24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 3c:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T483,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Zusy.Generic Sample 03360ea19dca… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 03360ea19dca…. Malware family: Zusy.Generic. Threat score 100/100. 10/25 AV engines flagged this file. 4 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/03360ea19dca17e9b7238f2272e865325f5c7b30e928535f725abfb72a57cc8f","keywords":["Malicious","Zusy.Generic","malware analysis","sandbox report","threat intelligence","03360ea19dca17e9b7238f2272e865325f5c7b30e928535f725abfb72a57cc8f"],"about":{"@type":"SoftwareApplication","name":"user0","applicationCategory":["peexe","assembly","executable"],"identifier":"03360ea19dca17e9b7238f2272e865325f5c7b30e928535f725abfb72a57cc8f","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Zusy.Generic","antivirusDetections":{"malicious":10,"total":25},"behavioralIndicators":{"malicious":4,"suspicious":10},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T1dfd,Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; File: "user0") Found reference to "CryptoStream" (Indicator: "CryptoStream"; File: "user0") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; File: "user0") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; File: "user0") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; File: "user0") Found reference to "System.Security.Cryptography.RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00005972.00000001.69970.05540000.00000004.mdmp, 00000000-00005972.00000002.71890.05540000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00005972.00000001.69970.05540000.00000004.mdmp, 00000000-00005972.00000002.71890.05540000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00005972.00000001.69970.05540000.00000004.mdmp, 00000000-00005972.00000002.71890.05540000.00000004.mdmp") Found reference to "System.Security.Cryptography.RSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "RSACng"; Source: "00000000-00005972.00000001.69970.05540000.00000004.mdmp, 00000000-00005972.00000002.71890.05540000.00000004.mdmp") Found reference to "System.Security.Cryptography.DSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "DSACng"; Source: "00000000-00005972.00000001.69970.05540000.00000004.mdmp, 00000000-00005972.00000002.71890.05540000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00005972.00000001.69970.05540000.00000004.mdmp, 00000000-00005972.00000002.71890.05540000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesManaged"; Source: "00000000-00005972.00000001.69970.05540000.00000004.mdmp, 00000000-00005972.00000002.71890.05540000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellman"; Source: "00000000-00005972.00000001.69970.05540000.00000004.mdmp, 00000000-00005972.00000002.71890.05540000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellmanCng"; Source: "00000000-00005972.00000001.69970.05540000.00000004.mdmp, 00000000-00005972.00000002.71890.05540000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsa"; Source: "00000000-00005972.00000001.69970.05540000.00000004.mdmp, 00000000-00005972.00000002.71890.05540000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsaCng"; Source: "00000000-00005972.00000001.69970.05540000.00000004.mdmp, 00000000-00005972.00000002.71890.05540000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00005972.00000001.69970.05540000.00000004.mdmp, 00000000-00005972.00000002.71890.05540000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00005972.00000001.69970.05540000.00000004.mdmp, 00000000-00005972.00000002.71890.05540000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00005972.00000001.69970.05540000.00000004.mdmp, 00000000-00005972.00000002.71890.05540000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00005972.00000001.69970.05540000.00000004.mdmp, 00000000-00005972.00000002.71890.05540000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00005972.00000001.69970.05540000.00000004.mdmp, 00000000-00005972.00000002.71890.05540000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00005972.00000001.69970.05540000.00000004.mdmp, 00000000-00005972.00000002.71890.05540000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512CryptoServiceProvider"; Source: "00000000-00005972.00000001.69970.05540000.00000004.mdmp, 00000000-00005972.00000002.71890.05540000.00000004.mdmp") Found reference to "RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00005972.00000001.69970.05540000.00000004.mdmp, 00000000-00005972.00000002.71890.05540000.00000004.mdmp") Found reference to "System.Security.Cryptography.HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00005972.00000001.69970.05540000.00000004.mdmp, 00000000-00005972.00000002.71890.05540000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00005972.00000001.69970.05540000.00000004.mdmp, 00000000-00005972.00000002.71890.05540000.00000004.mdmp") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00005972.00000001.69970.05540000.00000004.mdmp, 00000000-00005972.00000002.71890.05540000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384" (Indicator: "SHA384"; Source: "00000000-00005972.00000001.69970.05540000.00000004.mdmp, 00000000-00005972.00000002.71890.05540000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng" (Indicator: "SHA384"; Source: "00000000-00005972.00000001.69970.05540000.00000004.mdmp, 00000000-00005972.00000002.71890.05540000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider" (Indicator: "SHA384"; Source: "00000000-00005972.00000001.69970.05540000.00000004.mdmp, 00000000-00005972.00000002.71890.05540000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00005972.00000001.69970.05540000.00000004.mdmp, 00000000-00005972.00000002.71890.05540000.00000004.mdmp") Found reference to "SHA512" (Indicator: "SHA512"; Source: "00000000-00005972.00000001.69970.05540000.00000004.mdmp, 00000000-00005972.00000002.71890.05540000.00000004.mdmp")26:T558,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to perform encryption (API string) Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Calls an API typically used to encrypt data Matched sigs: Contains ability to decrypt/decode data Matched sigs: Contains ability to perform symmetric encryption (Dotnet) Matched sigs: Contains ability to perform symmetric decryption (Dotnet) Matched sigs: Calls an API typically to import cryptographic keys into a CSP Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: Contains ability to perform AES cryptographic operations (Dotnet) Matched sigs: Contains ability to perform symmetric crypto operations Matched sigs: Dotnet file contains encryption/decryption functions Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Contains reference to cryptographic keys Matched sigs: Calls an API typically used to decrypt data Matched sigs: Reads the cryptographic machine GUID Matched sigs: Contains ability to perform crypto operations Matched sigs: Contains ability to perform CryptoStream operations (Dotnet)27:T9d2,"user0.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000018000000246afc28932df573b0fefa00687d467758eefb00705df57380a4f05bfeffffff74edfb002248f47318edfb000000b27710eefb003b48f473e0df6b7708000000000000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff3400000000000000a0edfb000000000008000000000000000000000000000000000000000000000000000000dc6bfc2800000000e0edfb006992f176ffffffff34000000a0edfb0008000000000000000000b27710eefb002794f176a8edfb000b00000000000000f8edfb00 (UID: 00000000-00005972) "user0.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005972) "user0.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005972) "user0.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000b0d9fb0054d9fb00226e037700004305000000002d6e037759a9830e2d000000ecb75775d8d9fb000000ff0080793203282e3203020000008000000018d9fb000000ff009cd9fb0070c80477f5017179feffffff2d000000d0cc6675270000006cd9fb00856a05771c230a77acd9fb00f85f057708000000bb690477b2690477a1a9830e2d000000ecb7577527000000d0cc667580d9fb002d000000d0cc667527000000b0d9fb00856a05771c230a77f8d9fb007e8a6575ee8c6575738a65759717945e2d000000ecb7577527000000d0cc6675e4274305782743059717945ec0d9fb00fc52a375acdafb00e0846575573fce2bfeffffff738a6575 (UID: 00000000-00005972)28:T15e2,"user0.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005972) "user0.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005972) "user0.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005972) "user0.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005972) "user0.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005972) "user0.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00005972) "user0.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005972) "user0.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00005972) "user0.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00005972) "user0.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00005972) "user0.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005972) "user0.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00005972) "user0.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00005972) "user0.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00005972) "user0.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00005972) "user0.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00005972) "user0.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00005972) "user0.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00005972) "user0.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005972) "user0.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005972) "user0.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005972) "user0.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00005972) "user0.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00005972) "user0.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00005972) "user0.exe" called "LoadLibrary" with a parameter C:\shell32.dll (UID: 00000000-00005972) "user0.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005972) "user0.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005972) "user0.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00005972) "user0.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00005972) "user0.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00005972) "user0.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00005972) "user0.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005972) "user0.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005972) "user0.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00005972) "user0.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00005972) "user0.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00005972) "user0.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00005972) "user0.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00005972) "user0.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00005972) "user0.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00005972) "user0.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00005972) "user0.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00005972) "user0.exe" called "LoadLibrary" with a parameter advapi32 (UID: 00000000-00005972) "user0.exe" called "LoadLibrary" with a parameter C:\ntdll.dll (UID: 00000000-00005972) "user0.exe" called "LoadLibrary" with a parameter C:\msvcrt.dll (UID: 00000000-00005972) "user0.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00005972) "user0.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\\wminet_utils.dll (UID: 00000000-00005972) "user0.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00005972)29:T601e,"user0.