26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 47:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T49e,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Lazy.Generic Sample 038ae1968e1c… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 038ae1968e1c…. Malware family: Lazy.Generic. Threat score 100/100. 18/24 AV engines flagged this file. 11 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e","keywords":["Malicious","Lazy.Generic","malware analysis","sandbox report","threat intelligence","038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e"],"about":{"@type":"SoftwareApplication","name":"66e06cea88f93_BlueSapphire.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Lazy.Generic","antivirusDetections":{"malicious":18,"total":24},"behavioralIndicators":{"malicious":11,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T9e0,Found reference to API "BindingNavigatorMoveNextItem" (Indicator: "bind"; Source: "sample.bin"), Found reference to API "System.Runtime.InteropServices" (Indicator: "time"; Source: "sample.bin"), Found reference to API "System.Windows.Automation.Provider.IWindowProvider.SetVisualState" (Indicator: "lstat"; Source: "sample.bin"), Found reference to API "System.Windows.Automation.Provider.IWindowProvider.SetVisualState" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "ReadString" (Indicator: "read"; Source: "sample.bin"), Found reference to API "System.Reflection.RuntimeModule" (Indicator: "time"; Source: "sample.bin"), Found reference to API "get_IsReadOnly" (Indicator: "read"; Source: "sample.bin"), Found reference to API "IsSelectionRequiredProperty" (Indicator: "select"; Source: "sample.bin"), Found reference to API "ElementAddedToSelectionEvent" (Indicator: "select"; Source: "sample.bin"), Found reference to API "MenuClosedEvent" (Indicator: "close"; Source: "sample.bin"), Found reference to API "IResourceReader" (Indicator: "read"; Source: "sample.bin"), Found reference to API "InvalidTimestamp" (Indicator: "time"; Source: "sample.bin"), Found reference to API "InvalidTimestamp" (Indicator: "times"; Source: "sample.bin"), Found reference to API "state" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "System.ComponentModel.EventBasedAsync" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "System.Threading" (Indicator: "read"; Source: "sample.bin"), Found reference to API "CreateWindowExW" (Indicator: "creat"; Source: "sample.bin"), Found reference to API "set_AccessibleName" (Indicator: "access"; Source: "sample.bin"), Found reference to API "IResourceWriter" (Indicator: "write"; Source: "sample.bin"), Found reference to API "timerId" (Indicator: "time"; Source: "sample.bin"), Found reference to API "System.Windows.Automation.Provider.IWindowProvider.get_InteractionState" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "BindingNavigatorMoveFirstItem" (Indicator: "bind"; Source: "sample.bin"), Found reference to API "IAsyncResult" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "Write" (Indicator: "write"; Source: "sample.bin"), Found reference to API "InvokeOnEventsThread" (Indicator: "read"; Source: "sample.bin"), Found reference to API "ToolTipOpenedEvent" (Indicator: "open"; Source: "sample.bin"), Found reference to API "TextSelectionChangedEvent" (Indicator: "select"; Source: "sample.bin")28:T1319,Found reference to API (Indicator: "IsIconic"; Source: "sample.bin"), Found reference to API (Indicator: "MapVirtualKey"; Source: "sample.bin"), Found reference to API (Indicator: "IsWindowEnabled"; Source: "sample.bin"), Found reference to API (Indicator: "CreateWindowExW"; Source: "sample.bin"), Found reference to API (Indicator: "DefWindowProcW"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowPlacement"; Source: "sample.bin"), Found reference to API (Indicator: "TranslateMessage"; Source: "sample.bin"), Found reference to API (Indicator: "UnregisterClassW"; Source: "sample.bin"), Found reference to API (Indicator: "IsChild"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleW"; Source: "sample.bin"), Found reference to API (Indicator: "GetDesktopWindow"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowPos"; Source: "sample.bin"), Found reference to API (Indicator: "GetFocus"; Source: "sample.bin"), Found reference to API (Indicator: "WTSRegisterSessionNotification"; Source: "sample.bin"), Found reference to API (Indicator: "GetLength"; Source: "sample.bin"), Found reference to API (Indicator: "DispatchMessageW"; Source: "sample.bin"), Found reference to API (Indicator: "RegisterHotKey"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteObject"; Source: "sample.bin"), Found reference to API (Indicator: "IsWindowVisible"; Source: "sample.bin"), Found reference to API (Indicator: "DispatchMessage"; Source: "sample.bin"), Found reference to API (Indicator: "GetClassName"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "GetMenuState"; Source: "sample.bin"), Found reference to API (Indicator: "GetParent"; Source: "sample.bin"), Found reference to API (Indicator: "GetAsyncKeyState"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowPlacement"; Source: "sample.bin"), Found reference to API (Indicator: "UnregisterHotKey"; Source: "sample.bin"), Found reference to API (Indicator: "GetUserObjectInformationW"; Source: "sample.bin"), Found reference to API (Indicator: "PeekMessage"; Source: "sample.bin"), Found reference to API (Indicator: "IsWindow"; Source: "sample.bin"), Found reference to API (Indicator: "RegisterClassW"; Source: "sample.bin"), Found reference to API (Indicator: "GetTickCount"; Source: "sample.bin"), Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "sample.bin"), Found reference to API (Indicator: "PostMessage"; Source: "sample.bin"), Found reference to API (Indicator: "SetFocus"; Source: "sample.bin"), Found reference to API (Indicator: "DestroyWindow"; Source: "sample.bin"), Found reference to API (Indicator: "WindowFromPoint"; Source: "sample.bin"), Found reference to API (Indicator: "MsgWaitForMultipleObjectsEx"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentThreadId"; Source: "sample.bin"), Found reference to API (Indicator: "GetClientRect"; Source: "sample.bin"), Found reference to API (Indicator: "PostQuitMessage"; Source: "sample.bin"), Found reference to API (Indicator: "SendMessageTimeout"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowRect"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcess"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowThreadProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessWindowStation"; Source: "sample.bin"), Found reference to API (Indicator: "GetObject"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameEx"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "GetMessage"; Source: "sample.bin"), Found reference to API (Indicator: "SendInput"; Source: "sample.bin"), Found reference to API (Indicator: "SetTimer"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessById"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalAddAtom"; Source: "sample.bin"), Found