A00 Assembly shows XOR instruction xor rcx rsp in Stream UID: 18091-3415-0000000140064A00 Assembly shows XOR instruction xor ecx esp in Stream UID: 18091-3415-0000000140064A00 Assembly shows XOR instruction xor rax rsp in Stream UID: 18091-3418-0000000140064AA0 Assembly shows XOR instruction xor eax esp in Stream UID: 18091-3418-0000000140064AA0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 18091-3418-0000000140064AA0 Assembly shows XOR instruction xor ecx esp in Stream UID: 18091-3418-0000000140064AA0 Assembly shows XOR instruction xor rax rsp in Stream UID: 18091-3573-0000000140002C20 Assembly shows XOR instruction xor eax esp in Stream UID: 18091-3573-0000000140002C20 Assembly shows XOR instruction xor rcx rsp in Stream UID: 18091-3573-0000000140002C20 Assembly shows XOR instruction xor ecx esp in Stream UID: 18091-3573-0000000140002C20 Assembly shows XOR instruction xor rax rsp in Stream UID: 18091-3760-00000001400124C0 Assembly shows XOR instruction xor eax esp in Stream UID: 18091-3760-00000001400124C0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 18091-3760-00000001400124C0 Assembly shows XOR instruction xor ecx esp in Stream UID: 18091-3760-00000001400124C0 Assembly shows XOR instruction xor rax rsp in Stream UID: 18091-3806-000000014000B100 Assembly shows XOR instruction xor eax esp in Stream UID: 18091-3806-000000014000B100 Assembly shows XOR instruction xor rcx rsp in Stream UID: 18091-3806-000000014000B100 Assembly shows XOR instruction xor ecx esp in Stream UID: 18091-3806-000000014000B100 Assembly shows XOR instruction xor rax rsp in Stream UID: 18091-3808-000000014000AEF0 Assembly shows XOR instruction xor eax esp in Stream UID: 18091-3808-000000014000AEF0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 18091-3808-000000014000AEF0 Assembly shows XOR instruction xor ecx esp in Stream UID: 18091-3808-000000014000AEF0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 18091-3974-000000014000C2DF Assembly shows XOR instruction xor ecx esp in Stream UID: 18091-3974-000000014000C2DF Assembly shows XOR instruction xor rcx rsp in Stream UID: 18091-4075-0000000140012147 Assembly shows XOR instruction xor ecx esp in Stream UID: 18091-4075-0000000140012147 Assembly shows XOR instruction xor rcx rsp in Stream UID: 18091-4077-0000000140012345 Assembly shows XOR instruction xor ecx esp in Stream UID: 18091-4077-0000000140012345 Assembly shows XOR instruction xor rax rsp in Stream UID: 18091-4096-0000000140012AFB Assembly shows XOR instruction xor eax esp in Stream UID: 18091-4096-0000000140012AFB Assembly shows XOR instruction xor rcx rsp in Stream UID: 18091-4096-0000000140012AFB Assembly shows XOR instruction xor ecx esp in Stream UID: 18091-4096-0000000140012AFB Assembly shows XOR instruction xor rax rsp in Stream UID: 18091-4809-0000000140064B92 Assembly shows XOR instruction xor eax esp in Stream UID: 18091-4809-0000000140064B92 Assembly shows XOR instruction xor rcx rsp in Stream UID: 18091-4814-000000014006668C Assembly shows XOR instruction xor ecx esp in Stream UID: 18091-4814-000000014006668C Assembly shows XOR instruction xor rcx rsp in Stream UID: 18091-5081-000000014006C3F4 Assembly shows XOR instruction xor ecx esp in Stream UID: 18091-5081-000000014006C3F4 Assembly shows XOR instruction xor rax rsp in Stream UID: 18091-5122-000000014006D6EE Assembly shows XOR instruction xor eax esp in Stream UID: 18091-5122-000000014006D6EE Assembly shows XOR instruction xor rcx rsp in Stream UID: 18091-5122-000000014006D6EE Assembly shows XOR instruction xor ecx esp in Stream UID: 18091-5122-000000014006D6EE Assembly shows XOR instruction xor qword ptr [rbp-10h] rax in Stream UID: 18091-11395-000000014006B5A1 Assembly shows XOR instruction xor dword ptr [rbp-10h] eax in Stream UID: 18091-11395-000000014006B5A1 Assembly shows XOR instruction xor rax qword ptr [rbp+18h] in Stream UID: 18091-11395-000000014006B5A1 Assembly shows XOR instruction xor eax dword ptr [rbp+18h] in Stream UID: 18091-11395-000000014006B5A1 Assembly shows XOR instruction xor rax qword ptr [rbp-10h] in Stream UID: 18091-11395-000000014006B5A1 Assembly shows XOR instruction xor eax dword ptr [rbp-10h] in Stream UID: 18091-11395-000000014006B5A1 Assembly shows XOR instruction xor rax rcx in Stream UID: 18091-11395-000000014006B5A1 Assembly shows XOR instruction xor eax ecx in Stream UID: 18091-11395-000000014006B5A12e:T635,Found reference to API "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "BCryptDestroyKey" (Indicator: "CryptDestroyKey"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "BCryptGenerateSymmetricKey" (Indicator: "BCryptGenerateSymmetricKey"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "4BCryptGenerateSymmetricKey" (Indicator: "BCryptGenerateSymmetricKey"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "$EncryptFilePrivate,DecryptFileFilePrivate" (Indicator: "DecryptFile"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "$EncryptFilePrivate,DecryptFileFilePrivate" (Indicator: "EncryptFile"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "Hg____PInvoke|9_0" (Indicator: "EncryptFile"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "Rg____PInvoke|11_0" (Indicator: "DecryptFile"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "DecryptFileW" (Indicator: "DecryptFile"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "EncryptFileW" (Indicator: "EncryptFile"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f")2f:T4bd,Found reference to API "$EncryptFilePrivate,DecryptFileFilePrivate" (Indicator: "DecryptFile"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "Rg____PInvoke|11_0" (Indicator: "DecryptFile"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "DecryptFileW" (Indicator: "DecryptFile"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "BCryptDecrypt" (Indicator: "BCryptDecrypt"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "BCryptDecrypt" (Indicator: "CryptDecrypt"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "$EncryptFilePrivate,DecryptFileFilePrivate" (Indicator: "DecryptFile"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "Rg____PInvoke|11_0" (Indicator: "DecryptFile"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "DecryptFileW" (Indicator: "DecryptFile"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp")30:T1137,Found XOR loop in file "sample.bin" at offset 1608728; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1622297; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1709788; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1726960; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1766080; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1828052; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1978773; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2041068; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 186289; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 436720; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 511837; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 519801; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 519814; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 526383; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 559036; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 559684; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 563153; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 563234; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 564345; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 569078; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 570137; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 570474; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 571577; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 571725; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 571795; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 589459; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 589545; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 601241; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 625385; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 625642; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 628561; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 827946; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 859498; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 896848; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 897557; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 926653; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 930202; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 938611; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 993940; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1145198; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1145297; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1145431; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1145530; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1564424; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1880170; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1902480; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2038244; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2055205; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1552492; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1573441; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1582561; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1599693; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1612748; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1669395; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1758964; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1949517; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1956534; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1970039; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2050869; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2056458; code bytes = 803031:Tb54,Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API ""GetLocaleInfoCore@" (Indicator: "GetLocaleInfo"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f"), Found reference to API ":GetLocaleInfoCoreUserOverride@" (Indicator: "GetLocaleInfo"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f"), Found reference to API "IcuGetLocaleInfo IcuGetTimeFormatString@" (Indicator: "GetLocaleInfo"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f"), Found reference to API "$GetLocaleInfoExInt" (Indicator: "GetLocaleInfo"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f"), Found reference to API "(NlsGetFirstDayOfWeek.GetLocaleInfoFromLCType" (Indicator: "GetLocaleInfo"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "*GetUserDefaultCulture.GetUserDefaultUICulture0GetUserDefaultLocaleName@" (Indicator: "GetUserDefaultLocaleName"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "&GetLocaleInfoString" (Indicator: "GetLocaleInfo"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "$IsPredefinedLocale GetLocaleInfoInt" (Indicator: "GetLocaleInfo"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API ""GetLocaleInfoCore@" (Indicator: "GetLocaleInfo"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp"), Found reference to API ":GetLocaleInfoCoreUserOverride@" (Indicator: "GetLocaleInfo"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp"), Found reference to API "IcuGetLocaleInfo IcuGetTimeFormatString@" (Indicator: "GetLocaleInfo"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp"), Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp"), Found reference to API "$GetLocaleInfoExInt" (Indicator: "GetLocaleInfo"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp"), Found