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter IsUserAnAdmin (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter CreateMutex (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter CreateMutexW (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter WindowsCreateStringReference (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter IIDFromString (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter QueryUnbiasedInterruptTime (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter SetWaitableTimerEx (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter WSASocket (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter setsockopt (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter WSAEventSelect (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter ioctlsocket (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter closesocket (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter bind (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter WSARecv (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter CryptAcquireContext (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter CryptGetProvParam (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter CryptContextAddRef (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter CryptExportKey (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter CryptDuplicateKey (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter CryptSetKeyParam (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter CryptDecrypt (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter CryptEncrypt (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter RtlGetCompressionWorkSpaceSize (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter RtlCompressBuffer (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter memcmp (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter GetComputerName (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter GetComputerNameW (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter GetSystemDirectory (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter GetDiskFreeSpaceEx (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter GetDiskFreeSpaceExW (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter CoGetObjectContext (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter LoadLibrary (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter ResetSecurity (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter SetSecurity (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter BlessIWbemServices (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter BlessIWbemServicesObject (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter GetPropertyHandle (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter WritePropertyValue (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter Clone (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter VerifyClientKey (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter GetQualifierSet (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter Get (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter Put (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter Delete (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter GetNames (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter BeginEnumeration (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter Next (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter EndEnumeration (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter GetPropertyQualifierSet (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter GetObjectText (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter SpawnDerivedClass (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter SpawnInstance (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter CompareTo (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter GetPropertyOrigin (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter InheritsFrom (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter GetMethod (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter PutMethod (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter DeleteMethod (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter BeginMethodEnumeration (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter NextMethod (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter EndMethodEnumeration (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter GetMethodQualifierSet (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter GetMethodOrigin (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter QualifierSet_Get (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter QualifierSet_Put (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter QualifierSet_Delete (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter QualifierSet_GetNames (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter QualifierSet_BeginEnumeration (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter QualifierSet_Next (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter QualifierSet_EndEnumeration (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter GetCurrentApartmentType (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter GetDemultiplexedStub (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter CreateInstanceEnumWmi (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter CreateClassEnumWmi (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter ExecQueryWmi (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter ExecNotificationQueryWmi (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter PutInstanceWmi (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter PutClassWmi (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter CloneEnumWbemClassObject (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter ConnectServerWmi (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter GetErrorInfo (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter Initialize (UID: 00000000-00005972) "user0.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00005972)2a:Tb64,Found reference to API (Indicator: "LocalAlloc"; File: "user0") Found reference to API (Indicator: "GetWindowThreadProcessId"; File: "user0") Found reference to API (Indicator: "LocalFree"; File: "user0") Found reference to API (Indicator: "CloseHandle"; File: "user0") Found reference to API (Indicator: "GetTempFileName"; File: "user0") Found reference to API (Indicator: "RtlGetCompressionWorkSpaceSize"; File: "user0") Found reference to API (Indicator: "GetWindowTextLength"; File: "user0") Found reference to API (Indicator: "RtlCompressBuffer"; File: "user0") Found reference to API (Indicator: "RtlDecompressBuffer"; File: "user0") Found reference to API (Indicator: "GetCurrentProcess"; File: "user0") Found reference to API (Indicator: "GetWindowText"; File: "user0") Found reference to API (Indicator: "GetForegroundWindow"; File: "user0") Found reference to API (Indicator: "CreateDirectory"; File: "user0") Found reference to API (Indicator: "GetCurrentDirectory"; File: "user0") Found reference to API (Indicator: "GetErrorInfo"; Source: "00000000-00005972.00000001.69970.05540000.00000004.mdmp, 00000000-00005972.00000002.71890.05540000.00000004.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00005972.00000002.71890.00E12000.00000002.mdmp") Found reference to API (Indicator: "GetWindowThreadProcessId"; Source: "00000000-00005972.00000002.71890.00E12000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00005972.00000002.71890.00E12000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00005972.00000002.71890.00E12000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileName"; Source: "00000000-00005972.00000002.71890.00E12000.00000002.mdmp") Found reference to API (Indicator: "RtlGetCompressionWorkSpaceSize"; Source: "00000000-00005972.00000002.71890.00E12000.00000002.mdmp") Found reference to API (Indicator: "GetWindowTextLength"; Source: "00000000-00005972.00000002.71890.00E12000.00000002.mdmp") Found reference to API (Indicator: "RtlCompressBuffer"; Source: "00000000-00005972.00000002.71890.00E12000.00000002.mdmp") Found reference to API (Indicator: "RtlDecompressBuffer"; Source: "00000000-00005972.00000002.71890.00E12000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00005972.00000002.71890.00E12000.00000002.mdmp") Found reference to API (Indicator: "GetWindowText"; Source: "00000000-00005972.00000002.71890.00E12000.00000002.mdmp") Found reference to API (Indicator: "GetForegroundWindow"; Source: "00000000-00005972.00000002.71890.00E12000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectory"; Source: "00000000-00005972.00000002.71890.00E12000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectory"; Source: "00000000-00005972.00000002.71890.00E12000.00000002.mdmp")2b:Tcfc,"SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: user0 "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" in Source: 6000088-Utilsc__DisplayClass13_0~RemoveStartupb__0 "\REGISTRY\MACHINE\Software\Microsoft\WindowsRuntime" in Source: 00000000-00005972.00000000.68053.032C0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00005972.00000000.68053.032C0000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\Windo\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1BE1F766-5536-11D1-B72" in Source: 00000000-00005972.00000000.68053.032C0000.00000004.mdmp 00000000-00005972.00000001.69970.032C0000.00000004.mdmp 00000000-00005972.00000002.71890.032C0000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" in Source: 00000000-00005972.00000001.69970.032C0000.00000004.mdmp 00000000-00005972.00000002.71890.032C0000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00005972.00000001.69970.05540000.00000004.mdmp 00000000-00005972.00000002.71890.05540000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00005972.00000001.69970.05540000.00000004.mdmp 00000000-00005972.00000002.71890.05540000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\XML" in Source: 00000000-00005972.00000001.69970.05540000.00000004.mdmp 00000000-00005972.00000002.71890.05540000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00005972.00000001.69970.05540000.00000004.mdmp 00000000-00005972.00000002.71890.05540000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00005972.00000001.69970.05540000.00000004.mdmp 00000000-00005972.00000002.71890.05540000.00000004.mdmp "SOFTWARE\Microsoft\Wind" in Source: 00000000-00005972.00000001.69970.05540000.00000004.mdmp 00000000-00005972.00000002.71890.05540000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00005972.00000001.69970.05540000.00000004.mdmp 00000000-00005972.00000002.71890.05540000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00005972.00000001.69970.05540000.00000004.mdmp 00000000-00005972.00000002.71890.05540000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00005972.00000001.69970.05540000.00000004.mdmp 00000000-00005972.00000002.71890.05540000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00005972.00000001.69970.05540000.00000004.mdmp 00000000-00005972.00000002.71890.05540000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00005972.00000001.69970.05540000.00000004.mdmp 00000000-00005972.00000002.71890.05540000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00005972.00000001.69970.05540000.00000004.mdmp 00000000-00005972.00000002.71890.05540000.00000004.mdmp2c:T5a1,"user0.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "user0.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "user0.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "user0.exe" failed to load missing module "C:\shell32.dll" - [base:0; Status:c0000135] "user0.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "user0.