reference to API (Indicator: "GetProp"; Source: "sample.bin"), Found reference to API (Indicator: "SetWinEventHook"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "SetConsoleCtrlHandler"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemMetrics"; Source: "sample.bin"), Found reference to API (Indicator: "WTSUnRegisterSessionNotification"; Source: "sample.bin"), Found reference to API (Indicator: "KillTimer"; Source: "sample.bin"), Found reference to API (Indicator: "CloseHandle"; Source: "sample.bin"), Found reference to API (Indicator: "EnumThreadWindows"; Source: "sample.bin")29:Tca4,Observed namespace "System.IO.UnmanagedMemoryStream" and TypeReference ".ctor" in "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e" Observed namespace "System.IO.UnmanagedMemoryStream" and TypeReference "Initialize" in "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e" Observed namespace "System.Runtime.InteropServices.MemoryMarshal" and TypeReference "GetReference" in "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e" Observed namespace "System.IO.UnmanagedMemoryStream" and TypeReference "Dispose" in "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e" Observed namespace "System.IO.UnmanagedMemoryStream" and TypeReference "get_PositionPointer" in "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "PtrToStringUni" in "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetFunctionPointerForDelegate" in "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "FreeHGlobal" in "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "StringToHGlobalUni" in "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "FreeCoTaskMem" in "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocCoTaskMem" in "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "StructureToPtr" in "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetLastWin32Error" in "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "PtrToStructure" in "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "Release" in "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ThrowExceptionForHR" in "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "IsComObject" in "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e"2a:T1ac1,Assembly shows XOR instruction xor eax ecx in Stream UID: 00000000-00006056-59998-3-0040D760 Assembly shows XOR instruction xor eax 72h in Stream UID: 00000000-00006056-59998-4-00431710 Assembly shows XOR instruction xor al 1Eh in Stream UID: 00000000-00006056-59998-4-00431710 Assembly shows XOR instruction xor eax 73h in Stream UID: 00000000-00006056-59998-4-00431710 Assembly shows XOR instruction xor eax 70h in Stream UID: 00000000-00006056-59998-4-00431710 Assembly shows XOR instruction xor eax 71h in Stream UID: 00000000-00006056-59998-4-00431710 Assembly shows XOR instruction xor eax 6Eh in Stream UID: 00000000-00006056-59998-4-00431710 Assembly shows XOR instruction xor eax 6Fh in Stream UID: 00000000-00006056-59998-4-00431710 Assembly shows XOR instruction xor eax 6Ch in Stream UID: 00000000-00006056-59998-4-00431710 Assembly shows XOR instruction xor eax 6Dh in Stream UID: 00000000-00006056-59998-4-00431710 Assembly shows XOR instruction xor eax 6Ah in Stream UID: 00000000-00006056-59998-4-00431710 Assembly shows XOR instruction xor eax 6Bh in Stream UID: 00000000-00006056-59998-4-00431710 Assembly shows XOR instruction xor eax 68h in Stream UID: 00000000-00006056-59998-4-00431710 Assembly shows XOR instruction xor eax 69h in Stream UID: 00000000-00006056-59998-4-00431710 Assembly shows XOR instruction xor eax 66h in Stream UID: 00000000-00006056-59998-4-00431710 Assembly shows XOR instruction xor eax 67h in Stream UID: 00000000-00006056-59998-4-00431710 Assembly shows XOR instruction xor eax esi in Stream UID: 00000000-00006056-59998-8-00404180 Assembly shows XOR instruction xor edi dword ptr [0044180Ch+eax*4] in Stream UID: 00000000-00006056-59998-8-00404180 Assembly shows XOR instruction xor esi edi in Stream UID: 00000000-00006056-59998-8-00404180 Assembly shows XOR instruction xor eax dword ptr [0044180Ch+esi*4] in Stream UID: 00000000-00006056-59998-8-00404180 Assembly shows XOR instruction xor eax edi in Stream UID: 00000000-00006056-59998-8-00404180 Assembly shows XOR instruction xor ebx dword ptr [0044180Ch+eax*4] in Stream UID: 00000000-00006056-59998-8-00404180 Assembly shows XOR instruction xor edi ebx in Stream UID: 00000000-00006056-59998-8-00404180 Assembly shows XOR instruction xor eax dword ptr [0044180Ch+edi*4] in Stream UID: 00000000-00006056-59998-8-00404180 Assembly shows XOR instruction xor bh bl in Stream UID: 00000000-00006056-59998-10-004042C0 Assembly shows XOR instruction xor ecx edi in Stream UID: 00000000-00006056-59998-10-004042C0 Assembly shows XOR instruction xor edx dword ptr [esi+3Ch] in Stream UID: 00000000-00006056-59998-12-00404FB0 Assembly shows XOR instruction xor dword ptr [esi+3Ch] 0000FFFFh in Stream UID: 00000000-00006056-59998-12-00404FB0 Assembly shows XOR instruction xor eax 1Fh in Stream UID: 00000000-00006056-59998-12-00404FB0 Assembly shows XOR instruction xor ecx FFFFFFFCh in Stream UID: 00000000-00006056-59998-13-00409A30 Assembly shows XOR instruction xor edi FFFFFFFEh in Stream UID: 00000000-00006056-59998-13-00409A30 Assembly shows XOR instruction xor edx ebx in Stream UID: 00000000-00006056-59998-14-00407B60 Assembly shows XOR instruction xor edi 08h in Stream UID: 00000000-00006056-59998-14-00407B60 Assembly shows XOR instruction xor ecx 08h in Stream UID: 00000000-00006056-59998-16-00408EE0 Assembly shows XOR instruction xor ecx eax in Stream UID: 00000000-00006056-59998-16-00408EE0 Assembly shows XOR instruction xor esi 02h in Stream UID: 00000000-00006056-59998-16-00408EE0 Assembly shows XOR instruction xor edi 02h in Stream UID: 00000000-00006056-59998-16-00408EE0 Assembly shows XOR instruction xor edi edx in Stream UID: 00000000-00006056-59998-16-00408EE0 Assembly shows XOR instruction xor esi edx in Stream UID: 00000000-00006056-59998-16-00408EE0 Assembly shows XOR instruction xor ecx edx in Stream UID: 00000000-00006056-59998-16-00408EE0 Assembly shows XOR instruction xor eax ecx in Stream UID: 00000000-00006056-59998-18-00407E60 Assembly shows XOR instruction xor ecx eax in Stream UID: 00000000-00006056-59998-18-00407E60 Assembly shows XOR instruction xor edx ecx in Stream UID: 00000000-00006056-59998-18-00407E60 Assembly shows XOR instruction xor edi edx in Stream UID: 00000000-00006056-59998-19-004044E0 Assembly shows XOR instruction xor ecx edi in Stream UID: 00000000-00006056-59998-19-004044E0 Assembly shows XOR instruction xor ecx esi in Stream UID: 00000000-00006056-59998-20-00403FB0 Assembly shows XOR instruction xor ecx edx in Stream UID: 00000000-00006056-59998-21-00404580 Assembly shows XOR instruction xor ebp edi in Stream UID: 00000000-00006056-59998-21-00404580 Assembly shows XOR instruction xor edi ebp in Stream UID: 00000000-00006056-59998-21-00404580 Assembly shows XOR instruction xor ecx 01h in Stream UID: 00000000-00006056-59998-21-00404580 Assembly shows XOR