reference to API "(NlsGetFirstDayOfWeek.GetLocaleInfoFromLCType" (Indicator: "GetLocaleInfo"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "*GetUserDefaultCulture.GetUserDefaultUICulture0GetUserDefaultLocaleName@" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "&GetLocaleInfoString" (Indicator: "GetLocaleInfo"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "$IsPredefinedLocale GetLocaleInfoInt" (Indicator: "GetLocaleInfo"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp")32:T634,Found reference to API "EnumTimeFormatsEx" (Indicator: "EnumTimeFormats"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "IcuGetLocaleInfo,IcuGetTimeFormatString@" (Indicator: "GetTimeFormat"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "*nativeEnumTimeFormats" (Indicator: "EnumTimeFormats"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "&InitCultureDataCore InitUserOverride$GetTimeFormatsCore@" (Indicator: "GetTimeFormat"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API ""EnumTimeFormatsEx" (Indicator: "EnumTimeFormats"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f"), Found reference to API "IcuGetLocaleInfo IcuGetTimeFormatString@" (Indicator: "GetTimeFormat"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp"), Found reference to API "*nativeEnumTimeFormats" (Indicator: "EnumTimeFormats"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp"), Found reference to API "&InitCultureDataCore InitUserOverride$GetTimeFormatsCore@" (Indicator: "GetTimeFormat"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp"), Found reference to API ""EnumTimeFormatsEx" (Indicator: "EnumTimeFormats"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "EnumTimeFormatsEx" (Indicator: "EnumTimeFormats"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp")33:T648,Found system information discovery API: "ExpandEnvironmentStringsW" in file "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f" Found system information discovery API: "GetSystemInfo" in file "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f" Found system information discovery API: "*RtlNtStatusToDosError" in file "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f" Found system information discovery API: "0NtQuerySystemInformation" in file "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f" Found system information discovery API: "NtQuerySystemInformation" in file "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f" Found system information discovery API: "RtlNtStatusToDosError" in file "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f" Found system information discovery API: "*RtlNtStatusToDosError" in "00000000-00005828.00000000.203500.F698D000.00000002.mdmp" Found system information discovery API: "0NtQuerySystemInformation" in "00000000-00005828.00000000.203500.F698D000.00000002.mdmp" Found system information discovery API: "NtQuerySystemInformation" in "00000000-00005828.00000000.203500.F698D000.00000002.mdmp" Found system information discovery API: "RtlNtStatusToDosError" in "00000000-00005828.00000000.203500.F698D000.00000002.mdmp" Found system information discovery API: "ExpandEnvironmentStringsW" in "00000000-00005828.00000000.203500.F698D000.00000002.mdmp" Found system information discovery API: "GetSystemInfo" in "00000000-00005828.00000000.203500.F698D000.00000002.mdmp"34:Tabe,"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005828) "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005828) "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0ac5b6fff7f0000000000000000000051ed7c71ff7f000000000000da0100000000000000000000d174770f202c00002a0000000000000050beebffda0100008fec7c71ff7f0000e0ac5b6fff7f0000e0ac5b6fff7f0000000000000000000000000000ff7f0000ffffff7fdd17000000000000000000000000000000000000d8ce4f6fff7f00002a0000000000000069c3086fff7f0000310000000000000008020000000000000c02000000000000110001100000000010f0b7ac4900000003a34370ff7f000010f0b7ac4900000000000000000000002b00000000000000000000000000000020b00e6fff7f0000b43f0d6fff7f0000e0ce4f6f (UID: 00000000-00005828) "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005828)35:T52a,Found reference to API "GetDynamicTimeZoneInformation" (Indicator: "GetDynamicTimeZoneInformation"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "GetTimeZoneInformation" (Indicator: "GetTimeZoneInformation"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API ":GetDynamicTimeZoneInformation" (Indicator: "GetDynamicTimeZoneInformation"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API ",GetTimeZoneInformation" (Indicator: "GetTimeZoneInformation"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API ":GetDynamicTimeZoneInformation" (Indicator: "GetDynamicTimeZoneInformation"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API ",GetTimeZoneInformation" (Indicator: "GetTimeZoneInformation"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "GetDynamicTimeZoneInformation" (Indicator: "GetDynamicTimeZoneInformation"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "GetTimeZoneInformation" (Indicator: "GetTimeZoneInformation"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp")36:T701,Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "RtlGetVersionEx" (Indicator: "GetVersion"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "@g____PInvoke|22_0" (Indicator: "GetVersion"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "OSVersion's call to GetVersionEx failed" (Indicator: "GetVersion"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "OSVersion's call to GetVersionEx failed." (Indicator: "GetVersion"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "RtlGetVersionEx" (Indicator: "GetVersion"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "@g____PInvoke|22_0" (Indicator: "GetVersion"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp")37:Tcd4,"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005828) "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005828) "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005828) "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005828) "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005828) "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005828) "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00005828) "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00005828) "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005828) "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005828) "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005828) "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005828) "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" called "GetProcAddress" with a parameter ShowWindow (UID: 00000000-00005828) "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" called "GetProcAddress" with a parameter SHGetKnownFolderPath (UID: 00000000-00005828) "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" called "GetProcAddress" with a parameter BCryptDecrypt (UID: 00000000-00005828) "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" called "GetProcAddress" with a parameter CreateProcessA (UID: 00000000-00005828) "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" called "GetProcAddress" with a parameter ZwUnmapViewOfSection (UID: 00000000-00005828) "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" called "GetProcAddress" with a parameter VirtualAllocEx (UID: 00000000-00005828) "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" called "GetProcAddress" with a parameter ZwWriteVirtualMemory (UID: 00000000-00005828) "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" called "GetProcAddress" with a parameter Wow64GetThreadContext (UID: 00000000-00005828) "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" called "GetProcAddress" with a parameter Wow64SetThreadContext (UID: 00000000-00005828)38:Tf34,Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "CreateThreadpoolIo" (Indicator: "CreateThread"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "$CreateThreadpoolIo" (Indicator: "CreateThread"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "Failed to get thread context GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "Failed to get thread context Wow64GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "Wow64GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "Wow64SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "*Wow64SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "SetThreadContext*Wow64GetThreadContext GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "SetThreadContext*Wow64GetThreadContext GetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "2RefreshCurrentProcessorId2ProcessorNumberSpeedCheck*UninlinedThreadStatic8CreateThreadLocalCountObject$get_SafeWaitHandle@" (Indicator: "CreateThread"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "BindHandle(FreeNativeOverlapped0GetNativeOverlappedStateLCreateThreadLocalCompletionCountObject" (Indicator: "CreateThread"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "$CreateThreadpoolIo" (Indicator: "CreateThread"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "CreateThreadpoolIo" (Indicator: "CreateThread"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp")39:T4b1,"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7fff58b40000 "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7fff6e7c0000 "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7fff6e7c0000 "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7fff6db80000 "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" loaded module "USER32.DLL" at base 7fff70a40000 "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" loaded module "SHELL32.DLL" at base 7fff6efd0000 "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" loaded module "NTDLL.DLL" at base 7fff71780000 "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 7fff6bed0000 "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 7fff6db600003a:T57a,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API ".LoadLibraryCallbackStub" (Indicator: "LoadLibrary"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "LoadLibraryEx" (Indicator: "LoadLibrary"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API ""LoadLibraryByName" (Indicator: "LoadLibrary"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp"), Found reference to API ""LoadLibraryHelper" (Indicator: "LoadLibrary"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API ".LoadLibraryCallbackStub" (Indicator: "LoadLibrary"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "LoadLibraryEx" (Indicator: "LoadLibrary"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp")3b:T969,"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\CONHOST.EXE"; Key: ""; Value: "") "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: ""; Value: "") "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\BAM"; Key: ""; Value: "") "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "") "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "")3c:T104b,"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "AGGRESSIVEMTATESTING"; Value: "") "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "ENABLEPERPROCESSSYSTEMDPI"; Value: "") "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "032894933FC40D5F1533C5F1056C3A5FD39F32E74B8620D72FF05BA7E6A5F45F"; Value: "") "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "")3d:T749,"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" trying to touch file "\Device\ConDrv\Server" "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" trying to touch file "\Device\ConDrv\\Reference" "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" trying