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "user0.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "user0.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "user0.exe" failed to load missing module "C:\ntdll.dll" - [base:0; Status:c0000135] "user0.exe" failed to load missing module "C:\msvcrt.dll" - [base:0; Status:c0000135] "user0.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135]2d:T1213,"user0.exe" loaded module "KERNEL32" at base 745c0000 "user0.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 76e10000 "user0.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 76e10000 "user0.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 76e10000 "user0.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 77b50000 "user0.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76e10000 "user0.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76e10000 "user0.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76e10000 "user0.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73ee0000 "user0.exe" loaded module "ADVAPI32.DLL" at base 77a00000 "user0.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 731c0000 "user0.exe" loaded module "SHLWAPI.DLL" at base 775c0000 "user0.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 779f0000 "user0.exe" loaded module "VERSION.DLL" at base 742c0000 "user0.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 72a10000 "user0.exe" loaded module "USER32.DLL" at base 74f40000 "user0.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 76e10000 "user0.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "user0.exe" loaded module "MSCOREE.DLL" at base 73280000 "user0.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 74690000 "user0.exe" loaded module "PSAPI.DLL" at base 76c40000 "user0.exe" loaded module "KERNEL32.DLL" at base 745c0000 "user0.exe" loaded module "RPCRT4.DLL" at base 76c50000 "user0.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 71530000 "user0.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "user0.exe" loaded module "OLE32.DLL" at base 76890000 "user0.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "user0.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 74690000 "user0.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 76e10000 "user0.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 714a0000 "user0.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 70a40000 "user0.exe" loaded module "C:\SHELL32.DLL" at base 0 "user0.exe" loaded module "SHELL32.DLL" at base 75550000 "user0.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\COMBASE.DLL" at base 0 "user0.exe" loaded module "COMBASE.DLL" at base 74690000 "user0.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 74690000 "user0.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 0 "user0.exe" loaded module "NTDLL.DLL" at base 77b80000 "user0.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 70220000 "user0.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 70110000 "user0.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 6f990000 "user0.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "user0.exe" loaded module "BCRYPT.DLL" at base 73310000 "user0.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 6f940000 "user0.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WS2_32.DLL" at base 0 "user0.exe" loaded module "WS2_32.DLL" at base 77980000 "user0.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 73f80000 "user0.exe" loaded module "ADVAPI32" at base 77a00000 "user0.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 76b90000 "user0.exe" loaded module "C:\NTDLL.DLL" at base 0 "user0.exe" loaded module "C:\MSVCRT.DLL" at base 0 "user0.exe" loaded module "MSVCRT.DLL" at base 76ff0000 "user0.exe" loaded module "SSPICLI.DLL" at base 745a0000 "user0.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\\WMINET_UTILS.DLL" at base 6f910000 "user0.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\VERSION.DLL" at base 02e:T482,"user0" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"2f:Tbc4,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00005972-00000C25-49634566] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00005972-00000C25-50212014] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00005972-00000C25-50412947] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00005972-00000C25-50576755] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00005972-00000C25-50809180] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00005972-00000C25-50901213] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00005972-00000C25-51060249] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00005972-00000C25-51297449] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00005972-00000C25-51571875] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00005972-00000C25-51996661] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00005972-00000C25-52205360] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00005972-00000C25-57325389] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" [Source: 00000000-00005972-00000C25-57384797] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00005972-00000C25-57474673] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00005972-00000C25-57698735] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" [Source: 00000000-00005972-00000C25-58007385] Observed system executable string:"%WINDIR%\system32\en-US\tzres.dll.mui" [Source: 00000000-00005972-00000C25-58475752] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\\wminet_utils.dll" [Source: 00000000-00005972-00000C25-59523240] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" [Source: 00000000-00005972-00000C25-59599384]30:T88c,"user0.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CMF\CONFIG"; Key: ""; Value: "") "user0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME"; Key: ""; Value: "") "user0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: ""; Value: "") "user0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS"; Key: ""; Value: "") "user0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}"; Key: ""; Value: "") "user0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\PROPERTYBAG"; Key: ""; Value: "") "user0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\CRYPTOGRAPHY\DEFAULTS\PROVIDER\MICROSOFT ENHANCED RSA AND AES CRYPTOGRAPHIC PROVIDER"; Key: ""; Value: "") "user0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY"; Key: ""; Value: "") "user0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\CRYPTOGRAPHY\OFFLOAD"; Key: ""; Value: "") "user0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\CRYPTOGRAPHY\DESHASHSESSIONKEYBACKWARD"; Key: ""; Value: "") "user0.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\HVSI"; Key: ""; Value: "") "user0.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CRYPTOGRAPHY\PROVIDERS"; Key: ""; Value: "") "user0.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CRYPTOGRAPHY\CONFIGURATION"; Key: ""; Value: "") "user0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\V4.0_POLICY.4.0.SYSTEM.MANAGEMENT__B03F5F7F11D50A3A"; Key: ""; Value: "") "user0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\POLICY.4.0.SYSTEM.MANAGEMENT__B03F5F7F11D50A3A"; Key: ""; Value: "")31:Tbf2,"user0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CMF\CONFIG"; Key: "SYSTEM"; Value: "") "user0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME"; Key: "TZI"; Value: "") "user0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "FIRSTENTRY"; Value: "") "user0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "LASTENTRY"; Value: "") "user0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "2006"; Value: "") "user0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "2007"; Value: "") "user0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME"; Key: "MUI_DISPLAY"; Value: "") "user0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME"; Key: "MUI_STD"; Value: "") "user0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME"; Key: "MUI_DLT"; Value: "") "user0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}"; Key: "CATEGORY"; Value: "") "user0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}"; Key: "NAME"; Value: "") "user0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}"; Key: "PARENTFOLDER"; Value: "") "user0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}"; Key: "DESCRIPTION"; Value: "") "user0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}"; Key: "RELATIVEPATH"; Value: "") "user0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}"; Key: "PARSINGNAME"; Value: "") "user0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}"; Key: "INFOTIP"; Value: "") "user0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}"; Key: "LOCALIZEDNAME"; Value: "")32:T969,"user0.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "user0.exe" trying to access non-existent file "C:\FLTLIB.DLL" "user0.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\CLR.DLL" "user0.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\MSCORWKS.DLL" "user0.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\CLR.DLL" "user0.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\MSCORWKS.DLL" "user0.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CLR.DLL" "user0.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.DLL" "user0.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.dll" "user0.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\UCRTBASE_CLR0400.DLL" "user0.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ucrtbase_clr0400.dll" "user0.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSCOREE.DLL" "user0.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" "user0.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\OLE32.DLL" "user0.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ole32.dll" "user0.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "user0.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "user0.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" "user0.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" "user0.exe" trying to access non-existent file "C:\SHELL32.DLL" "user0.exe" trying to access non-existent file "C:\shell32.dll" "user0.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\COMBASE.DLL" "user0.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll"33:T52f,"user0.exe" trying to access non-existent file "C:\Windows\SysWOW64\MSCOREE.DLL.LOCAL" "user0.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\MSCOREE.DLL.local" "user0.exe" trying to access non-existent file "C:\USER0.EXE.CONFIG" "user0.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC" "user0.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" "user0.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\USER0.EXE.LOG" "user0.exe" trying to access non-existent file "C:\user0.exe.config" "user0.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\XENO RAT CLIENT" "user0.exe" trying to access non-existent file "C:\USER0.INI" "user0.exe" trying to access non-existent file "C:\user0.INI" "user0.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "user0.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\SYSTEM.MANAGEMENT.INI" "user0.