instruction xor ecx FFFFFE00h in Stream UID: 00000000-00006056-59998-21-00404580 Assembly shows XOR instruction xor edx FFFFFE00h in Stream UID: 00000000-00006056-59998-21-00404580 Assembly shows XOR instruction xor ecx 02h in Stream UID: 00000000-00006056-59998-23-00407120 Assembly shows XOR instruction xor ebp 02h in Stream UID: 00000000-00006056-59998-24-00409950 Assembly shows XOR instruction xor ecx eax in Stream UID: 00000000-00006056-59998-27-00431DD0 Assembly shows XOR instruction xor edx eax in Stream UID: 00000000-00006056-59998-29-004198D0 Assembly shows XOR instruction xor edx ecx in Stream UID: 00000000-00006056-59998-31-00427510 Assembly shows XOR instruction xor edx edi in Stream UID: 00000000-00006056-59998-31-00427510 Assembly shows XOR instruction xor eax ecx in Stream UID: 00000000-00006056-59998-34-0040AAE0 Assembly shows XOR instruction xor ecx edx in Stream UID: 00000000-00006056-59998-34-0040AAE0 Assembly shows XOR instruction xor ebx 02h in Stream UID: 00000000-00006056-59998-42-0043EEC0 Assembly shows XOR instruction xor ecx edx in Stream UID: 00000000-00006056-59998-42-0043EEC0 Assembly shows XOR instruction xor ecx 02h in Stream UID: 00000000-00006056-59998-50-0043F650 Assembly shows XOR instruction xor eax ecx in Stream UID: 00000000-00006056-59998-50-0043F650 Assembly shows XOR instruction xor ecx edx in Stream UID: 00000000-00006056-59998-53-0043F080 Assembly shows XOR instruction xor eax 01h in Stream UID: 00000000-00006056-59998-55-00403530 Assembly shows XOR instruction xor ecx 02h in Stream UID: 00000000-00006056-59998-57-00403880 Assembly shows XOR instruction xor eax 04h in Stream UID: 00000000-00006056-59998-57-00403880 Assembly shows XOR instruction xor eax ecx in Stream UID: 00000000-00006056-59998-58-0040EAD0 Assembly shows XOR instruction xor eax 01h in Stream UID: 00000000-00006056-59998-60-004031202b:T655,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains CRYPTO related strings Matched sigs: Able to decrypt/decode data Matched sigs: Contains ability to perform AES decryption (Dotnet String) Matched sigs: Contains reference to crypto DLLs Matched sigs: Contains ability to decode base64 data Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Able to perform cryptographic operations Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Calls an API typically used to decrypt data Matched sigs: Reads the cryptographic machine GUID Matched sigs: Contains ability to perform crypto operations Matched sigs: Contains ability to perform symmetric crypto operations Matched sigs: Dotnet file contains encryption/decryption functions Matched sigs: Contains ability to perform AES cryptographic operations (Dotnet) Matched sigs: Contains ability to perform asymmetric crypto operations Matched sigs: Able to decode string content at runtime (.NET) Matched sigs: Contains symmetric decryption functionality in .NET code Matched sigs: Contains ability to perform CryptoStream operations (Dotnet) Matched sigs: Contains ability to perform symmetric encryption (Dotnet) Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: Contains XOR operation loops [Stream disassembly]2c:T1d08,Found XOR loop in file "sample.bin" at offset 166622; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 430831; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 441817; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 550438; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 629854; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 795240; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 803478; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 814817; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 824469; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 835873; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 857864; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 908657; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 983655; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 992764; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1054915; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1071613; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1144250; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1159954; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1173868; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1201407; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1329821; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1459315; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1532555; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1547998; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1861272; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1878986; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1942009; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1948412; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1968015; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1977855; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2025557; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2047093; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2048820; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2082937; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2094330; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2139955; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2250921; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2295763; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 356942; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 361659; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 417449; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 455490; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 467774; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 469183; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 472711; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 529201; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 540608; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 614869; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 683096; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 864588; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 867843; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1085762; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1223704; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1248878; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1452881; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1567016; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1570161; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1618984; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1769116; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1902604; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1967221; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2023437; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2081682; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2099129; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2114041; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2136514; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2211438; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2214706; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2241068; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2428791; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 