to touch file "\Device\ConDrv\\Connect" "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" trying to touch file "\Device\ConDrv\\Input" "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" trying to touch file "\Device\ConDrv\\Output" "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" trying to touch file "C:\Windows\System32\apphelp.dll" "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" trying to touch file "C:\WINDOWS\SYSTEM32\apphelp.dll" "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" trying to touch file "C:\032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" trying to touch file "C:\Windows\System32\ntdll.dll" "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" trying to touch file "C:\Windows\System32\kernel32.dll" "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" trying to touch file "C:\Windows\System32\KernelBase.dll" "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" trying to touch file "C:\BCRYPT.DLL" "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" trying to touch file "C:\bcrypt.dll" "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" trying to touch file "C:\Windows\System32\bcrypt.dll"3e:T470,"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" trying to access non-existent file "C:\BCRYPT.DLL" "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" trying to access non-existent file "C:\bcrypt.dll" "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" trying to access non-existent file "C:\FLTLIB.DLL" "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" trying to access non-existent file "C:\MSVCP140.DLL" "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" trying to access non-existent file "C:\VCRUNTIME140.DLL" "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" trying to access non-existent file "C:\VCRUNTIME140_1.DLL" "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" trying to access non-existent file "C:\VCRUNTIME140_1.dll" "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" trying to access non-existent file "C:\CRYPTSP.DLL"3f:T673,Found registry query API: "RegEnumKeyExW" in file "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f" Found registry query API: "RegQueryValueExW" in file "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f" Found registry query API: "RegQueryInfoKeyW" in file "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f" Found registry query API: "RegOpenKeyExW" in file "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f" Found registry query API: "RegEnumValueW" in file "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f" Found registry query API: "RegOpenKeyEx" in "00000000-00005828.00000000.203500.F698D000.00000002.mdmp" Found registry query API: "RegEnumKeyEx" in "00000000-00005828.00000000.203500.F698D000.00000002.mdmp" Found registry query API: "RegEnumValue" in "00000000-00005828.00000000.203500.F698D000.00000002.mdmp" Found registry query API: "RegQueryInfoKey" in "00000000-00005828.00000000.203500.F698D000.00000002.mdmp" Found registry query API: "RegQueryValueEx" in "00000000-00005828.00000000.203500.F698D000.00000002.mdmp" Found registry query API: "RegEnumKeyExW" in "00000000-00005828.00000000.203500.F698D000.00000002.mdmp" Found registry query API: "RegEnumValueW" in "00000000-00005828.00000000.203500.F698D000.00000002.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00005828.00000000.203500.F698D000.00000002.mdmp" Found registry query API: "RegQueryInfoKeyW" in "00000000-00005828.00000000.203500.F698D000.00000002.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00005828.00000000.203500.F698D000.00000002.mdmp"40:T654,Found reference to API "GetWindowsAccountDomainSid" (Indicator: "GetWindowsAccountDomainSid"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "&GetTokenInformation" (Indicator: "GetTokenInformation"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "0NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "4GetWindowsAccountDomainSid" (Indicator: "GetWindowsAccountDomainSid"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "&GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "0NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "4GetWindowsAccountDomainSid" (Indicator: "GetWindowsAccountDomainSid"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "GetWindowsAccountDomainSid" (Indicator: "GetWindowsAccountDomainSid"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp")41:T484,Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "FindNextFile" (Indicator: "FindNextFile"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "FindClose,FindFirstFileExPrivate" (Indicator: "FindFirstFile"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "FindNextFile" (Indicator: "FindNextFile"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "FindClose,FindFirstFileExPrivate" (Indicator: "FindFirstFile"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp")42:Tad6,Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "GetCurrentProcessorNumberEx" (Indicator: "GetCurrentProcess"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "GetModuleHandle" (Indicator: "GetModuleHandle"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "6GetCurrentProcessorNumberEx" (Indicator: "GetCurrentProcess"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "GetModuleHandle" (Indicator: "GetModuleHandle"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "&GetForegroundWindow&GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "Sleep:SetThreadPoolWorkerThreadName2ResetThreadPoolThreadSlow2GetCurrentProcessorNumber@" (Indicator: "GetCurrentProcess"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "6GetCurrentProcessorNumberEx" (Indicator: "GetCurrentProcess"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "GetCurrentProcessorNumberEx" (Indicator: "GetCurrentProcess"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp")43:T488,Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "GetModuleHandle" (Indicator: "GetModuleHandle"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "GetModuleHandle" (Indicator: "GetModuleHandle"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp")44:Tcba,Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "FreeLibrary4GetFileAttributesExPrivate" (Indicator: "GetFileAttributes"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "4GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "8GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API ",NtQueryInformationFile" (Indicator: "QueryInformationFile"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "Rg____PInvoke|17_0" (Indicator: "QueryInformationFile"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "NtQueryInformationFile" (Indicator: "QueryInformationFile"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "FreeLibrary4GetFileAttributesExPrivate" (Indicator: "GetFileAttributes"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "4GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "8GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API ",NtQueryInformationFile" (Indicator: "QueryInformationFile"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "Rg____PInvoke|17_0" (Indicator: "QueryInformationFile"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "NtQueryInformationFile" (Indicator: "QueryInformationFile"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp")45:T4dc,Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "(LookupPrivilegeValue" (Indicator: "LookupPrivilegeValue"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "*AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "(LookupPrivilegeValue" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "*AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp")46:Tc10,Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "CreateWellKnownSid" (Indicator: "CreateWellKnownSid"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "GetWindowsAccountDomainSid" (Indicator: "GetWindowsAccountDomainSid"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "RevertToSelf" (Indicator: "RevertToSelf"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "GetSecurityDescriptorLength" (Indicator: "GetSecurityDescriptorLength"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "&GetTokenInformation" (Indicator: "GetTokenInformation"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "RevertToSelf.GetSecurityInfoByHandle" (Indicator: "RevertToSelf"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "$CreateWellKnownSid" (Indicator: "CreateWellKnownSid"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "4GetWindowsAccountDomainSid" (Indicator: "GetWindowsAccountDomainSid"; File: "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f") Found reference to API "&GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "RevertToSelf.GetSecurityInfoByHandle" (Indicator: "RevertToSelf"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "$CreateWellKnownSid" (Indicator: "CreateWellKnownSid"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "4GetWindowsAccountDomainSid" (Indicator: "GetWindowsAccountDomainSid"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "CreateWellKnownSid" (Indicator: "CreateWellKnownSid"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "GetSecurityDescriptorLength" (Indicator: "GetSecurityDescriptorLength"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "GetWindowsAccountDomainSid" (Indicator: "GetWindowsAccountDomainSid"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp") Found reference to API "RevertToSelf" (Indicator: "RevertToSelf"; Source: "00000000-00005828.00000000.203500.F698D000.00000002.mdmp")47:T481,Observed import api "CreateWellKnownSid" which can "create a SID for predefined aliases" [Source: 032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f] Observed import api "DuplicateToken" which can "create a new access token that duplicates one already in existence" [Source: 032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f] Observed import api "DuplicateTokenEx" which can "create a new access token that duplicates an existing token" [Source: 032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f] Observed import api "GetSecurityDescriptorLength" which can "return the length in bytes of a structurally valid security descriptor" [Source: 032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f] Observed import api "GetWindowsAccountDomainSid" which can "receive a security identifier (SID) and returns a SID representing the domain of that SID" [Source: 032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f] Observed import api "RevertToSelf" which can "terminate the impersonation of a client application" [Source: 032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f]48:T570,"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\REGEDIT.EXE"; Value: "") "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "") "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\SVCHOST.EXE"; Value: "") "032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\PROGRAM FILES (X86)\INTERNET EXPLORER\IEXPLORE.EXE"; Value: "")49:Tbe2,Found string "ReplaceFile" (Source: 032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f, API is part of module: KERNEL32.DLL) Found string "GetSecurityInfo" (Source: 032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f, API is part of module: ADVAPI32.DLL) Found string "SetSecurityInfo" (Source: 032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f, API is part of module: ADVAPI32.DLL) Found string "DecryptFileW" (Source: 032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f, API is part of module: ADVAPI32.DLL) Found string "EncryptFileW" (Source: 