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.INI"34:T4e9,Observed Namespace "System.Net.Sockets.Socket" and MemberReference "get_Connected" in "user0" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "BeginDisconnect" in "user0" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "EndDisconnect" in "user0" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Close" in "user0" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Dispose" in "user0" Observed Namespace "System.Net.Sockets.Socket" and MemberReference ".ctor" in "user0" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "get_RemoteEndPoint" in "user0" Observed Namespace "System.Net.Sockets.SocketTaskExtensions" and MemberReference "ConnectAsync" in "user0" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "set_NoDelay" in "user0" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "set_ReceiveTimeout" in "user0" Observed Namespace "System.Net.Sockets.SocketTaskExtensions" and MemberReference "ReceiveAsync" in "user0" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "get_Available" in "user0" Observed Namespace "System.Net.Sockets.SocketTaskExtensions" and MemberReference "SendAsync" in "user0"35:T123f,Pattern match: "http://schemas.microsoft.com/windows/2004/02/mit/task" Pattern match: "Microsoft.NET/Framework/v4.0.30319/" Heuristic match: "e4e012a\mscorlib.ni" Pattern match: "http://www.w3.org/2001/XMLSchema-instance" Heuristic match: "l.iqx.iq" Pattern match: "http://go.microsoft.com/fwlink/?LinkId=42127" Pattern match: "http://www.w3.org/2000/09/xmldsig#dsa-sha1" Pattern match: "http://www.w3.org/2000/09/xmldsig#rsa-sha1" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha512" Pattern match: "http://www.w3.org/2000/09/xmldsig#sha1" Pattern match: "http://www.w3.org/2001/04/xmlenc#sha256" Pattern match: "http://www.w3.org/2001/04/xmlenc#sha512" Pattern match: "http://www.w3.org/2001/04/xmlenc#ripemd160" Pattern match: "http://www.w3.org/2001/04/xmlenc#des-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#tripledes-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-tripledes" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes128-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes128" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes192-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes192" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes256-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes256" Pattern match: "http://www.w3.org/TR/2001/REC-xml-c14n-20010315" Pattern match: "http://www.w3.org/TR/2001/REC-xml-c14n-20010315#WithComments" Pattern match: "http://www.w3.org/2001/10/xml-exc-c14n#" Pattern match: "http://www.w3.org/2001/10/xml-exc-c14n#WithComments" Pattern match: "http://www.w3.org/2000/09/xmldsig#base64" Pattern match: "http://www.w3.org/TR/1999/REC-xpath-19991116" Pattern match: "http://www.w3.org/TR/1999/REC-xslt-19991116" Pattern match: "http://www.w3.org/2000/09/xmldsig#enveloped-signature" Pattern match: "http://www.w3.org/2002/07/decrypt#XML" Pattern match: "http://www.w3.org/2000/09/xmldsig#" Pattern match: "http://www.w3.org/2001/04/xmlenc#" Pattern match: "http://www.w3.org/2000/09/xmldsig#hmac-sha1" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#md5" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-md5" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-ripemd160" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha256" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha512" Pattern match: "http://www.w3.org/2000/xmlns/" Pattern match: "http://www.w3.org/XML/1998/namespace" Pattern match: "http://schemas.microsoft.com/.NetConfiguration/v2.0" Pattern match: "system.web/anonymousIdentification" Pattern match: "system.web/authentication" Pattern match: "system.web/authorization" Pattern match: "system.web/browserCaps" Pattern match: "system.web/clientTarget" Pattern match: "system.web/compilation" Pattern match: "system.web/customErrors" Pattern match: "system.web/deployment" Pattern match: "system.web/deviceFilters" Pattern match: "system.web/fullTrustAssemblies" Pattern match: "system.web/globalization" Pattern match: "system.web/healthMonitoring" Pattern match: "system.web/hostingEnvironment" Pattern match: "system.web/httpCookies" Pattern match: "system.web/httpHandlers" Pattern match: "system.web/httpModules" Pattern match: "system.web/httpRuntime" Pattern match: "system.web/identity" Pattern match: "system.web/machineKey" Pattern match: "system.web/membership" Pattern match: "system.web/mobileControls" Pattern match: "system.web/pages" Pattern match: "system.web/partialTrustVisibleAssemblies" Pattern match: "system.web/processModel" Pattern match: "system.web/profile" Pattern match: "system.web/protocols" Pattern match: "system.web/roleManager" Pattern match: "system.web/securityPolicy" Pattern match: "system.web/sessionPageState" Pattern match: "system.web/sessionState" Pattern match: "system.web/siteMap" Pattern match: "system.web/trace" Pattern match: "system.web/trust" Pattern match: "system.web/urlMappings" Pattern match: "system.web/webControls" Pattern match: "system.web/webParts" Pattern match: "system.web/webServices" Pattern match: "system.web/xhtmlConformance" Pattern match: "system.web/caching" Pattern match: "system.web/caching/cache" Pattern match: "system.web/caching/outputCache" Pattern match: "system.web/caching/outputCacheSettings" Pattern match: "system.web/caching/sqlCacheDependency"36:T924,"user0.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00005972) "user0.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00005972) "user0.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00005972) "user0.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00005972) "user0.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00005972) "user0.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00005972) "user0.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00005972) "user0.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00005972) "user0.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00005972) "user0.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00005972) "user0.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00005972) "user0.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00005972) "user0.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00005972) "user0.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00005972) "user0.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00005972) "user0.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00005972) "user0.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00005972) "user0.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00005972) "user0.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00005972) "user0.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00005972) "user0.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00005972) "user0.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00005972) "user0.exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00005972) "user0.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00005972)37:T1b0a,Found string "CryptoStreamMode" (Indicator: "cryptostream"; File: "user0") Found string "CryptoStreamMode" (Indicator: "cryptostreammode"; File: "user0") Found string "CryptoStream" (Indicator: "cryptostream"; File: "user0") Found string "MD5CryptoServiceProvider" (Indicator: "md5cryptoserviceprovider"; File: "user0") Found string "CreateDecryptor" (Indicator: "createdecryptor"; File: "user0") Found string "CreateEncryptor" (Indicator: "createencryptor"; File: "user0") Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; File: "user0") Found string "OFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00005972.00000001.69970.032C0000.00000004.mdmp, 00000000-00005972.00000002.71890.032C0000.00000004.mdmp") Found string "icrosoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00005972.00000001.69970.032C0000.00000004.mdmp, 00000000-00005972.00000002.71890.032C0000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00005972.00000001.69970.032C0000.00000004.mdmp, 00000000-00005972.00000001.69970.05540000.00000004.mdmp, 00000000-00005972.00000002.71890.032C0000.00000004.mdmp, 00000000-00005972.00000002.71890.05540000.00000004.mdmp") Found string "SA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00005972.00000001.69970.032C0000.00000004.mdmp, 00000000-00005972.00000002.71890.032C0000.00000004.mdmp") Found string "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00005972.00000001.69970.032C0000.00000004.mdmp, 00000000-00005972.00000002.71890.032C0000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.DoNotAddrOfCspParentWindowHandle" (Indicator: "System.Security.Cryptography"; Source: "00000000-00005972.00000001.69970.05540000.00000004.mdmp, 00000000-00005972.00000002.71890.05540000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.UseLegacyFipsThrow" (Indicator: "System.Security.Cryptography"; Source: "00000000-00005972.00000001.69970.05540000.00000004.mdmp, 00000000-00005972.00000002.71890.05540000.00000004.mdmp") Found string "System.Security.Cryptography.RandomNumberGenerator" (Indicator: "System.Security.Cryptography"; Source: "00000000-00005972.00000001.69970.05540000.00000004.mdmp, 00000000-00005972.00000002.71890.05540000.00000004.mdmp") Found string "Uses RsaCryptoServiceProvider to encrypt and decrypt" (Indicator: "RsaCryptoServiceProvider"; Source: "00000000-00005972.00000001.69970.05540000.00000004.mdmp, 00000000-00005972.00000002.71890.05540000.00000004.mdmp") Found string "System.Security.Cryptography.SHA1" (Indicator: "System.Security.Cryptography"; Source: "00000000-00005972.00000001.69970.05540000.00000004.mdmp, 00000000-00005972.00000002.71890.05540000.00000004.mdmp") Found string "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "aes"; Source: "00000000-00005972.00000001.69970.05540000.00000004.mdmp, 00000000-00005972.00000002.71890.05540000.00000004.mdmp") Found string "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "aescryptoserviceprovider"; Source: "00000000-00005972.00000001.69970.05540000.00000004.mdmp, 00000000-00005972.00000002.71890.05540000.00000004.mdmp") Found string "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00005972.00000001.69970.05540000.00000004.mdmp, 00000000-00005972.00000002.71890.05540000.00000004.mdmp") Found string "System.Security.Cryptography.RSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00005972.00000001.69970.05540000.00000004.mdmp, 00000000-00005972.00000002.71890.05540000.00000004.mdmp") Found string "System.Security.Cryptography.DSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00005972.00000001.69970.05540000.00000004.mdmp, 00000000-00005972.00000002.71890.05540000.00000004.mdmp") Found string "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "aes"; Source: "00000000-00005972.00000001.69970.05540000.00000004.mdmp, 00000000-00005972.00000002.71890.05540000.00000004.mdmp") Found string "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00005972.00000001.69970.05540000.00000004.mdmp, 00000000-00005972.00000002.71890.05540000.00000004.mdmp") Found string "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00005972.00000001.69970.05540000.00000004.mdmp, 00000000-00005972.00000002.71890.05540000.00000004.mdmp") Found string "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ecdsa"; Source: "00000000-00005972.00000001.69970.05540000.00000004.mdmp, 00000000-00005972.00000002.71890.05540000.00000004.mdmp") Found string "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00005972.00000001.69970.05540000.00000004.mdmp, 00000000-00005972.00000002.71890.05540000.00000004.mdmp") Found string "System.Security.Cryptography.MD5Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00005972.00000001.69970.05540000.00000004.mdmp, 00000000-00005972.00000002.71890.05540000.00000004.mdmp") Found string "System.Security.Cryptography.SHA1Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00005972.00000001.69970.05540000.00000004.mdmp, 00000000-00005972.00000002.71890.05540000.00000004.mdmp") Found string "System.Security.Cryptography.SHA256Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00005972.00000001.69970.05540000.00000004.mdmp, 