19355; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 110183; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 162278; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 408485; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 474206; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 591232; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 617813; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 711097; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 729458; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 732297; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 799734; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 991169; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1076278; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1121595; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1414550; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1479032; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1552140; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1621316; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1704463; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1947236; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1958393; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2050415; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2130054; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2139620; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2211309; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2224114; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2255338; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2426892; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2475773; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2573377; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2582925; code bytes = 80302d:T80e,"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000000000001400000000000000000000000000000000000000000000000200000240fd0f001b75006e00000000000000000000000080000000000000001b75006e107711000100000000000000020000000c000000b02f1100b02f1100ab2f1100000000000000000000000c0000000001a0f3310000000000c0f9310095e1fb762eb7eb01feffffff435cff765059ff7694000000a0000000aa2f1100a82f11009400000044f53100fdfef17524ee310001000000c0f9310092e0296bf9ba841bfeffffffdcf431004c9c296b5c0c0000f0f431005f9c296b0000000000000000 (UID: 00000000-00005720)2e:T1f77,"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "LoadLibrary" with a parameter mscorjit.dll (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "LoadLibrary" with a parameter clrjit.dll (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\a891970b44db9e340c3ef3efa95b793c\Microsoft.VisualBasic.ni.dll (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "LoadLibrary" with a parameter advapi32 (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00005720) "MSBuild.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006056) "MSBuild.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00006056) "MSBuild.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00006056) "MSBuild.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00006056) "MSBuild.exe" called "LoadLibrary" with a parameter wshtcpip (UID: 00000000-00006056) "MSBuild.exe" called "LoadLibrary" with a parameter wship6.dll (UID: 00000000-00006056) "MSBuild.exe" called "LoadLibrary" with a parameter DNSAPI.dll (UID: 00000000-00006056) "MSBuild.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00006056) "MSBuild.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00006056)2f:T6ad2,"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter SortGetHandle (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter SortCloseHandle (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSize (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter GetFileVersionInfo (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter VerQueryValue (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter VerLanguageName (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter VerLanguageNameW (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter LoadLibrary (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter CryptAcquireContext (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter CryptGetProvParam (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter CryptContextAddRef (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter CryptGetHashParam (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter CryptDuplicateKey (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter CryptSetKeyParam (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter CryptDecrypt (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter Wow64SetThreadContext (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter SetThreadContext (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter Wow64GetThreadContext (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter VirtualAllocEx (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter WriteProcessMemory (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter ReadProcessMemory (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter ZwUnmapViewOfSection (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter CreateProcessA (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00005720) "MSBuild.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006056) "MSBuild.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006056) "MSBuild.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006056) "MSBuild.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006056) "MSBuild.exe" called "GetProcAddress" with a parameter GetProductInfo (UID: 00000000-00006056) "MSBuild.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceW (UID: 00000000-00006056) "MSBuild.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceA (UID: 00000000-00006056) "MSBuild.exe" called "GetProcAddress" with a parameter RpcStringBindingComposeW (UID: 00000000-00006056) "MSBuild.exe" called "GetProcAddress" with a parameter RpcBindingFromStringBindingW (UID: 00000000-00006056) "MSBuild.exe" called "GetProcAddress" with a parameter RpcBindingSetAuthInfoExW (UID: 00000000-00006056) "MSBuild.exe" called "GetProcAddress" with a parameter RpcBindingSetOption (UID: 00000000-00006056) "MSBuild.exe" called "GetProcAddress" with a parameter RpcStringFreeW (UID: 00000000-00006056) "MSBuild.