032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f, API is part of module: ADVAPI32.DLL) Found string "GetForegroundWindow" (Source: 032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f, API is part of module: USER32.DLL) Found string "GetNamedSecurityInfoW" (Source: 032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f, API is part of module: ADVAPI32.DLL) Found string "GetWindow" (Source: 032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f, API is part of module: USER32.DLL) Found string "GetWindowThreadProcessId" (Source: 032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f, API is part of module: USER32.DLL) Found string "NtQueryInformationFile" (Source: 032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f, API is part of module: NTDLL.DLL) Found string "NtQuerySystemInformation" (Source: 032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f, API is part of module: NTDLL.DLL) Found string "RegConnectRegistryW" (Source: 032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f, API is part of module: ADVAPI32.DLL) Found string "RtlGetVersion" (Source: 032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f, API is part of module: NTDLL.DLL) Found string "RtlNtStatusToDosError" (Source: 032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f, API is part of module: NTDLL.DLL) Found string "SHGetKnownFolderPath" (Source: 032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f, API is part of module: WINDOWS.STORAGE.DLL) Found string "SetNamedSecurityInfoW" (Source: 032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f, API is part of module: ADVAPI32.DLL) Found string "ShowWindow" (Source: 032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f, API is part of module: USER32.DLL) Found string "ZwUnmapViewOfSection" (Source: 032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f, API is part of module: NTDLL.DLL) Found string "ZwWriteVirtualMemory" (Source: 032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f, API is part of module: NTDLL.DLL) Found string "IsWow64Process2" (Source: 032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f, API is part of module: KERNELBASE.DLL) Found string "FlsFree" (Source: 032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f, API is part of module: KERNELBASE.DLL)4a:T400,AAABAAEAICAQPAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAMRERERERERERERERAAAAA5mZmZmZl5mZmZmZmRAAAAOZmZmZiZiYd5mZmZkQAAADmZmZmYh4mIeZmZmZEAAAA5mZmZmXl3mXmZmZmRAAAAd3d3d3d3d3d3d3d3cQAAAH////////////////cAAAB//4mY///////////3AAAAf/+ZiX//////////9wAAAH//iXiY//////////cAAAB///+ZeY/////////3AAAAf///+Jl/////////9wAAAH/////4mXj//4iP//cAAAB//////5l5mIeZmP/3AAAAf/////+J/4mZmZj/9wAAAH//////iY/4l4iP//cAAAB///////l/iZ/////3AAAAf//////4n5mP////9wAAAI//////+JeY//////cAAACP//////+Zn//////3AAAAj///////mY//////9wAAAI///////5n///////cAAACP//////iZ////+Ij3AAAAj//////3mY//iIiIgAAAAI//////+ZmP+P//+AAAAACP//////mZj/j//4AAAAAAj//////4mf////gAAAAAAI///////4////+AAAAAAACP///////////4AAAAAAAAj///////////gAAAAAAAAIiIiIiIiIiIiAAAAAAADgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAD+AAAB/gAAA/4AAAf+AAAP/gAAH/4AAD/w==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791199320147,"unified_at":"2026-10-05T11:22:00.147Z","metadata":{"hashes":{"sha256":"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f","sha1":"b9985a5558c671010b664a65ae5c5d7027e53dd8","md5":"592c2208a278f63bfe7e3983783c4c95","sha512":"ac4c2642f0a00f2637fd6c396847a296493a7b079d6951622d96baa3c8be354d7a6efa646b69baf20bbbfb6524ad1bf2c18ed484f9bd483c6caffc69b9323a7c","ssdeep":"49152:fwJvvL96MLtWUrX8+fwG2jH+c/LoxZ3SaYee6r3qHZP8lNrFOaXTkvZA:erscm8IaXyZ","ssdeep_chunks":["49152:fwJvvL9","49152:wJvvL96","49152:JvvL96M","49152:vvL96ML","49152:vL96MLt","49152:L96MLtW","49152:96MLtWU","49152:6MLtWUr","49152:MLtWUrX","49152:LtWUrX8","49152:tWUrX8+","49152:WUrX8+f","49152:UrX8+fw","49152:rX8+fwG","49152:X8+fwG2","49152:8+fwG2j","49152:+fwG2jH","49152:fwG2jH+","49152:wG2jH+c","49152:G2jH+c/","49152:2jH+c/L","49152:jH+c/Lo","49152:H+c/Lox","49152:+c/LoxZ","49152:c/LoxZ3","49152:/LoxZ3S","49152:LoxZ3Sa","49152:oxZ3SaY","49152:xZ3SaYe","49152:Z3SaYee","49152:3SaYee6","49152:SaYee6r","49152:aYee6r3","49152:Yee6r3q","49152:ee6r3qH","49152:e6r3qHZ","49152:6r3qHZP","49152:r3qHZP8","49152:3qHZP8l","49152:qHZP8lN","49152:HZP8lNr","49152:ZP8lNrF","49152:P8lNrFO","49152:8lNrFOa","49152:lNrFOaX","49152:NrFOaXT","49152:rFOaXTk","49152:FOaXTkv","49152:OaXTkvZ","49152:aXTkvZA","98304:fwJvvL9","98304:wJvvL96","98304:JvvL96M","98304:vvL96ML","98304:vL96MLt","98304:L96MLtW","98304:96MLtWU","98304:6MLtWUr","98304:MLtWUrX","98304:LtWUrX8","98304:tWUrX8+","98304:WUrX8+f","98304:UrX8+fw","98304:rX8+fwG","98304:X8+fwG2","98304:8+fwG2j","98304:+fwG2jH","98304:fwG2jH+","98304:wG2jH+c","98304:G2jH+c/","98304:2jH+c/L","98304:jH+c/Lo","98304:H+c/Lox","98304:+c/LoxZ","98304:c/LoxZ3","98304:/LoxZ3S","98304:LoxZ3Sa","98304:oxZ3SaY","98304:xZ3SaYe","98304:Z3SaYee","98304:3SaYee6","98304:SaYee6r","98304:aYee6r3","98304:Yee6r3q","98304:ee6r3qH","98304:e6r3qHZ","98304:6r3qHZP","98304:r3qHZP8","98304:3qHZP8l","98304:qHZP8lN","98304:HZP8lNr","98304:ZP8lNrF","98304:P8lNrFO","98304:8lNrFOa","98304:lNrFOaX","98304:NrFOaXT","98304:rFOaXTk","98304:FOaXTkv","98304:OaXTkvZ","98304:aXTkvZA","49152:erscm8I","49152:rscm8Ia","49152:scm8IaX","49152:cm8IaXy","49152:m8IaXyZ"],"imphash":"3c5d9fa090f96eb1572a4f10fd629a07"},"file_info":{"file_name":"CC-CREDIT CARD-itineraries.exe","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":2161664,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1721053821000,"last_seen":1789891252000,"last_multi_scan":1789891252000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["evasive"]},"stats":{"av":{"malicious_count":16,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":65},"sandbox_signatures":{"informative_count":148,"suspicious_count":15,"malicious_count":7,"total":170},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Injuke","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W64.MalwareX","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Generic.Dacic.3347.769B2C5B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Malware.Aotera-10060486-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Generic.Dacic.3347.769B2C5B (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/Formbook.AA trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Malware.Win64.Gen.vl!i","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Trojan/W64.Agent.fm","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005d43431 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"high_entropy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W64/Kryptik.GSA","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win64.Agent.GZJ","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.GenKryptik.Win64.40073","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Dacic.3347.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"tactic":"Impact","technique":"Disk Content Wipe","attack_id":"T1561.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1561/001","identifiers":[{"type":"informative","value":"Contains ability to format disks"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"suspicious","value":"Contains ability to create directories"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"suspicious","value":"Contains ability to modify processes thread functionality"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Contains ability to remove directories"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Contains ability to query local/system time as file time"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Contains ability to copy files (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Contains registry location strings"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to query machine time"},{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Able to retrieve machine time (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"suspicious","value":"Contains ability to retrieve volume information"},{"type":"suspicious","value":"Contains ability to retrieve a module handle"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to find logical drives of the machine (API string)"},{"type":"suspicious","value":"Contains ability to query CPU information"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to read software policies"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"YARA signature match - RSA algorithm (keys)"},{"type":"informative","value":"Able to utilize the Windows bcrypt cryptographic API"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"PE file contains zero-sized sections"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"},{"type":"informative","value":"Able to perform scheduled transfer (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","identifiers":[{"type":"suspicious","value":"Detected network traffic to commonly abused domain"}],"sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Imports system security related APIs"}],"sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Able to modify process memory (API string)"},{"type":"informative","value":"Found a thread hijacking injection call sequence"}],"sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"malicious","value":"Creates a system process in suspended mode (likely for process injection)"},{"type":"informative","value":"Contains ability to unmap view of a section from a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Contains ability to queue an Asynchronous Procedure Call (APC) in a remote process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"tactic":"Privilege Escalation","technique":"Make and Impersonate Token","attack_id":"T1134.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/003","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"tactic":"Defense Evasion","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Tries to detect debugger using ProcessDebugPort"}],"sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"suspicious","value":"Queries process mitigation policy via NtQueryInformationProcess"},{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Able to modify Windows Defender exclusions (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"tactic":"Defense Evasion","technique":"System Binary Proxy Execution","attack_id":"T1218","attack_id_wiki":"https://attack.mitre.org/techniques/T1218","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy resources"}],"sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"tactic":"Defense Evasion","technique":"Junk Code Insertion","attack_id":"T1027.