00000000-00005972.00000002.71890.05540000.00000004.mdmp")38:T8db,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00005972.00000000.68053.032C0000.00000004.mdmp, 00000000-00005972.00000001.69970.032C0000.00000004.mdmp, 00000000-00005972.00000002.71890.032C0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00005972.00000000.68053.032C0000.00000004.mdmp, 00000000-00005972.00000001.69970.032C0000.00000004.mdmp, 00000000-00005972.00000002.71890.032C0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00005972.00000000.68053.032C0000.00000004.mdmp, 00000000-00005972.00000001.69970.032C0000.00000004.mdmp, 00000000-00005972.00000002.71890.032C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00005972.00000000.68053.032C0000.00000004.mdmp, 00000000-00005972.00000001.69970.032C0000.00000004.mdmp, 00000000-00005972.00000002.71890.032C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00005972.00000000.68053.032C0000.00000004.mdmp, 00000000-00005972.00000001.69970.032C0000.00000004.mdmp, 00000000-00005972.00000002.71890.032C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00005972.00000000.68053.032C0000.00000004.mdmp, 00000000-00005972.00000001.69970.032C0000.00000004.mdmp, 00000000-00005972.00000002.71890.032C0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00005972.00000000.68053.032C0000.00000004.mdmp, 00000000-00005972.00000001.69970.032C0000.00000004.mdmp, 00000000-00005972.00000002.71890.032C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00005972.00000000.68053.032C0000.00000004.mdmp, 00000000-00005972.00000001.69970.032C0000.00000004.mdmp, 00000000-00005972.00000002.71890.032C0000.00000004.mdmp")39:T478,Found string "passwordFormat" (Indicator: "password"; Source: "00000000-00005972.00000001.69970.05540000.00000004.mdmp, 00000000-00005972.00000002.71890.05540000.00000004.mdmp") Found string "passwordAttemptWindow" (Indicator: "password"; Source: "00000000-00005972.00000001.69970.05540000.00000004.mdmp, 00000000-00005972.00000002.71890.05540000.00000004.mdmp") Found string "passwordStrengthRegularExpression" (Indicator: "password"; Source: "00000000-00005972.00000001.69970.05540000.00000004.mdmp, 00000000-00005972.00000002.71890.05540000.00000004.mdmp") Found string "passwordFormat="Hashed"" (Indicator: "password"; Source: "00000000-00005972.00000001.69970.05540000.00000004.mdmp, 00000000-00005972.00000002.71890.05540000.00000004.mdmp") Found string "passwordAttemptWindow="10"" (Indicator: "password"; Source: "00000000-00005972.00000001.69970.05540000.00000004.mdmp, 00000000-00005972.00000002.71890.05540000.00000004.mdmp") Found string "passwordStrengthRegularExpression="" />" (Indicator: "password"; Source: "00000000-00005972.00000001.69970.05540000.00000004.mdmp, 00000000-00005972.00000002.71890.05540000.00000004.mdmp")3a:T990,"user0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "user0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "user0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "user0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "user0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "user0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "user0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "user0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "user0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "user0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "user0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "user0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") "user0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "") "user0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000009"; Key: "PACKEDCATALOGITEM"; Value: "")3b:Tf73,System.Net.Sockets.SocketTaskExtensions::ConnectAsync(System.Net.Sockets.Socket,System.String,System.Int32) at c1e8963d0dbd7476d0100bbaddb4148a-600006d-ProgramMaind__10~MoveNext xeno_rat_client.SocketHandler::SetRecvTimeout(System.Int32) at c1e8963d0dbd7476d0100bbaddb4148a-6000048-NodeAuthenticateAsyncd__18~MoveNext System.Net.Sockets.Socket::get_Connected() at c1e8963d0dbd7476d0100bbaddb4148a-6000034-Node~Connected xeno_rat_client.SocketHandler::ReceiveAsync() at c1e8963d0dbd7476d0100bbaddb4148a-6000042-NodeReceiveAsyncd__13~MoveNext System.Runtime.CompilerServices.AsyncTaskMethodBuilder`1::Startd__9>(xeno_rat_client.SocketHandler/d__9&) at c1e8963d0dbd7476d0100bbaddb4148a-6000051-SocketHandler~SendAsync xeno_rat_client.SocketHandler::IntToBytes(System.Int32) at c1e8963d0dbd7476d0100bbaddb4148a-6000061-SocketHandlerSendAsyncd__9~MoveNext xeno_rat_client.SocketHandler::BytesToInt(System.Byte[],System.Int32) at c1e8963d0dbd7476d0100bbaddb4148a-600004f-SocketHandler~ParseHeader xeno_rat_client.SocketHandler::Concat(System.Byte[],System.Byte[]) at c1e8963d0dbd7476d0100bbaddb4148a-600001e-HandlerGetAndSendInfod__5~MoveNext xeno_rat_client.SocketHandler::SetRecvTimeout(System.Int32) at c1e8963d0dbd7476d0100bbaddb4148a-6000038-Node~SetRecvTimeout xeno_rat_client.SocketHandler::BytesToInt(System.Byte[],System.Int32) at c1e8963d0dbd7476d0100bbaddb4148a-6000064-SocketHandlerReceiveAsyncd__10~MoveNext System.Net.Sockets.Socket::set_NoDelay(System.Boolean) at c1e8963d0dbd7476d0100bbaddb4148a-600004b-ctor System.Runtime.CompilerServices.AsyncTaskMethodBuilder`1::Startd__4>(xeno_rat_client.SocketHandler/d__4&) at c1e8963d0dbd7476d0100bbaddb4148a-600004c-SocketHandler~RecvAllAsync_ddos_unsafer System.Net.Sockets.Socket::Close(System.Int32) at c1e8963d0dbd7476d0100bbaddb4148a-600003c-NodeDisconnectd__10~MoveNext System.Net.Sockets.Socket::set_ReceiveTimeout(System.Int32) at c1e8963d0dbd7476d0100bbaddb4148a-6000055-SocketHandler~SetRecvTimeout xeno_rat_client.SocketHandler::SendAsync(System.Byte[]) at c1e8963d0dbd7476d0100bbaddb4148a-6000045-NodeSendAsyncd__14~MoveNext System.Net.Sockets.Socket::get_Connected() at c1e8963d0dbd7476d0100bbaddb4148a-6000058-SocketHandlerRecvAllAsync_ddos_unsaferd__4~MoveNext xeno_rat_client.SocketHandler::ResetRecvTimeout() at c1e8963d0dbd7476d0100bbaddb4148a-6000039-Node~ResetRecvTimeout System.Net.Sockets.Socket::get_RemoteEndPoint() at c1e8963d0dbd7476d0100bbaddb4148a-600003f-NodeConnectSubSockAsyncd__11~MoveNext System.Net.Sockets.Socket::get_Connected() at c1e8963d0dbd7476d0100bbaddb4148a-600005b-SocketHandlerRecvAllAsync_ddos_saferd__5~MoveNext xeno_rat_client.SocketHandler::BytesToInt(System.Byte[],System.Int32) at c1e8963d0dbd7476d0100bbaddb4148a-6000027-HandlersetSetIdd__8~MoveNext System.Net.Sockets.Socket::set_ReceiveTimeout(System.Int32) at c1e8963d0dbd7476d0100bbaddb4148a-6000056-SocketHandler~ResetRecvTimeout System.Runtime.CompilerServices.AsyncTaskMethodBuilder`1::Startd__10>(xeno_rat_client.SocketHandler/d__10&) at c1e8963d0dbd7476d0100bbaddb4148a-6000052-SocketHandler~ReceiveAsync System.Runtime.CompilerServices.AsyncTaskMethodBuilder`1::Startd__5>(xeno_rat_client.SocketHandler/d__5&) at c1e8963d0dbd7476d0100bbaddb4148a-600004d-SocketHandler~RecvAllAsync_ddos_safer System.Type::GetMethod(System.String,System.Reflection.BindingFlags) at c1e8963d0dbd7476d0100bbaddb4148a-600000c-DllHandlerDllNodeHandlerd__2~MoveNext System.Net.Sockets.SocketTaskExtensions::ConnectAsync(System.Net.Sockets.Socket,System.String,System.Int32) at c1e8963d0dbd7476d0100bbaddb4148a-6000070-ProgramsetServerIpd__11~MoveNext1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"03360ea19dca17e9b7238f2272e865325f5c7b30e928535f725abfb72a57cc8f","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790419736880,"unified_at":"2026-09-26T10:48:56.880Z","metadata":{"hashes":{"sha256":"03360ea19dca17e9b7238f2272e865325f5c7b30e928535f725abfb72a57cc8f","sha1":"d8591a62916984952383b789e8ab2697f4642c63","md5":"c1e8963d0dbd7476d0100bbaddb4148a","sha512":"2bd7e934a451fea2b59e05064c33b0f62d76295cf92c315257345547314417a13767ea842e30634cfbb7408121cc063bdf9c591d527bf8c8243108bd4444209b","ssdeep":"768:gJhiQierPQPUXHq2BJVVohCQK7uxyS9Xfb+0zveZSC0t4DF:+hiQieDxq2BJPohCT7uESdfb+2e+4DF","ssdeep_chunks":["768:gJhiQie","768:JhiQier","768:hiQierP","768:iQierPQ","768:QierPQP","768:ierPQPU","768:erPQPUX","768:rPQPUXH","768:PQPUXHq","768:QPUXHq2","768:PUXHq2B","768:UXHq2BJ","768:XHq2BJV","768:Hq2BJVV","768:q2BJVVo","768:2BJVVoh","768:BJVVohC","768:JVVohCQ","768:VVohCQK","768:VohCQK7","768:ohCQK7u","768:hCQK7ux","768:CQK7uxy","768:QK7uxyS","768:K7uxyS9","768:7uxyS9X","768:uxyS9Xf","768:xyS9Xfb","768:yS9Xfb+","768:S9Xfb+0","768:9Xfb+0z","768:Xfb+0zv","768:fb+0zve","768:b+0zveZ","768:+0zveZS","768:0zveZSC","768:zveZSC0","768:veZSC0t","768:eZSC0t4","768:ZSC0t4D","768:SC0t4DF","1536:gJhiQie","1536:JhiQier","1536:hiQierP","1536:iQierPQ","1536:QierPQP","1536:ierPQPU","1536:erPQPUX","1536:rPQPUXH","1536:PQPUXHq","1536:QPUXHq2","1536:PUXHq2B","1536:UXHq2BJ","1536:XHq2BJV","1536:Hq2BJVV","1536:q2BJVVo","1536:2BJVVoh","1536:BJVVohC","1536:JVVohCQ","1536:VVohCQK","1536:VohCQK7","1536:ohCQK7u","1536:hCQK7ux","1536:CQK7uxy","1536:QK7uxyS","1536:K7uxyS9","1536:7uxyS9X","1536:uxyS9Xf","1536:xyS9Xfb","1536:yS9Xfb+","1536:S9Xfb+0","1536:9Xfb+0z","1536:Xfb+0zv","1536:fb+0zve","1536:b+0zveZ","1536:+0zveZS","1536:0zveZSC","1536:zveZSC0","1536:veZSC0t","1536:eZSC0t4","1536:ZSC0t4D","1536:SC0t4DF","768:+hiQieD","768:hiQieDx","768:iQieDxq","768:QieDxq2","768:ieDxq2B","768:eDxq2BJ","768:Dxq2BJP","768:xq2BJPo","768:q2BJPoh","768:2BJPohC","768:BJPohCT","768:JPohCT7","768:PohCT7u","768:ohCT7uE","768:hCT7uES","768:CT7uESd","768:T7uESdf","768:7uESdfb","768:uESdfb+","768:ESdfb+2","768:Sdfb+2e","768:dfb+2e+","768:fb+2e+4","768:b+2e+4D","768:+2e+4DF"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"user0","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":47104,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1708210091000,"last_seen":1708210091000,"last_multi_scan":1708210091000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["evasive"]},"stats":{"av":{"malicious_count":10,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":44},"sandbox_signatures":{"informative_count":98,"suspicious_count":10,"malicious_count":4,"total":112},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.XenoRAT","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Zusy.507813","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_70% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Zusy.507813 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/Agent.WNX trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Trojan/MSIL.Agent.dj","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005b11ae1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/RAT-GY","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/MSIL_Agent.HBX.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Zusy.