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00006056) "MSBuild.exe" called "GetProcAddress" with a parameter WSAStringToAddressW (UID: 00000000-00006056) "MSBuild.exe" called "GetProcAddress" with a parameter WSHAddressToString (UID: 00000000-00006056) "MSBuild.exe" called "GetProcAddress" with a parameter WSHEnumProtocols (UID: 00000000-00006056) "MSBuild.exe" called "GetProcAddress" with a parameter WSHGetProviderGuid (UID: 00000000-00006056) "MSBuild.exe" called "GetProcAddress" with a parameter WSHGetSockaddrType (UID: 00000000-00006056) "MSBuild.exe" called "GetProcAddress" with a parameter WSHGetSocketInformation (UID: 00000000-00006056) "MSBuild.exe" called "GetProcAddress" with a parameter WSHGetWSAProtocolInfo (UID: 00000000-00006056) "MSBuild.exe" called "GetProcAddress" with a parameter WSHGetWildcardSockaddr (UID: 00000000-00006056) "MSBuild.exe" called "GetProcAddress" with a parameter WSHGetWinsockMapping (UID: 00000000-00006056) "MSBuild.exe" called "GetProcAddress" with a parameter WSHIoctl (UID: 00000000-00006056) "MSBuild.exe" called "GetProcAddress" with a parameter WSHJoinLeaf (UID: 00000000-00006056) "MSBuild.exe" called "GetProcAddress" with a parameter WSHNotify (UID: 00000000-00006056) "MSBuild.exe" called "GetProcAddress" with a parameter WSHOpenSocket (UID: 00000000-00006056) "MSBuild.exe" called "GetProcAddress" with a parameter WSHOpenSocket2 (UID: 00000000-00006056) "MSBuild.exe" called "GetProcAddress" with a parameter WSHSetSocketInformation (UID: 00000000-00006056) "MSBuild.exe" called "GetProcAddress" with a parameter WSHStringToAddress (UID: 00000000-00006056) "MSBuild.exe" called "GetProcAddress" with a parameter UrlCanonicalizeW (UID: 00000000-00006056) "MSBuild.exe" called "GetProcAddress" with a parameter StrCmpNW (UID: 00000000-00006056) "MSBuild.exe" called "GetProcAddress" with a parameter DnsGetProxyInformation (UID: 00000000-00006056) "MSBuild.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00006056) "MSBuild.exe" called "GetProcAddress" with a parameter RpcBindingFree (UID: 00000000-00006056) "MSBuild.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00006056) "MSBuild.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00006056) "MSBuild.exe" called "GetProcAddress" with a parameter FreeAddrInfoW (UID: 00000000-00006056) "MSBuild.exe" called "GetProcAddress" with a parameter WSAGetOverlappedResult (UID: 00000000-00006056) "MSBuild.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00006056) "MSBuild.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00006056) "MSBuild.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00006056) "MSBuild.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00006056) "MSBuild.exe" called "GetProcAddress" with a parameter WSARecv (UID: 00000000-00006056) "MSBuild.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00006056)30:T757,"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" failed to load missing module "mscorjit.dll" - [base:0; Status:c0000135] "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" failed to load missing module "amsi.dll" - [base:0; Status:c0000135]31:Ta17,Observed unmanaged function "CreateWindowExW" in "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e" Observed unmanaged function "DefWindowProcW" in "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e" Observed unmanaged function "DestroyWindow" in "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e" Observed unmanaged function "DispatchMessageW" in "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e" Observed unmanaged function "GetClassInfoW" in "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e" Observed unmanaged function "GetMessageW" in "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e" Observed unmanaged function "GetProcessWindowStation" in "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e" Observed unmanaged function "GetUserObjectInformationW" in "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e" Observed unmanaged function "GetWindowThreadProcessId" in "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e" Observed unmanaged function "IsWindow" in "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e" Observed unmanaged function "KillTimer" in "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e" Observed unmanaged function "MsgWaitForMultipleObjectsEx" in "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e" Observed unmanaged function "PostMessageW" in "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e" Observed unmanaged function "PostQuitMessage" in "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e" Observed unmanaged function "RegisterClassW" in "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e" Observed unmanaged function "RegisterWindowMessageW" in "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e" Observed unmanaged function "SendMessageW" in "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e" Observed unmanaged function "SetClassLongW" in "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e" Observed unmanaged function "SetClassLongPtrW" in "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e" Observed unmanaged function "SetTimer" in "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e" Observed unmanaged function "SetWindowLongW" in "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e" Observed unmanaged function "SetWindowLongPtrW" in "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e"32:T1537,"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 71530000 "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" loaded module "KERNEL32" at base 75ed0000 "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" loaded module "ADVAPI32.DLL" at base 75fb0000 "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 6b850000 "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" loaded module "SHLWAPI.DLL" at base 75d00000 "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" loaded module "VERSION.DLL" at base 74340000 "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 646e0000 "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" loaded module "USER32.DLL" at base 75810000 "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" loaded module "MSCOREE.DLL" at base 6b8e0000 "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" loaded module "PSAPI.DLL" at base 75a40000 "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" loaded module "RPCRT4.DLL" at base 77140000 "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" loaded module "KERNEL32.DLL" at base 75ed0000 "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 632d0000 "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" loaded module "OLE32.DLL" at base 758e0000 "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" loaded module "CRYPTBASE.DLL" at base 74da0000 "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73d00000 "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 6c550000 "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 69cc0000 "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 6cd90000 "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 62870000 "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" loaded module "CLRJIT.DLL" at base 69cc0000 "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 