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/016","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Contains ability to detect virtual environment (API)"}],"sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"tactic":"Credential Access","technique":"Input Capture","attack_id":"T1056","attack_id_wiki":"https://attack.mitre.org/techniques/T1056","identifiers":[{"type":"informative","value":"Contains ability to register/read input devices (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains references to file movement (imports API)"},{"type":"informative","value":"Contains ability to enumerates all mounted drives"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"}],"sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Calls an API used to retrieve process information"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"suspicious","value":"Contacts non-existent domain"},{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Contacts random domain names"}],"sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Calls an API used to open a process handle"}],"sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]}],"sandbox_signatures":[{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RSA algorithm (keys)","description":"YARA signature for RSA public and private key matched on file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1027","id":"yara-62","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – AOT compiled .NET binary","description":"YARA signature match – AOT compiled .NET binary file \"sample.bin\"","origin":"Static Analysis","id":"yara-628","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (On Sensor) detected file with high confidence","description":"\"Portable Executable (On Sensor) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-12","sources":[{"report_type":"qsp","report_id":""}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (Cloud) detected file with high confidence","description":"\"Portable Executable (Cloud) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-16","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zone\" in Source: sample.bin, \"System\\CurrentControlSet\\Control\\Nls\\Calendars\\Japanese\\Era\" in Source: sample.bin, \"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\UT\" in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-120","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"Found reference to API (Indicator: \"DeleteFile\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"CreateDirectory\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"SetFileTime\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"ReplaceFile\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"RemoveDirectory\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"CopyFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1074.001","id":"string-423","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"$CreateProcessClass[\" (Indicator: \"CreateProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-204","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFile6OpenHandleToWriteAttributes\" (Indicator: \"MoveFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1570","id":"string-322","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"General","name":"Contains ability to copy files (API string)","description":"Found reference to API \"CopyFile\" (Indicator: \"CopyFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1005","id":"string-449","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"https://aka.ms/globalizationinvariantmode\", Pattern match: \"https://aka.ms/nativeaot-compatibilit\", Heuristic match: \" .net\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://aka.ms\"","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-98","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"1.0.0.0\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFile\" (Indicator: \"DeleteFile\"; Source: \"sample.bin\"), Found reference to API \"0RemoveDirectoryRecursive\" (Indicator: \"RemoveDirectory\"; Source: \"sample.bin\"), Found reference to API \".RemoveDirectoryInternal\" (Indicator: \"RemoveDirectory\"; Source: \"sample.bin\"), Found reference to API \"RemoveDirectory\" (Indicator: \"RemoveDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.004","id":"string-308","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"System Security","name":"Contains ability to format disks","description":"Found string \"Format string can be only \"G\", \"g\", \"X\", \"x\", \"F\", \"f\", \"D\" or \"d\"\" (Indicator: \"format \"; Source: \"sample.bin\"), Found string \"Format of the executable (.exe) or library (.dll) is invalid\" (Indicator: \"format \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1561.001","id":"string-407","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"Found reference to API \"SeLockMemoryPrivilege\" (Indicator: \"SeLockMemoryPrivilege\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1548","id":"string-97","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimePreciseAsFileTim\" (Indicator: \"GetSystemTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1029","id":"string-365","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimePreciseAsFileTim\" (Indicator: \"GetSystemTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1124","id":"string-247","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"\"GetLastAccessTime GetLastWriteTime GetAttributeData\" (Indicator: \"GetLastAccessTime\"; Source: \"sample.bin\"), Found reference to API \"\"GetLastAccessTime GetLastWriteTime GetAttributeData\" (Indicator: \"GetLastWriteTime\"; Source: \"sample.bin\"), Found reference to API \"GetCreationTime\" (Indicator: \"GetCreationTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.006","id":"string-249","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"\"SetLastAccessTime SetLastWriteTime GetLogicalDrives\" (Indicator: \"SetLastAccessTime\"; Source: \"sample.bin\"), Found reference to API \"\"SetLastAccessTime SetLastWriteTime GetLogicalDrives\" (Indicator: \"SetLastWriteTime\"; Source: \"sample.bin\"), Found reference to API \"SetCreationTime\" (Indicator: \"SetCreationTime\"; Source: \"sample.bin\"), Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.006","id":"string-409","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to find logical drives of the machine (API string)","description":"Found reference to API \"\"SetLastAccessTime SetLastWriteTime GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-84","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify Windows Defender exclusions (Powershell command string)","description":"Found reference string \"Add-MpPreference -ExclusionPath $env:UserProfile\" (Indicator: \"add-mppreference\"; Source: \"00000000-00005828.00000000.203500.F698D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-980","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify process memory (API string)","description":"Found reference to API \"VirtualAllocExNuma\" (Indicator: \"VirtualAllocEx\"; File: \"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f\")\n Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00005828.00000000.203500.F698D000.00000002.mdmp\")\n Found reference to API \"VirtualAllocExNuma\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00005828.00000000.203500.F698D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","id":"string-439","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThreadToken\"; File: \"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f\")\n Found reference to API \"SetThreadToken\" (Indicator: \"SetThreadToken\"; File: \"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00005828.00000000.203500.F698D000.00000002.mdmp\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThreadToken\"; Source: \"00000000-00005828.00000000.203500.F698D000.00000002.mdmp\")\n Found reference to API \"SetThreadToken\" (Indicator: \"SetThreadToken\"; Source: \"00000000-00005828.00000000.203500.F698D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegFlushKey\" (Indicator: \"RegFlushKey\"; File: \"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f\")\n Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; File: \"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f\")\n Found reference to API \"RegSetValueEx\" (Indicator: \"RegSetValue\"; Source: \"00000000-00005828.00000000.203500.F698D000.00000002.mdmp\")\n Found reference to API \"RegFlushKey\" (Indicator: \"RegFlushKey\"; Source: \"00000000-00005828.00000000.203500.F698D000.00000002.mdmp\")\n Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; Source: \"00000000-00005828.00000000.203500.F698D000.00000002.mdmp\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00005828.00000000.203500.F698D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to unmap view of a section from a process (API string)","description":"Found reference to API \"ZwUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; File: \"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f\")\n Found reference to API \"(ZwUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00005828.00000000.203500.F698D000.00000002.mdmp\")\n Found reference to API \"ZwUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00005828.00000000.203500.F698D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.012","relevance":1,"id":"string-90","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"AesDecrypt\" (Indicator: \"Aes\"; File: \"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f\")\n Found reference to \"AesDecrypt\" (Indicator: \"Aes\"; Source: \"00000000-00005828.00000000.203500.F698D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-sized sections","description":"Raw size of \"hydrated\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Tries to detect debugger using ProcessDebugPort","description":"\"iexplore.exe queries ProcessDebugPort (UID: 2556)","origin":"API Call","mitre_attack_id":"T1622","relevance":5,"id":"api-238","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to utilize the Windows bcrypt cryptographic API","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-927","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$2d","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"Invalid assembly public key\" (Indicator: \"public key\"; File: \"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f\")\n Found string \"Invalid assembly public key.\" (Indicator: \"public key\"; Source: \"00000000-00005828.00000000.203500.F698D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.03845","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to perform AES/RC4 encryption (API string)\n Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Able to utilize the Windows bcrypt cryptographic API\n Matched sigs: Contains asymmetric cryptographic functions (API string)\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to perform decryption (API string)\n Matched sigs: Contains reference to cryptographic keys\n Matched sigs: References bcrypt module and functions (used for encryption/decryption)\n Matched sigs: Calls an API typically used to decrypt a block of data\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$30","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; File: \"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f\")\n Found reference to API \"\"SetLastAccessTime SetLastWriteTime GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; File: \"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f\"), Found reference to API \"\"SetLastAccessTime SetLastWriteTime GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00005828.00000000.203500.F698D000.00000002.mdmp\")\n Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00005828.00000000.203500.F698D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"0NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; File: \"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; File: \"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f\")\n Found reference to API \"0NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005828.00000000.203500.F698D000.00000002.mdmp\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005828.00000000.203500.F698D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"OSVersion's call to GetVersionEx failed.