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"suspicious","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to execute application (Dotnet)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Found Native API in Dotnet file"}],"sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"tactic":"Execution","technique":"Scheduled Task/Job","attack_id":"T1053","attack_id_wiki":"https://attack.mitre.org/techniques/T1053","identifiers":[{"type":"malicious","value":"Found an indicator for a scheduled task trigger"}],"sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Found a reference to a WMI query string known to be used for VM detection"},{"type":"informative","value":"Found WMI keywords in script (string)"},{"type":"informative","value":"Contains ability to execute WMI queries (Dotnet)"},{"type":"informative","value":"Contains ability to execute a WMI query"}],"sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to perform symmetric encryption (Dotnet)"},{"type":"informative","value":"Contains ability to perform AES cryptographic operations (Dotnet)"},{"type":"informative","value":"Dotnet file contains encryption/decryption functions"},{"type":"informative","value":"Contains ability to perform crypto operations"},{"type":"informative","value":"Contains ability to perform CryptoStream operations (Dotnet)"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"suspicious","value":"Uses a .NET obfuscator to hide its code"},{"type":"informative","value":"Contains ability to perform symmetric decryption (Dotnet)"},{"type":"informative","value":"Contains ability to load content into memory (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"},{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability execute applications in hidden mode (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"suspicious","value":"Possibly tries to evade analysis by sleeping many times"}],"sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"}],"sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"},{"type":"informative","value":"Dotnet code contains potential unpacker"}],"sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Dotnet code contains ability to modify/delete registry"}],"sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"}],"sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to gather system information (Dotnet)"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to gather system environment details"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"References to WMI query strings used for information discovery"}],"sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Dotnet code contains ability to query registry"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Contains registry location strings"}],"sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Contains ability to gather process details (Dotnet)"},{"type":"suspicious","value":"Queries process information"},{"type":"suspicious","value":"Contains ability to enumerate processes/modules/threads"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"}],"sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Possibly checks for the presence of an Antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Contains ability to retrieve user privileges (API string)"},{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Contains ability to retrieve user privileges"}],"sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Contains ability to compress/decompress buffers (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"May execute SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"suspicious","value":"Spawned process connects to a network"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains ability to communicates via socket (possible C&C communication)"}],"sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate via sockets (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains ability to perform encryption/decryption using RSA algorithm"}],"sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"malicious","value":"Uses network protocols on unusual ports"},{"type":"suspicious","value":"Contains ability to open a port and listen for incoming connection"}],"sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Contains ability to perform symmetric crypto operations"}],"sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains ability to provide interface for network protocols (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains ability to perform encryption (API string)"},{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability execute applications in hidden mode (Dotnet)","description":"Observed Namespace \"System.Diagnostics.ProcessStartInfo\" and MemberReference \"set_CreateNoWindow\" in \"user0\"","origin":"Static Parser","mitre_attack_id":"T1564.003","relevance":1,"id":"static-161","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to compress/decompress buffers (API string)","description":"Found reference to API \"RtlCompressBuffer\" (Indicator: \"RtlCompressBuffer\"; File: \"user0\")\n Found reference to API \"RtlDecompressBuffer\" (Indicator: \"RtlDecompressBuffer\"; File: \"user0\")\n Found reference to API \"RtlCompressBuffer\" (Indicator: \"RtlCompressBuffer\"; Source: \"00000000-00005972.00000002.71890.00E12000.00000002.mdmp\")\n Found reference to API \"RtlDecompressBuffer\" (Indicator: \"RtlDecompressBuffer\"; Source: \"00000000-00005972.00000002.71890.00E12000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-404","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load content into memory (Dotnet)","description":"Observed namespace \"System.IO.MemoryStream\" and TypeReference \".ctor\" in \"user0\"\n Observed namespace \"System.IO.MemoryStream\" and TypeReference \"ToArray\" in \"user0\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-107","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00005972.00000000.68053.032C0000.00000004.mdmp, 00000000-00005972.00000001.69970.032C0000.00000004.mdmp, 00000000-00005972.00000002.71890.032C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to use Cryptographic classes","description":"$25","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Dotnet code contains potential unpacker","description":"Observed function \"System.Reflection.Load\" in \"user0\"","origin":"Static Parser","mitre_attack_id":"T1620","relevance":1,"id":"static-115","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Dotnet file contains encryption/decryption functions","description":"Observed namespace \"System.Security.Cryptography\" and MemberReference \"CreateDecryptor\" in \"user0\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-134","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES cryptographic operations (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.Aes\" and TypeReference \"Create\" in \"user0\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-167","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform CryptoStream operations (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.CryptoStream\" and TypeReference \"FlushFinalBlock\" in \"user0\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-166","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform crypto operations","description":"Observed namespace \"System.Security.Cryptography\" in [Source: \"user0\"]","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-118","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00005972.00000001.69970.05540000.00000004.mdmp, 00000000-00005972.00000002.71890.05540000.00000004.mdmp\")\n Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00005972.00000001.69970.05540000.00000004.mdmp, 00000000-00005972.00000002.71890.05540000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"Uses RsaCryptoServiceProvider to encrypt and decrypt\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00005972.00000001.69970.05540000.00000004.mdmp, 00000000-00005972.00000002.71890.05540000.00000004.mdmp\")\n Found string \"description=\"Uses RsaCryptoServiceProvider to encrypt and decrypt\"\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00005972.00000001.69970.05540000.00000004.mdmp, 00000000-00005972.00000002.71890.05540000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-352","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform symmetric crypto operations","description":"Observed namespace \"System.Security.Cryptography.Aes\" and TypeReference \"Create\" in \"user0\"","origin":"Static Parser","mitre_attack_id":"T1573.001","relevance":1,"id":"static-140","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform symmetric decryption (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateDecryptor\" in \"user0\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-168","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform symmetric encryption (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateEncryptor\" in \"user0\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-165","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"http://www.w3.org/2001/04/xmlenc# EncryptedKey\" (Indicator: \"encryptedkey\"; Source: \"00000000-00005972.00000001.69970.05540000.00000004.mdmp, 00000000-00005972.00000002.71890.05540000.00000004.mdmp\")\n Found string \"System.Security.Cryptography.Xml.KeyInfoEncryptedKey, System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\" (Indicator: \"encryptedkey\"; Source: \"00000000-00005972.00000001.69970.05540000.00000004.mdmp, 00000000-00005972.00000002.71890.05540000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$26","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"user0.exe\" called \"IsWow64Process\" with parameter \"5972\" - (UID: 00000000-00005972)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"user0.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005972)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$27","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"user0.exe\" called \"GetVersionExA\" with parameter 940000000600000002000000f02300000200000000000000000000005c000000000063000000000000000100000074001400000090922e03000000000100000001000000000000002c00000040d12e0300000000140000000a000000000000000000000000006f0008732e0314000000000000000000000000000000000000000000000000006e00000000006700000019000019 (UID: 00000000-00005972)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute WMI queries (Dotnet)","description":"Observed namespace \"System.Management.ManagementObjectSearcher\" in \"user0\"","origin":"Static Parser","mitre_attack_id":"T1047","relevance":1,"id":"static-114","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"Found string \"SELECT * FROM AntivirusProduct\" (Indicator: \"select * from \"; File: \"user0\")\n Found string \"SELECT * FROM Win32_OperatingSystem\" (Indicator: \"select * from \"; File: \"user0\")\n Found string \"SELECT * FROM Win32_OperatingSystem\" (Indicator: \"select * from \"; Source: \"00000000-00005972.00000001.69970.05540000.00000004.mdmp, 00000000-00005972.00000002.71890.05540000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to gather system environment details","description":"Observed function \"ExpandEnvironmentVariables\" in \"user0\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":1,"id":"static-119","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to gather system information (Dotnet)","description":"Observed function \"get_UserName\" in \"user0\"\n Observed function \"get_MachineName\" in \"user0\"\n Observed function \"get_OSVersion\" in \"user0\"\n Observed function \"get_SystemDirectory\" in \"user0\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":1,"id":"static-120","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"user0.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetWindowTextLength\" (Indicator: \"GetWindowText\"; File: \"user0\")\n Found reference to API \"GetWindowText\" (Indicator: \"GetWindowText\"; File: \"user0\")\n Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; File: \"user0\")\n Found reference to API \"GetWindowTextLength\" (Indicator: \"GetWindowText\"; Source: \"00000000-00005972.00000002.71890.00E12000.00000002.mdmp\")\n Found reference to API \"GetWindowText\" (Indicator: \"GetWindowText\"; Source: \"00000000-00005972.00000002.71890.00E12000.00000002.mdmp\")\n Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; Source: \"00000000-00005972.00000002.71890.00E12000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"user0.exe\" queries volume information of \"C:\\user0.exe\" at 00000000-00005972-00000C15-50890076\n \"user0.exe\" queries volume information of \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Management\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\System.Management.dll\" at 00000000-00005972-00000C15-59481682","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"user0.