62050000 "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.V9921E851#\A891970B44DB9E340C3EF3EFA95B793C\MICROSOFT.VISUALBASIC.NI.DLL" at base 61e60000 "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" loaded module "ADVAPI32" at base 75fb0000 "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" loaded module "CRYPTSP.DLL" at base 748b0000 "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74640000 "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" loaded module "NTDLL" at base 76fa0000 "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74d50000 "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 75e70000 "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" loaded module "RPCRTREMOTE.DLL" at base 74e40000 "MSBuild.exe" loaded module "KERNEL32.DLL" at base 75ed0000 "MSBuild.exe" loaded module "SSPICLI.DLL" at base 74d30000 "MSBuild.exe" loaded module "CRYPTSP.DLL" at base 748b0000 "MSBuild.exe" loaded module "RPCRT4.DLL" at base 77140000 "MSBuild.exe" loaded module "CREDSSP.DLL" at base 74540000 "MSBuild.exe" loaded module "ADVAPI32.DLL" at base 75fb0000 "MSBuild.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74870000 "MSBuild.exe" loaded module "WSHTCPIP" at base 743d0000 "MSBuild.exe" loaded module "WSHIP6.DLL" at base 74860000 "MSBuild.exe" loaded module "%WINDIR%\SYSTEM32\WSHQOS.DLL" at base 6ea20000 "MSBuild.exe" loaded module "DNSAPI.DLL" at base 74730000 "MSBuild.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 743d0000 "MSBuild.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 74860000 "MSBuild.exe" loaded module "IPHLPAPI.DLL" at base 71b90000 "MSBuild.exe" loaded module "RASADHLP.DLL" at base 6c6a0000 "MSBuild.exe" loaded module "WINHTTP.DLL" at base 710d0000 "MSBuild.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 70ed0000 "MSBuild.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 746b0000 "MSBuild.exe" loaded module "CRYPT32.DLL" at base 74f4000033:T4bd,"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"34:T988,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00005720-00000C2B-264790419] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00005720-00000C2B-265107573] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00005720-00000C2B-266154790] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00005720-00000C2B-266282576] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00005720-00000C2B-266518315] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00005720-00000C2B-266585349] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00005720-00000C2B-266822084] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00005720-00000C2B-267216522] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll" [Source: 00000000-00005720-00000C2B-267299053] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00005720-00000C2B-267384684] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00005720-00000C2B-267662039] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00005720-00000C2B-268503434] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\a891970b44db9e340c3ef3efa95b793c\Microsoft.VisualBasic.ni.dll" [Source: 00000000-00005720-00000C2B-268583496] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00005720-00000C2B-269650546] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00005720-00000C2B-269787853] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll" [Source: 00000000-00005720-00000C2B-269926355]35:Tc21,"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: ""; Value: "") "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: ""; Value: "") "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\SETUP"; Key: ""; Value: "") "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS NT\RPC"; Key: ""; Value: "") "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SQMCLIENT\WINDOWS"; Key: ""; Value: "") "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "") "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: ""; Value: "") "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\ERROR MESSAGE INSTRUMENT"; Key: ""; Value: "") "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: ""; Value: "") "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: ""; Value: "") "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IME COMPATIBILITY"; Key: ""; Value: "") "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: ""; Value: "") "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: ""; Value: "")36:Tefb,"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: "MAXRPCSIZE"; Value: "") "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME"; Value: "") "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "OOBEINPROGRESS"; Value: "") "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "SYSTEMSETUPINPROGRESS"; Value: "") "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SQMCLIENT\WINDOWS"; Key: "CEIPENABLE"; Value: "") "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "038AE1968E1CC1424184B684200CCED6E2DDD84D4D8557FC2A10330CB754F44E"; Value: "") "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "INSTALLROOT"; Value: "")37:T507,"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\config\machine.config" "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll.aux" "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\0b2f69b43a576b9edcc807a30872bd91\system.ni.dll.aux" "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\2c3c912ea8f058f9d04c4650128feb3f\system.ni.dll.aux" "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\microsoft.v9921e851#\a891970b44db9e340c3ef3efa95b793c\microsoft.visualbasic.ni.dll.aux" "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.core\31fae3290fad30c31c98651462d22724\system.core.ni.dll.aux" "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\msbuild.exe"38:Tcfc,"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" trying to touch file "C:\Windows\SYSTEM32\MSCOREE.DLL" "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" trying to touch file "C:\Windows\Temp\VxOle32.dll" "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" trying to touch file "C:\FLTLIB.DLL" "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" trying to touch file "C:\Windows\system32\FLTLIB.DLL" "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" trying to touch file "C:\MSVCP140.dll" "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" trying to touch file "C:\Windows\system32\MSVCP140.dll" "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" trying to touch file "C:\VCRUNTIME140.dll" "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" trying to touch file "C:\Windows\system32\VCRUNTIME140.dll" "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" trying to touch file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" trying to touch file "C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll" "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" trying to touch file "C:\ucrtbase.DLL" "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" trying to touch file "C:\Windows\system32\ucrtbase.DLL" "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" trying to touch file "C:\api-ms-win-core-timezone-l1-1-0.dll" "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-timezone-l1-1-0.dll" "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" trying to touch file "C:\api-ms-win-core-file-l2-1-0.dll" "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-file-l2-1-0.dll" "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" trying to touch file "C:\api-ms-win-core-localization-l1-2-0.dll" "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-localization-l1-2-0.dll" "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" trying to touch file "C:\api-ms-win-core-synch-l1-2-0.dll" "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-synch-l1-2-0.dll" "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" trying to touch file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-processthreads-l1-1-1.dll" "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" trying to touch file "C:\api-ms-win-core-file-l1-2-0.dll" "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-file-l1-2-0.dll"39:Tcf7,"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" trying to access non-existent file "C:\FLTLIB.DLL" "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" trying to access non-existent file "C:\MSVCP140.dll" "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" trying to access non-existent file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" trying to access non-existent file "C:\ucrtbase.DLL" "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" trying to access non-existent file "C:\api-ms-win-core-timezone-l1-1-0.dll" "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" trying to access non-existent file "C:\api-ms-win-core-file-l2-1-0.dll" "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" trying to access non-existent file "C:\api-ms-win-core-localization-l1-2-0.dll" "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" trying to access non-existent file "C:\api-ms-win-core-synch-l1-2-0.dll" "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" trying to access non-existent file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" trying to access non-existent file "C:\api-ms-win-core-file-l1-2-0.dll" "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" trying to access non-existent file "C:\api-ms-win-crt-heap-l1-1-0.dll" "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" trying to access non-existent file "C:\api-ms-win-crt-string-l1-1-0.dll" "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" trying to access non-existent file "C:\api-ms-win-crt-stdio-l1-1-0.dll" "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" trying to access non-existent file "C:\api-ms-win-crt-convert-l1-1-0.dll" "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" trying to access non-existent file "C:\api-ms-win-crt-locale-l1-1-0.dll" "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" trying to access non-existent file "C:\api-ms-win-crt-filesystem-l1-1-0.dll" "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" trying to access non-existent file "C:\api-ms-win-crt-time-l1-1-0.dll" "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" trying to access non-existent file "C:\api-ms-win-crt-environment-l1-1-0.dll" "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" trying to access non-existent file "C:\api-ms-win-crt-math-l1-1-0.dll" "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" trying to access non-existent file "C:\api-ms-win-crt-utility-l1-1-0.dll" "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL"3a:T758,"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" trying to access non-existent file "C:\Windows\SYSTEM32\MSCOREE.DLL.local" "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" trying to access non-existent file "C:\038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe.config" "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\BlueSapphir4bd2d513#\" "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" trying to access non-existent file "C:\038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.INI" "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" trying to access non-existent file "C:\038AE1968E1CC1424184B684200CCED6E2DDD84D4D8557FC2A10330CB754F44E.EXE.CONFIG" "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC" "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\BLUESAPPHIR4BD2D513#" "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" trying to access non-existent file "C:\038AE1968E1CC1424184B684200CCED6E2DDD84D4D8557FC2A10330CB754F44E.INI" "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME"3b:T8a9,"MSBuild.exe" called "WinHttpSendRequest" with parameters {"hRequest": "5e5590" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "act=life" "dwOptionalLength": "8" "dwTotalLength": "8" "dwContext": "0" "$error": "2ee7"} "MSBuild.exe" called "WinHttpSendRequest" with parameters {"hRequest": "5ec0b0" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "act=life" "dwOptionalLength": "8" "dwTotalLength": "8" "dwContext": "0" "$error": "2ee2"} "MSBuild.exe" called "WinHttpSendRequest" with parameters {"hRequest": "5e4f30" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "act=life" "dwOptionalLength": "8" "dwTotalLength": "8" "dwContext": "0" "$error": "2ee7"} "MSBuild.exe" called "WinHttpSendRequest" with parameters {"hRequest": "5e7840" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "act=life" "dwOptionalLength": "8" "dwTotalLength": "8" "dwContext": "0" "$error": "2f8f"} "MSBuild.exe" called "WinHttpSendRequest" with parameters {"hRequest": "5e7840" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "act=life" "dwOptionalLength": "8" "dwTotalLength": "8" "dwContext": "0" "$error": "2ee7"} "MSBuild.exe" called "WinHttpSendRequest" with parameters {"hRequest": "5e4f38" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "act=life" "dwOptionalLength": "8" "dwTotalLength": "8" "dwContext": "0" "$error": "2ee7"} "MSBuild.exe" called "WinHttpSendRequest" with parameters {"hRequest": "5e2aa8" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "act=life" "dwOptionalLength": "8" "dwTotalLength": "8" "dwContext": "0" "$error": "2f8f"} "MSBuild.exe" called "WinHttpSendRequest" with parameters {"hRequest": "5e2aa8" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0" "$error": "2f8f"}3c:Teac,"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00005720) "038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00005720)3d:Tdec,Found string "Sleep" (Source: 038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e, API is part of module: KERNELBASE.DLL) Found string "CreateWindowExW" (Source: 038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e, API is part of module: USER32.DLL) Found string "DefWindowProcW" (Source: 038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e, API is part of module: USER32.DLL) Found string "DestroyWindow" (Source: 038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e, API is part of module: USER32.DLL) Found