\" (Source: \"00000000-00005828.00000000.203500.F698D000.00000002.mdmp\")\n Found string \"get_OSVersion\" (Source: \"00000000-00005828.00000000.203500.F698D000.00000002.mdmp\")\n Found string \"GetOSVersion&get_SystemDirectory4GetEnvironmentVariableCoreLGetEnvironmentVariableCore_NoArrayPool\" (Source: \"00000000-00005828.00000000.203500.F698D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"0NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; File: \"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f\")\n Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; File: \"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f\")\n Found string \"0NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005828.00000000.203500.F698D000.00000002.mdmp\")\n Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005828.00000000.203500.F698D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005828.00000000.203500.F698D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatus\"; File: \"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatusEx\"; File: \"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatus\"; Source: \"00000000-00005828.00000000.203500.F698D000.00000002.mdmp\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatusEx\"; Source: \"00000000-00005828.00000000.203500.F698D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005828.00000000.203500.F698D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetUserPreferredUILanguages\" (Indicator: \"GetUserPreferredUILanguages\"; File: \"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f\")\n Found reference to API \"GetUserPreferredUILanguages\" (Indicator: \"GetUserPreferredUILanguages\"; Source: \"00000000-00005828.00000000.203500.F698D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00005828)\n \"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe\" called \"GlobalMemoryStatusEx\" with parameters (UID: 00000000-00005828)\n \"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00005828)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00005828)\n \"iexplore.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00002556)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005828)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$34","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API used to retrieve process information","description":"Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: 032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f]","origin":"Static Parser","mitre_attack_id":"T1057","relevance":5,"id":"static-189","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount64@KERNEL32.dll at 18091-3609-00000001400120F0\n GlobalMemoryStatusEx@KERNEL32.dll at 18091-3760-00000001400124C0\n GlobalMemoryStatusEx@KERNEL32.dll at 18091-4075-0000000140012147\n GlobalMemoryStatusEx@KERNEL32.dll at 18091-4077-0000000140012345","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process2\" (Indicator: \"IsWow64Process\"; File: \"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f\")\n Found reference to API \"IsWow64Process2\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00005828.00000000.203500.F698D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindNextFileW@KERNEL32.dll at 18091-11248-000000014006AA72","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerates all mounted drives","description":"GetLogicalDrives@KERNEL32.dll at 18091-11241-000000014006AB02","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-66","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"GetSystemTimeAsFileTime@KERNEL32.dll at 18091-11395-000000014006B5A1","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.dll at 18091-11395-000000014006B5A1","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"Found string \"set unknown\" (Indicator: \"set \"; File: \"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; File: \"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f\")\n Found reference to API \"GetWindowText\" (Indicator: \"GetWindowText\"; File: \"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f\")\n Found reference to API \"&GetForegroundWindow&GetCurrentProcessId\" (Indicator: \"GetForegroundWindow\"; Source: \"00000000-00005828.00000000.203500.F698D000.00000002.mdmp\")\n Found reference to API \"GetWindowText\" (Indicator: \"GetWindowText\"; Source: \"00000000-00005828.00000000.203500.F698D000.00000002.mdmp\")\n Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; Source: \"00000000-00005828.00000000.203500.F698D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$36","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; File: \"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f\")\n Found reference to API \"(GetVolumeInformation\" (Indicator: \"GetVolumeInformation\"; File: \"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f\")\n Found reference to API \"(GetVolumeInformation\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00005828.00000000.203500.F698D000.00000002.mdmp\")\n Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00005828.00000000.203500.F698D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"OpenProcessToken@ADVAPI32.dll at 18091-4096-0000000140012AFB\n OpenProcessToken@ADVAPI32.dll at 18091-11500-000000014006A940","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyExW\" in file \"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f\"\n Found registry modification API: \"RegConnectRegistryW\" in file \"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f\"\n Found registry modification API: \"$RegConnectRegistry\" in \"00000000-00005828.00000000.203500.F698D000.00000002.mdmp\"\n Found registry modification API: \"RegCreateKeyEx\" in \"00000000-00005828.00000000.203500.F698D000.00000002.mdmp\"\n Found registry modification API: \"Hg____PInvoke|1_0\" in \"00000000-00005828.00000000.203500.F698D000.00000002.mdmp\"\n Found registry modification API: \"RegConnectRegistryW\" in \"00000000-00005828.00000000.203500.F698D000.00000002.mdmp\"\n Found registry modification API: \"RegCreateKeyExW\" in \"00000000-00005828.00000000.203500.F698D000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; File: \"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f\")\n Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; Source: \"00000000-00005828.00000000.203500.F698D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005828.00000000.203500.F698D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe\" called \"CreateProcessA\" with parameter \"%WINDIR%\\regedit.exe\" - (UID: 00000000-00005828)\n \"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe\" called \"CreateProcessA\" with parameter \"%WINDIR%\\System32\\cmd.exe\" - (UID: 00000000-00005828)\n \"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe\" called \"CreateProcessA\" with parameter \"%WINDIR%\\System32\\svchost.exe\" - (UID: 00000000-00005828)\n \"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe\" called \"CreateProcessA\" with parameter \"%PROGRAMFILES%\\(x86)\\Internet Explorer\\iexplore.exe\" - (UID: 00000000-00005828)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"\"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005828)\n \"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005828)\n \"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe\" called \"LoadLibrary\" with a parameter user32.dll (UID: 00000000-00005828)\n \"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe\" called \"LoadLibrary\" with a parameter shell32.dll (UID: 00000000-00005828)\n \"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe\" called \"LoadLibrary\" with a parameter ntdll.dll (UID: 00000000-00005828)","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$37","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; File: \"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f\")\n Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00005828.00000000.203500.F698D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f\")\n Found reference to API \"\"CreateFilePrivate\" (Indicator: \"CreateFile\"; File: \"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f\"), Found reference to API \"CreateFile\" (Indicator: \"CreateFile\"; Source: \"00000000-00005828.00000000.203500.F698D000.00000002.mdmp\"), Found reference to API \"\"CreateFilePrivate\" (Indicator: \"CreateFile\"; Source: \"00000000-00005828.00000000.203500.F698D000.00000002.mdmp\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00005828.00000000.203500.F698D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"SleepEx@KERNEL32.dll at 18091-3517-0000000140012950\n WaitForSingleObject@KERNEL32.dll at 18091-3758-0000000140012CB0\n WaitForSingleObjectEx@KERNEL32.dll at 18091-3820-000000014006AC3A\n WaitForMultipleObjectsEx@KERNEL32.dll at 18091-3992-000000014000C8B7","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00005828.00000000.203500.F698D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryExW@KERNEL32.dll at 18091-3413-0000000140067A50\n LoadLibraryExW@KERNEL32.dll at 18091-3573-0000000140002C20","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00005828.00000000.203500.F698D000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00005828.00000000.203500.F698D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; File: \"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00005828.00000000.203500.F698D000.00000002.mdmp\")\n Found reference to API \",GenerateUniqueFileName0GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00005828.00000000.203500.F698D000.00000002.mdmp\")\n Found reference to API \"wShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00005828.00000000.203500.F698D000.00000002.mdmp\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00005828.00000000.203500.F698D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"General","name":"Contains references to file movement (imports API)","description":"Found MoveFileExW in import section (Source: 032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f)","origin":"Static Parser","mitre_attack_id":"T1083","relevance":1,"id":"static-205","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process iexplore.exe created mutex with name \"\\BaseNamedObjects\\J2RR056TX88-833B\"","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"y@system.gc.heapaffinitizeranges\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\" in Source: 00000000-00005828.00000000.203500.F698D000.00000002.mdmp\n \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\" in Source: 00000000-00005828.00000000.203500.F698D000.00000002.mdmp\n \"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\" in Source: 00000000-00005828.00000000.203500.F698D000.00000002.mdmp\n \"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\\" in Source: 00000000-00005828.00000000.203500.F698D000.00000002.mdmp\n \"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\UTC\" in Source: 00000000-00005828.00000000.203500.F698D000.00000002.mdmp\n \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" in Source: 00000000-00005828.00000000.203500.F698D000.00000002.mdmp\n \"System\\CurrentControlSet\\Control\\Nls\\Calendars\\Japanese\\Eras\" in Source: 00000000-00005828.00000000.203500.F698D000.00000002.mdmp","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"General","name":"Launches a browser","description":"Launches browser \"iexplore.exe\" (UID: 00000000-00002556)","origin":"Monitored Target","relevance":3,"id":"target-21","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$39","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 6D630000\n \"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 6DB80000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 704F0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f\" has an executable section named \".text\"\n \"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f\" has an executable section named \".managed\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f\" has an writable section named \"hydrated\"\n \"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f\" file has an entrypoint instructions - \"sub\trsp, 