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"user0.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$28","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$29","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"45.195.69.28:4444\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"SELECT * FROM AntivirusProduct\" (Source: user0, Indicator: \"select * from antivirusproduct\")\n \"SELECT * FROM Win32_OperatingSystem\" (Source: user0, Indicator: \"select * from win32_operatingsystem\")\n \"SELECT * FROM Win32_OperatingSystem\" (Source: 00000000-00005972.00000001.69970.05540000.00000004.mdmp, 00000000-00005972.00000002.71890.05540000.00000004.mdmp, Indicator: \"select * from win32_operatingsystem\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; File: \"user0\")\n Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00005972.00000002.71890.00E12000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"set_UseShellExecute\" (Indicator: \"ShellExecute\"; File: \"user0\")\n Found reference to API \"set_UseShellExecute\" (Indicator: \"ShellExecute\"; Source: \"00000000-00005972.00000002.71890.00E12000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"General","name":"Contains ability to execute application (Dotnet)","description":"Observed function \"set_UseShellExecute\" in \"user0\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-108","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; File: \"user0\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00005972.00000002.71890.00E12000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"Local\\SM0:5972:168:WilStaging_02\"\n \"SM0:5972:168:WilStaging_02\"\n \"SM0:5972:64:WilError_01\"\n \"Xeno_rat_nd8912d-admin\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"General","name":"Dotnet code contains ability to modify/delete registry","description":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"DeleteValue\" in \"user0\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"SetValue\" in \"user0\"","origin":"Static Parser","mitre_attack_id":"T1112","relevance":1,"id":"static-139","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"General","name":"Dotnet code contains ability to query registry","description":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"OpenBaseKey\" in \"user0\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"OpenSubKey\" in \"user0\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"GetValueNames\" in \"user0\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"GetValue\" in \"user0\"","origin":"Static Parser","mitre_attack_id":"T1012","relevance":1,"id":"static-138","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$2c","origin":"API Call","mitre_attack_id":"T1574.002","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"user0\" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"General","name":"Found Native API in Dotnet file","description":"Observed unmanaged function \"RtlGetCompressionWorkSpaceSize\" in \"user0\"\n Observed unmanaged function \"RtlDecompressBuffer\" in \"user0\"\n Observed unmanaged function \"RtlCompressBuffer\" in \"user0\"\n Observed unmanaged function \"LocalAlloc\" in \"user0\"\n Observed unmanaged function \"LocalFree\" in \"user0\"\n Observed unmanaged function \"memcmp\" in \"user0\"\n Observed unmanaged function \"IsUserAnAdmin\" in \"user0\"\n Observed unmanaged function \"GetForegroundWindow\" in \"user0\"\n Observed unmanaged function \"GetWindowText\" in \"user0\"\n Observed unmanaged function \"GetWindowTextLength\" in \"user0\"\n Observed unmanaged function \"GetWindowThreadProcessId\" in \"user0\"\n Observed unmanaged function \"CloseHandle\" in \"user0\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-101","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"General","name":"Found WMI keywords in script (string)","description":"Observed WMI keyword:\"//./root/cimv2\" [Source: 00000000-00005972.00000001.69970.05540000.00000004.mdmp\n 00000000-00005972.00000002.71890.05540000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-155","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$2d","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"user0.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 71530000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"user0.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76B90000\n \"user0.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73310000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"user0.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 72A10000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"user0.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76C50000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"user0\" was detected as \".NET\" and name: \"Library\"\n \"user0\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"General","name":"May execute SQL queries","description":"\"SELECT * FROM AntivirusProduct\" (Source: user0, Indicator: \"select * from antivirusproduct\")\n \"SELECT * FROM Win32_OperatingSystem\" (Source: user0, Indicator: \"select * from win32_operatingsystem\")","origin":"File/Memory","mitre_attack_id":"T1005","relevance":1,"id":"string-605","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"user0\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","relevance":1,"id":"static-144","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"user0\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$2e","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"General","name":"Possibly checks for the presence of an Antivirus engine","description":"\"GetAntivirus\" (Indicator: \"antivirus\") in Source: user0","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":2,"id":"string-8","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"user0.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"user0.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"user0.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"user0.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"user0.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$30","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"user0.exe\" queries basic process information of the \"C:\\user0.exe\" (UID: 5972)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$31","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"user0.exe\" called \"NtQueueApcThread\" (UID: 00000000-00005972)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"user0.exe\" reads file \"c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config\"\n \"user0.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll.aux\"\n \"user0.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\2c3c912ea8f058f9d04c4650128feb3f\\system.ni.dll.aux\"\n \"user0.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.configuration\\96f7edb07b12303f0ec2595c7f3778c7\\system.configuration.ni.dll.aux\"\n \"user0.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\31fae3290fad30c31c98651462d22724\\system.core.ni.dll.aux\"\n \"user0.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.xml\\15af16d373cf0528cb74fc73d365fdbf\\system.xml.ni.dll.aux\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Possibly tries to evade analysis by sleeping many times","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"user0.exe\" trying to touch file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"user0.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\mscoree.dll\"\n \"user0.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\apphelp.dll\"\n \"user0.exe\" trying to touch file \"C:\\user0.exe\"\n \"user0.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ntdll.dll\"\n \"user0.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\kernel32.dll\"\n \"user0.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \"user0.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"user0.exe\" trying to touch file \"C:\\Windows\\Temp\\VxSSL32.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$32","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$33","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate via sockets (Dotnet)","description":"$34","origin":"Static Parser","mitre_attack_id":"T1095","relevance":1,"id":"static-159","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00005972-00000C26-58093238\")\n Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; Source: \"00000000-00005972-00000C26-58701446\")\n Found reference to API \"WSASend\" (Indicator: \"WSASend\"; Source: \"00000000-00005972-00000C26-58978570\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicates via socket (possible C&C communication)","description":"Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"get_Connected\" in \"user0\"\n Observed Namespace \"System.Net.Sockets.SocketTaskExtensions\" and MemberReference \"ConnectAsync\" in \"user0\"\n Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"set_ReceiveTimeout\" in \"user0\"\n Observed Namespace \"System.Net.Sockets.SocketTaskExtensions\" and MemberReference \"ReceiveAsync\" in \"user0\"","origin":"Static Parser","mitre_attack_id":"T1071","relevance":1,"id":"static-151","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"Network Related","name":"Contains ability to provide interface for network protocols (Dotnet)","description":"Observed namespace \"System.Net.Sockets\" in \"user0\"","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-110","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"1.0.0.0\"\n \"45.195.69.28\"\n \"3.2.1.0\"\n \"1.2.3.0\"\n Potential IP \"4.0.0.0\" found in string \"ystem,4.0.0.0,,b77a5c561934e089\"\n \"192.168.243.153\"\n Potential IP \"4.0.0.0\" found in string \"4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\" allowDefinition=\"MachineToApplication\" />y$q)\", \"2.5.29.10\", \"2.5.29.19\", \"2.5.29.14\", \"2.5.29.15\", \"2.5.29.37\", Potential IP \"4.0.0.0\" found in string \"The type initializer for '{0}' threw an exception.=4.0.0.0\n Culture=neutral\n PublicKeyToken=b77a5c561934e089\", \"5.195.69.28\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$35","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e\n Observed JA3 fingerprint: bd0bf25947d4a37404f0424edf4db9ad\n Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLE90E6ADC904448DD97B4E829F5689]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00005972.00000000.68053.032C0000.00000004.mdmp, 00000000-00005972.00000001.69970.032C0000.00000004.mdmp, 00000000-00005972.00000002.71890.032C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"user0.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"user0.exe\" called \"GetComputerNameW\" (UID: 00000000-00005972)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"user0.