0x28,call\t0x14006b580,add\trsp, 0x28,jmp\t0x14006add8,int3\t,int3\t,jmp\t0x14006b90c,int3\t,int3\t,int3\t,sub\trsp, 0x28,mov\tr8, qword ptr [r9 + 0x38],mov\trcx, rdx,mov\trdx, r9,call\t0x14006af90,mov\teax, 1,add\trsp, 0x28,ret\t,int3\t,int3\t,int3\t,push\trbx,mov\tr11d, dword ptr [r8],mov\trbx, rdx,and\tr11d, 0xfffffff8,mov\tr9, rcx,test\tbyte ptr [r8], 4,mov\tr10, rcx,je\t0x14006afbb,mov\teax, dword ptr [r8 + 8],movsxd\tr10, dword ptr [r8 + 4],neg\teax,add\tr10, rcx,movsxd\trcx, eax,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f\" has high imagebase \"0x140000000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\regedit.exe\" [Source: 00000000-00005828-00000C46-824186964]\n Observed system executable string:\"%WINDIR%\\System32\\cmd.exe\" [Source: 00000000-00005828-00000C46-1433609420]\n Observed system executable string:\"%WINDIR%\\System32\\svchost.exe\" [Source: 00000000-00005828-00000C46-1945558684]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"regedit.exe\" (UID: 00000000-00002232) was launched with new environment variables: \"USERDNSDOMAIN=\"DESKTOP-FVVF82A\"\"\n Process \"regedit.exe\" (UID: 00000000-00002232) was launched with modified environment variables: \"NUMBER_OF_PROCESSORS\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"www.adoniil.com\"\n \"www.cm123453.xyz\"\n \"www.dynamologistics.net\"\n \"www.gzy42.top\"\n \"www.self.apartments\"\n \"www.sysui.top\"\n \"www.xaj1699l08ws8.shop\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"regedit.exe\" (UID: 00000000-00002232)\n Spawned process \"cmd.exe\" (UID: 00000000-00002328)\n Spawned process \"svchost.exe\" (UID: 00000000-00002452)\n Spawned process \"iexplore.exe\" (UID: 00000000-00002556)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"regedit.exe\" (UID: 00000000-00002232)\n Spawned process \"cmd.exe\" (UID: 00000000-00002328)\n Spawned process \"svchost.exe\" (UID: 00000000-00002452)\n Spawned process \"iexplore.exe\" (UID: 00000000-00002556)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to queue an Asynchronous Procedure Call (APC) in a remote process (API string)","description":"Found reference to API \"QueueUserAPC2\" (Indicator: \"QueueUserAPC\"; File: \"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f\")\n Found reference to API \"QueueUserAPC2\" (Indicator: \"QueueUserAPC\"; Source: \"00000000-00005828.00000000.203500.F698D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.004","relevance":1,"id":"string-255","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"Installation/Persistence","name":"Found a thread hijacking injection call sequence","description":"\"iexplore.exe\" (Thread: 2548) invoked a typical API call sequence (NtQuerySystemInformation -> NtOpenThread -> NtSuspendThread -> NtGetContextThread -> NtSetContextThread -> NtResumeThread)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":10,"id":"api-177","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$3b","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe\" queries basic process information of the \"C:\\032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe\" (UID: 5828)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$3c","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe\" reads file \"c:\\032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Contains ability to delay the execution of current thread\n Matched sigs: Contains ability to detect virtual environment (API)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$3d","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$3e","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"Found URL \"https://aka.ms/nativeaot-compatibility'\" - Source: \"00000000-00005828.00000000.203500.F698D000.00000002.mdmp\")\n Found URL \"https://aka.ms/nativeaot-compatibility(\" - Source: \"00000000-00005828.00000000.203500.F698D000.00000002.mdmp\")\n Found URL \"https://aka.ms/globalizationinvariantmode\" - Source: \"00000000-00005828.00000000.203500.F698D000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"www.dynamologistics.net\" has high entropy\n Contacted domain: \"www.xaj1699l08ws8.shop\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"RtlGetVersionEx\" (Indicator: \"RtlGetVersion\"; File: \"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f\")\n Found reference to API \"@g____PInvoke|22_0\" (Indicator: \"RtlGetVersion\"; File: \"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f\")\n Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; File: \"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f\")\n Found reference to API \"RtlGetVersionEx\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00005828.00000000.203500.F698D000.00000002.mdmp\")\n Found reference to API \"@g____PInvoke|22_0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00005828.00000000.203500.F698D000.00000002.mdmp\")\n Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00005828.00000000.203500.F698D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; File: \"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f\")\n Found reference to API \"\"SetLastAccessTime SetLastWriteTime GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; File: \"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f\"), Found reference to API \"\"SetLastAccessTime SetLastWriteTime GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00005828.00000000.203500.F698D000.00000002.mdmp\")\n Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00005828.00000000.203500.F698D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"$40","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"AesDecrypt\" (Indicator: \"aes\"; File: \"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f\")\n file/memory contains long string with (Indicator: \"aes\"; File: \"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f\")\n Found string \"AesDecrypt\" (Indicator: \"aes\"; Source: \"00000000-00005828.00000000.203500.F698D000.00000002.mdmp\")\n file/memory contains long string with (Indicator: \"aes\"; Source: \"00000000-00005828.00000000.203500.F698D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"$41","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$42","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00005828.00000000.203500.F698D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to register/read input devices (API string)","description":"Found reference to API \"keybd_event\" (Indicator: \"keybd_event\"; File: \"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f\")\n Found reference to API \"keybd_event\" (Indicator: \"keybd_event\"; Source: \"00000000-00005828.00000000.203500.F698D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056","relevance":1,"id":"string-403","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"$43","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f\")\n Found reference to API \"0GetProcAddressWithSuffix\" (Indicator: \"GetProcAddress\"; File: \"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00005828.00000000.203500.F698D000.00000002.mdmp\")\n Found reference to API \"0GetProcAddressWithSuffix\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00005828.00000000.203500.F698D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$44","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00005828.00000000.203500.F698D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; File: \"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f\")\n Found reference to API \",GetEnvironmentVariable4ExpandEnvironmentVariables\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00005828.00000000.203500.F698D000.00000002.mdmp\")\n Found reference to API \"GetOSVersion&get_SystemDirectory4GetEnvironmentVariableCoreLGetEnvironmentVariableCore_NoArrayPool\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00005828.00000000.203500.F698D000.00000002.mdmp\")\n Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00005828.00000000.203500.F698D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"00000000-00005828.00000000.203500.F698D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteKeyExW\" in file \"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f\"\n Found registry deletion API: \"RegDeleteTreeW\" in file \"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f\"\n Found registry deletion API: \"RegDeleteValueW\" in file \"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f\"\n Found registry deletion API: \"RegDeleteKeyEx\" in \"00000000-00005828.00000000.203500.F698D000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteTree\" in \"00000000-00005828.00000000.203500.F698D000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteValue\" in \"00000000-00005828.00000000.203500.F698D000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteKeyExW\" in \"00000000-00005828.00000000.203500.F698D000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteTreeW\" in \"00000000-00005828.00000000.203500.F698D000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteValueW\" in \"00000000-00005828.00000000.203500.F698D000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: 032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"$45","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f\")\n Found reference to API \"0SetFileAttributesPrivate\" (Indicator: \"SetFileAttributes\"; File: \"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f\")\n Found reference to API \"0SetFileAttributesPrivate\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00005828.00000000.203500.F698D000.00000002.mdmp\")\n Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00005828.00000000.203500.F698D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$46","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00005828.00000000.203500.F698D000.00000002.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00005828.00000000.203500.F698D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00005828.00000000.203500.F698D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CMD.EXE\"; Value: \"460A0039D648DD010000000000000000000000000200000000\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"$47","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$48","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"\"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CMD.EXE\"; Value: \"460A0039D648DD010000000000000000000000000200000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$49","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f\" has section name .rsrc with entropy \"7.509817507810195\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query CPU information","description":"cpuid at 18091-3476-00000001400458F0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":10,"id":"stream-13","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve a module handle","description":"GetModuleHandleW@KERNEL32.dll at 18091-3798-000000014000C730","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-121","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve volume information","description":"GetVolumeInformationW@KERNEL32.dll at 18091-2982-000000014006AB50","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-130","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"suspicious","category":"Environment Awareness","name":"Queries process mitigation policy via NtQueryInformationProcess","description":"\"C:\\032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe\" queried ProcessMitigationPolicy","origin":"API Call","mitre_attack_id":"T1497.001","relevance":1,"id":"api-323","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"15/24 Antivirus vendors marked sample as malicious (62% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"suspicious","category":"General","name":"Contains