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"user0.exe\" called \"GetUserNameW\" (UID: 00000000-00005972)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$36","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$37","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetProcessById\" (Indicator: \"GetProcessById\"; File: \"user0\")\n Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; File: \"user0\")\n Found reference to API \"GetProcessById\" (Indicator: \"GetProcessById\"; Source: \"00000000-00005972.00000002.71890.00E12000.00000002.mdmp\")\n Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00005972.00000002.71890.00E12000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to gather process details (Dotnet)","description":"Observed function \"GetProcessById\" in \"user0\"\n Observed function \"get_ProcessName\" in \"user0\"","origin":"Static Parser","mitre_attack_id":"T1057","relevance":1,"id":"static-100","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetTempFileName\" (Indicator: \"GetTempFileName\"; File: \"user0\")\n Found reference to API \"GetCurrentDirectory\" (Indicator: \"GetCurrentDirectory\"; File: \"user0\")\n Found reference to API \"GetTempFileName\" (Indicator: \"GetTempFileName\"; Source: \"00000000-00005972.00000002.71890.00E12000.00000002.mdmp\")\n Found reference to API \"GetCurrentDirectory\" (Indicator: \"GetCurrentDirectory\"; Source: \"00000000-00005972.00000002.71890.00E12000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve user privileges","description":"xeno_rat_client.Utils::IsUserAnAdmin() at c1e8963d0dbd7476d0100bbaddb4148a-6000079-Utils~IsAdmin","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1033","relevance":5,"id":"stream-136","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve user privileges (API string)","description":"Found reference to API \"IsUserAnAdmin\" (Indicator: \"IsUserAnAdmin\"; File: \"user0\")\n Found reference to API \"IsUserAnAdmin\" (Indicator: \"IsUserAnAdmin\"; Source: \"00000000-00005972.00000002.71890.00E12000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-217","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \",3165,,GetUserNameW,advapi32\" (Indicator: \"GetUserName\"; Source: \"00000000-00005972.00000001.69970.032C0000.00000004.mdmp, 00000000-00005972.00000002.71890.032C0000.00000004.mdmp\")\n Found reference to API \"53898680985,6484,3165,,GetUserNameW,advapi32.dll,\"00:18:00.890\",RX=0,PX=0\" (Indicator: \"GetUserName\"; Source: \"00000000-00005972.00000001.69970.032C0000.00000004.mdmp, 00000000-00005972.00000002.71890.032C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$39","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"Found string \"SELECT * FROM AntivirusProduct\" (Indicator: \"antivirusproduct\"; File: \"user0\")\n Found string \"SELECT * FROM Win32_OperatingSystem\" (Indicator: \" Win32_OperatingSystem\"; File: \"user0\")\n Found string \"SELECT * FROM Win32_OperatingSystem\" (Indicator: \" Win32_OperatingSystem\"; Source: \"00000000-00005972.00000001.69970.05540000.00000004.mdmp, 00000000-00005972.00000002.71890.05540000.00000004.mdmp\")\n Found string \"ELECT * FROM AntivirusProduct\" (Indicator: \"antivirusproduct\"; Source: \"00000000-00005972.00000002.71890.00E12000.00000002.mdmp\")\n Found string \"ELECT * FROM Win32_OperatingSystem\" (Indicator: \" Win32_OperatingSystem\"; Source: \"00000000-00005972.00000002.71890.00E12000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00005972.00000000.68053.032C0000.00000004.mdmp, 00000000-00005972.00000001.69970.032C0000.00000004.mdmp, 00000000-00005972.00000002.71890.032C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$3a","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"user0\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"user0.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"user0.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\"user0.exe\" queried SystemProcessInformation at 00000000-00005972-00000C13-48620935 [PID: 5972]\n \"user0.exe\" queried SystemProcessInformation at 00000000-00005972-00000C13-48622672 [PID: 5972]\n \"user0.exe\" queried SystemProcessInformation at 00000000-00005972-00000C13-49152099 [PID: 5972]\n \"user0.exe\" queried SystemProcessInformation at 00000000-00005972-00000C13-49153714 [PID: 5972]\n \"user0.exe\" queried SystemProcessInformation at 00000000-00005972-00000C13-51766864 [PID: 5972]\n \"user0.exe\" queried SystemProcessInformation at 00000000-00005972-00000C13-51768214 [PID: 5972]\n \"user0.exe\" queried SystemProcessInformation at 00000000-00005972-00000C13-57794161 [PID: 5972]\n \"user0.exe\" queried SystemProcessInformation at 00000000-00005972-00000C13-57795671 [PID: 5972]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"user0.exe\" is allocating memory with PAGE_GUARD access rights (Handle: 4294967295); (PID: 5972)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Uses a .NET obfuscator to hide its code","description":"\"COMPRESSION_FORMAT_LZNT1\" is a hint for the obfuscator \"MPRESS\"\n \"5__1\" is a hint for the obfuscator \"MPRESS\"\n \"5__2\" is a hint for the obfuscator \"MPRESS\"\n \"COMPRESSION_ENGINE_MAXIMUM\" is a hint for the obfuscator \"MPRESS\"\n \"Compressed\" is a hint for the obfuscator \"MPRESS\"\n \"FinalUncompressedSize\" is a hint for the obfuscator \"MPRESS\"\n \"RtlGetCompressionWorkSpaceSize\" is a hint for the obfuscator \"MPRESS\"\n \"CompressedBufferSize\" is a hint for the obfuscator \"MPRESS\"\n \"UncompressedBufferSize\" is a hint for the obfuscator \"MPRESS\"\n \"Compression\" is a hint for the obfuscator \"MPRESS\"\n \"CompressedBuffer\" is a hint for the obfuscator \"MPRESS\"\n \"UncompressedBuffer\" is a hint for the obfuscator \"MPRESS\"\n \"RtlCompressBuffer\" is a hint for the obfuscator \"MPRESS\"\n \"RtlDecompressBuffer\" is a hint for the obfuscator \"MPRESS\"\n \"Compress\" is a hint for the obfuscator \"MPRESS\"\n \"Decompress\" is a hint for the obfuscator \"MPRESS\"\n \"CompressionFormat\" is a hint for the obfuscator \"MPRESS\"","origin":"File/Memory","mitre_attack_id":"T1140","relevance":2,"id":"string-6","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a reference to a WMI query string known to be used for VM detection","description":"\"SELECT * FROM Win32_OperatingSystem\" (Indicator: \" win32_operatingsystem\"; File: \"user0\")\n \"SELECT * FROM Win32_OperatingSystem\" (Indicator: \" win32_operatingsystem\"; Source: \"00000000-00005972.00000001.69970.05540000.00000004.mdmp, 00000000-00005972.00000002.71890.05540000.00000004.mdmp\")\n \"ELECT * FROM Win32_OperatingSystem\" (Indicator: \" win32_operatingsystem\"; Source: \"00000000-00005972.00000002.71890.00E12000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-55","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to evade analysis by sleeping many times","description":"\"user0.exe\" (Thread ID: 6196) slept \"525\" times (threshold: 500)","origin":"API Call","mitre_attack_id":"T1497.003","relevance":10,"id":"api-47","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection","description":"$3b","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1571","relevance":5,"id":"stream-85","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"suspicious","category":"Network Related","name":"Spawned process connects to a network","description":"Process \"C:\\user0.exe\" connects to 45.195.69.28 on port 4444 (TCP)","origin":"Monitored Target","mitre_attack_id":"T1071","relevance":5,"id":"target-412","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"System.Diagnostics.Process::GetProcessById(System.Int32) at c1e8963d0dbd7476d0100bbaddb4148a-6000078-Utils~GetCaptionOfActiveWindow","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"GetMethod\" (Source: user0, API is part of module: WMINET_UTILS.DLL)\n Found string \"Delete\" (Source: user0, API is part of module: WMINET_UTILS.DLL)\n Found string \"memcmp\" (Source: user0, API is part of module: VCRUNTIME140_CLR0400.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"user0\" claims program is from Thu Sep 29 03:51:26 2067","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"malicious","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET MALWARE [ANY.RUN] Xeno-RAT TCP Check-In\" (SID: 2050110, Rev: 2, Severity: 1) categorized as \"Malware Command and Control Activity Detected\" (PUA/PUP/Adware)","origin":"Suricata Alerts","relevance":10,"id":"suricata-2","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_90% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"malicious","category":"Installation/Persistence","name":"Found an indicator for a scheduled task trigger","description":"file/memory contains long string with (Indicator: \"LogonTrigger\"; File: \"user0\")\n Found string \"\" (Indicator: \"LogonTrigger\"; Source: \"00000000-00005972.00000002.71890.00E12000.00000002.mdmp\")\n Found string \"\" (Indicator: \"LogonTrigger\"; Source: \"00000000-00005972.00000002.71890.00E12000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1053","relevance":5,"id":"string-32","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 45.195.69.28 on port 4444","origin":"Network Traffic","mitre_attack_id":"T1571","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"name":"Evasive","details_count":3,"details":[{"detail":"Possibly tries to evade analysis by sleeping many times"},{"detail":"Found a reference to a WMI query string known to be used for VM detection"},{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":4,"imported_dlls_count":55,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":2,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["evasive"],"sample_flags":["Network Traffic"],"sandbox_reports":[{"id":"65d137aaf77b590834038cf7","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["SYC"],"submit_name":"user0","analysis_start_time":"2024-02-17T22:48:11+00:00","indicators_count":{"informative":98,"suspicious":22,"malicious":4},"tags":["Network Traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"45.195.69.28","port":4444,"protocol":"TCP","country":"Seychelles","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]}],"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}],"processes":[{"pid":5972,"ppid":0,"name":"user0.exe","command_line":"","sha256":"03360ea19dca17e9b7238f2272e865325f5c7b30e928535f725abfb72a57cc8f","normalized_path":"C:\\user0.exe","uid":"00000000-00005972","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="}],"all_imported_dlls":["shlwapi.dll","version.dll","clr.dll","vcruntime140_clr0400.dll","SHCore.dll","rpcrt4.dll","cryptbase.dll","ucrtbase.dll","gdi32.dll","msvcrt.dll","kernel.appcore.dll","ucrtbase_clr0400.dll","clrjit.dll","kernel32.dll","sechost.dll","win32u.dll","imm32.dll","mscorlib.ni.dll","shell32.dll","cfgmgr32.dll","clbcatq.dll","ntdll.dll","apphelp.dll","sspicli.dll","bcryptprimitives.dll","profapi.dll","bcrypt.dll","mswsock.dll","System.Management.dll","wow64win.dll","mscoree.dll","KernelBase.dll","ws2_32.dll","System.ni.dll","System.Configuration.ni.dll","System.Xml.ni.dll","user32.dll","advapi32.dll","psapi.dll","rsaenh.dll","WMINet_Utils.dll","wow64.dll","fltLib.dll","windows.storage.dll","gdi32full.dll","msvcp_win.dll","ole32.dll","oleaut32.dll","mscoreei.dll","powrprof.dll","System.Core.ni.dll","cryptsp.dll","wow64cpu.dll","VxSSL32.dll","combase.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"Local\\SM0:5972:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"name":"SM0:5972:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"name":"SM0:5972:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]},{"name":"Xeno_rat_nd8912d-admin","sources":[{"report_type":"sandbox","report_id":"65d137aaf77b590834038cf7"}]}]}},"report_ids":{"sandbox_job_ids":["65d137aaf77b590834038cf7"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Zusy.Generic Sample 03360ea19dca… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 03360ea19dca…. Malware family: Zusy.Generic. Threat score 100/100. 10/25 AV engines flagged this file. 4 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/03360ea19dca17e9b7238f2272e865325f5c7b30e928535f725abfb72a57cc8f"}],["$","meta","4",{"property":"og:title","content":"Malicious Zusy.Generic Sample 03360ea19dca… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 03360ea19dca…. Malware family: Zusy.Generic. Threat score 100/100. 10/25 AV engines flagged this file. 4 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/03360ea19dca17e9b7238f2272e865325f5c7b30e928535f725abfb72a57cc8f"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Zusy.Generic Sample 03360ea19dca… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 03360ea19dca…. Malware family: Zusy.Generic. Threat score 100/100. 10/25 AV engines flagged this file. 4 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L3c","11",{}]]