ability to create directories","description":"CreateDirectoryW@KERNEL32.dll at 18091-2987-000000014006A9FA","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1074.001","relevance":3,"id":"stream-102","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"suspicious","category":"General","name":"Contains ability to modify processes thread functionality","description":"SuspendThread@KERNEL32.dll at 18091-3573-0000000140002C20\n SetThreadContext@KERNEL32.dll at 18091-3865-000000014000CE70\n GetThreadContext@KERNEL32.dll at 18091-3866-000000014000C9A0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-129","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"suspicious","category":"General","name":"PE file has unusual entropy resources","description":"\"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f\" has resource with unusual entropy \"BINARY:7.999435052759728\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":5,"id":"static-92","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"suspicious","category":"Network Related","name":"Contacts non-existent domain","description":"Domain: \"www.cm123453.xyz\" uses a high-risk TLD and returned a failed connection\n Domain: \"www.dynamologistics.net\" uses a high-entropy naming patterns and returned a failed connection\n Domain: \"www.gzy42.top\" uses a high-risk TLD and returned a failed connection\n Domain: \"www.sysui.top\" uses a high-risk TLD and returned a failed connection\n Domain: \"www.xaj1699l08ws8.shop\" uses a high-entropy naming patterns and returned a failed connection","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-118","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"suspicious","category":"Network Related","name":"Contacts random domain names","description":"\"www.cm123453.xyz\" seems to be random\n \"www.xaj1699l08ws8.shop\" seems to be random","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-6","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"suspicious","category":"Network Related","name":"Detected network traffic to commonly abused domain","description":"Domain: \"www.cm123453.xyz\" possible high risk indicator. Domain uses TLD that is commonly abused for malicious purposes.\n Domain: \"www.gzy42.top\" possible high risk indicator. Domain uses TLD that is commonly abused for malicious purposes.\n Domain: \"www.sysui.top\" possible high risk indicator. Domain uses TLD that is commonly abused for malicious purposes.","origin":"Network Traffic","mitre_attack_id":"T1566","relevance":5,"id":"network-84","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"suspicious","category":"System Destruction","name":"Contains ability to remove directories","description":"RemoveDirectoryW@KERNEL32.dll at 18091-2968-000000014006ABB0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.004","relevance":3,"id":"stream-109","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f\" claimed CRC 2189894 while the actual is CRC 2201832","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegEnumKeyExW\n RegCreateKeyExW\n RegCloseKey\n RegDeleteKeyExW\n OpenProcessToken\n RegOpenKeyExW\n RegDeleteValueW\n CreateFileW\n DeleteFileW\n FindFirstFileExW\n CreateThreadpoolIo\n VirtualAllocExNuma\n VirtualAlloc\n TerminateProcess\n GetLogicalDrives\n GetModuleHandleA\n GetFileAttributesExW\n CreateThread\n Sleep\n WriteFile\n CopyFileExW\n GetTickCount64\n GetSystemDirectoryW\n UnhandledExceptionFilter\n FindNextFileW\n DeviceIoControl\n GetSystemInfo\n SleepEx\n GetModuleHandleW\n LoadLibraryExW\n GetModuleFileNameW\n IsDebuggerPresent\n GetThreadContext\n CreateProcessA\n SleepConditionVariableCS\n CreateDirectoryW\n GetModuleHandleExW\n GetProcAddress","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe\" called \"CreateProcessA\" with parameter \"%WINDIR%\\regedit.exe\" - (UID: 00000000-00005828)\n \"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe\" called \"CreateProcessA\" with parameter \"%WINDIR%\\System32\\cmd.exe\" - (UID: 00000000-00005828)\n \"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe\" called \"CreateProcessA\" with parameter \"%WINDIR%\\System32\\svchost.exe\" - (UID: 00000000-00005828)\n \"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe\" called \"CreateProcessA\" with parameter \"%PROGRAMFILES%\\(x86)\\Internet Explorer\\iexplore.exe\" - (UID: 00000000-00005828)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a system process in suspended mode (likely for process injection)","description":"\"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe\" called \"CreateProcessA\" with parameter \"%WINDIR%\\System32\\svchost.exe\" - (UID: 00000000-00005828)","origin":"API Call","mitre_attack_id":"T1055.012","relevance":10,"id":"api-134","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"15/24 Antivirus vendors marked sample as malicious (62% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]}],"incidents":[{"name":"Evasive","details_count":2,"details":[{"detail":"May check for the presence of a forensics/monitoring tool"},{"detail":"Contains ability to adjust token privileges"}],"sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 7 domains and 7 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]}],"intel_graph":{"map":{"Domain:www.adoniil.com":{"type":"Domain","value":"www.adoniil.com"},"Domain:www.cm123453.xyz":{"type":"Domain","value":"www.cm123453.xyz"},"Domain:www.dynamologistics.net":{"type":"Domain","value":"www.dynamologistics.net"},"Domain:www.gzy42.top":{"type":"Domain","value":"www.gzy42.top"},"Domain:www.self.apartments":{"type":"Domain","value":"www.self.apartments"},"Domain:www.sysui.top":{"type":"Domain","value":"www.sysui.top"},"Domain:www.xaj1699l08ws8.shop":{"type":"Domain","value":"www.xaj1699l08ws8.shop"},"File:032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f":{"type":"File","value":"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f"}},"chains":[{"id":"sandbox_network","root":"File:032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f","edges":[{"edge_kind":"contacted_domain","from_key":"File:032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f","to_key":"Domain:www.adoniil.com"},{"edge_kind":"contacted_domain","from_key":"File:032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f","to_key":"Domain:www.cm123453.xyz"},{"edge_kind":"contacted_domain","from_key":"File:032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f","to_key":"Domain:www.dynamologistics.net"},{"edge_kind":"contacted_domain","from_key":"File:032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f","to_key":"Domain:www.gzy42.top"},{"edge_kind":"contacted_domain","from_key":"File:032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f","to_key":"Domain:www.self.apartments"},{"edge_kind":"contacted_domain","from_key":"File:032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f","to_key":"Domain:www.sysui.top"},{"edge_kind":"contacted_domain","from_key":"File:032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f","to_key":"Domain:www.xaj1699l08ws8.shop"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":5,"spawned_processes_count":5,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":1,"imported_dlls_count":40,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":7,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["evasive"],"sample_flags":["Multi-Process","Network Traffic"],"sandbox_reports":[{"id":"6aaf92b30110e47a69076c96","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.GenKryptik.Win64","submit_name":"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f","analysis_start_time":"2026-09-20T08:00:52+00:00","indicators_count":{"informative":144,"suspicious":32,"malicious":5},"tags":["Multi-Process","Network Traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":[{"domain":"www.adoniil.com","ttl":900,"country":"-","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"domain":"www.cm123453.xyz","ttl":900,"country":"-","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"domain":"www.dynamologistics.net","ttl":900,"country":"-","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"domain":"www.gzy42.top","ttl":1800,"country":"-","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"domain":"www.self.apartments","ttl":1800,"country":"-","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"domain":"www.sysui.top","ttl":1800,"country":"-","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]},{"domain":"www.xaj1699l08ws8.shop","ttl":1800,"country":"-","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}],"processes":[{"pid":5828,"ppid":0,"name":"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe","command_line":"","sha256":"032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f","normalized_path":"C:\\032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f.exe","uid":"00000000-00005828","icon":"$4a"},{"pid":2232,"ppid":5828,"name":"regedit.exe","command_line":"","sha256":"33b0ed8a05fda2ba39e8aaa86b38cd289f412c7c1b04519016ba9a60a8ba0d61","normalized_path":"%WINDIR%\\regedit.exe","parent_uid":"00000000-00005828","uid":"00000000-00002232"},{"pid":2328,"ppid":5828,"name":"cmd.exe","command_line":"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00000000-00005828","uid":"00000000-00002328"},{"pid":2452,"ppid":5828,"name":"svchost.exe","command_line":"","sha256":"b868487f8edbd0571d30d89573f087bfeac3da190652344afd351b1868ea0f8b","normalized_path":"%WINDIR%\\System32\\svchost.exe","parent_uid":"00000000-00005828","uid":"00000000-00002452"},{"pid":2556,"ppid":5828,"name":"iexplore.exe","command_line":"","sha256":"6eda2f58189675e23011e5a39fcbfdd4aa8846feb99c5e347bbd3071f30bd5ed","normalized_path":"%PROGRAMFILES%\\(x86)\\Internet Explorer\\iexplore.exe","parent_uid":"00000000-00005828","uid":"00000000-00002556"}],"all_imported_dlls":["vcruntime140.dll","cryptsp.dll","msvcrt.dll","ole32.dll","combase.dll","gdi32full.dll","shell32.dll","windows.storage.dll","ntdll.dll","bcryptprimitives.dll","ws2_32.dll","fltLib.dll","SHCore.dll","wow64.dll","KernelBase.dll","msvcp_win.dll","imm32.dll","VxSSL64.dll","vcruntime140_1.dll","cfgmgr32.dll","profapi.dll","sspicli.dll","shlwapi.dll","kernel.appcore.dll","oleaut32.dll","kernel32.dll","sechost.dll","bcrypt.dll","user32.dll","win32u.dll","advapi32.dll","gdi32.dll","msvcp140.dll","ucrtbase.dll","apphelp.dll","powrprof.dll","wow64win.dll","wow64cpu.dll","cryptbase.dll","rpcrt4.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\BaseNamedObjects\\J2RR056TX88-833B","sources":[{"report_type":"sandbox","report_id":"6aaf92b30110e47a69076c96"}]}]}},"report_ids":{"sandbox_job_ids":["6aaf92b30110e47a69076c96"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Dacic.3347.Generic Sample 032894933fc4… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 032894933fc4…. Malware family: Dacic.3347.Generic. Threat score 100/100. 16/25 AV engines flagged this file. 7 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f"}],["$","meta","4",{"property":"og:title","content":"Malicious Dacic.3347.Generic Sample 032894933fc4… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 032894933fc4…. Malware family: Dacic.3347.Generic. Threat score 100/100. 16/25 AV engines flagged this file. 7 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/032894933fc40d5f1533c5f1056c3a5fd39f32e74b8620d72ff05ba7e6a5f45f"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Dacic.3347.Generic Sample 032894933fc4… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 032894933fc4…. Malware family: Dacic.3347.Generic. Threat score 100/100. 16/25 AV engines flagged this file. 7 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L4b","11",{}]]