string "DispatchMessageW" (Source: 038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e, API is part of module: USER32.DLL) Found string "GetClassInfoW" (Source: 038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e, API is part of module: USER32.DLL) Found string "GetMessageW" (Source: 038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e, API is part of module: USER32.DLL) Found string "GetProcessWindowStation" (Source: 038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e, API is part of module: USER32.DLL) Found string "GetUserObjectInformationW" (Source: 038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e, API is part of module: USER32.DLL) Found string "GetWindowThreadProcessId" (Source: 038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e, API is part of module: USER32.DLL) Found string "IsWindow" (Source: 038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e, API is part of module: USER32.DLL) Found string "KillTimer" (Source: 038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e, API is part of module: USER32.DLL) Found string "MsgWaitForMultipleObjectsEx" (Source: 038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e, API is part of module: USER32.DLL) Found string "PostMessageW" (Source: 038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e, API is part of module: USER32.DLL) Found string "PostQuitMessage" (Source: 038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e, API is part of module: USER32.DLL) Found string "RegisterClassW" (Source: 038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e, API is part of module: USER32.DLL) Found string "RegisterWindowMessageW" (Source: 038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e, API is part of module: USER32.DLL) Found string "SendMessageW" (Source: 038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e, API is part of module: USER32.DLL) Found string "SetClassLongW" (Source: 038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e, API is part of module: USER32.DLL) Found string "SetTimer" (Source: 038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e, API is part of module: USER32.DLL) Found string "SetWindowLongW" (Source: 038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e, API is part of module: USER32.DLL) Found string "TranslateMessage" (Source: 038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e, API is part of module: USER32.DLL) Found string "UnregisterClassW" (Source: 038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e, API is part of module: USER32.DLL) Found string "GetCurrentThreadId" (Source: 038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e, API is part of module: KERNELBASE.DLL) Found string "GetModuleHandleW" (Source: 038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e, API is part of module: KERNELBASE.DLL)3e:T7cc,Wrote 60 instructions to a remote process Wrote 3 instructions to a remote process Wrote 178 instructions to a remote process Wrote 224 instructions to a remote process Wrote 49 instructions to a remote process Wrote 36 instructions to a remote process Wrote 814 instructions to a remote process Wrote 76 instructions to a remote process Wrote 46 instructions to a remote process Wrote 179 instructions to a remote process Wrote 38 instructions to a remote process Wrote 592 instructions to a remote process Wrote 106 instructions to a remote process Wrote 231 instructions to a remote process Wrote 670 instructions to a remote process Wrote 896 instructions to a remote process Wrote 19 instructions to a remote process Wrote 407 instructions to a remote process Wrote 61 instructions to a remote process Wrote 163 instructions to a remote process Wrote 676 instructions to a remote process Wrote 86 instructions to a remote process Wrote 574 instructions to a remote process Wrote 56 instructions to a remote process Wrote 13 instructions to a remote process Wrote 10 instructions to a remote process Wrote 4 instructions to a remote process Wrote 21 instructions to a remote process Wrote 1 instructions to a remote process Wrote 234 instructions to a remote process Wrote 41 instructions to a remote process Wrote 384 instructions to a remote process Wrote 7 instructions to a remote process Wrote 215 instructions to a remote process Wrote 285 instructions to a remote process Wrote 227 instructions to a remote process Wrote 265 instructions to a remote process Wrote 140 instructions to a remote process Wrote 160 instructions to a remote process Wrote 14 instructions to a remote process Wrote 17 instructions to a remote process Wrote 39 instructions to a remote process Wrote 194 instructions to a remote process Wrote 368 instructions to a remote process Wrote 12 instructions to a remote process Wrote 113 instructions to a remote process3f:T954,Observed namespace "System.IO.UnmanagedMemoryStream" and TypeReference ".ctor" in "66e06cea88f93_BlueSapphire.exe" Observed namespace "System.IO.UnmanagedMemoryStream" and TypeReference "Initialize" in "66e06cea88f93_BlueSapphire.exe" Observed namespace "System.Runtime.InteropServices.MemoryMarshal" and TypeReference "GetReference" in "66e06cea88f93_BlueSapphire.exe" Observed namespace "System.IO.UnmanagedMemoryStream" and TypeReference "Dispose" in "66e06cea88f93_BlueSapphire.exe" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "66e06cea88f93_BlueSapphire.exe" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "66e06cea88f93_BlueSapphire.exe" Observed namespace "System.IO.UnmanagedMemoryStream" and TypeReference "get_PositionPointer" in "66e06cea88f93_BlueSapphire.exe" Observed namespace "System.IO.UnmanagedMemoryStream" and TypeReference "TryGetValue" in "66e06cea88f93_BlueSapphire.exe" Observed namespace "System.IO.UnmanagedMemoryStream" and TypeReference "Add" in "66e06cea88f93_BlueSapphire.exe" Observed namespace "System.IO.UnmanagedMemoryStream" and TypeReference "set_Item" in "66e06cea88f93_BlueSapphire.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "PtrToStringUni" in "66e06cea88f93_BlueSapphire.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetFunctionPointerForDelegate" in "66e06cea88f93_BlueSapphire.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "FreeHGlobal" in "66e06cea88f93_BlueSapphire.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "StringToHGlobalUni" in "66e06cea88f93_BlueSapphire.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "FreeCoTaskMem" in "66e06cea88f93_BlueSapphire.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "66e06cea88f93_BlueSapphire.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocCoTaskMem" in "66e06cea88f93_BlueSapphire.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "StructureToPtr" in "66e06cea88f93_BlueSapphire.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetLastWin32Error" in "66e06cea88f93_BlueSapphire.exe"40:Tc9d,Observed system executable string:"1,"fusion","GAC",01,"WinRT","NotApp",13,"System Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll",02,"Microsoft.VisualBasic Version=10.0.0.0 Culture=neutral PublicKeyToken=b03f5f7f11d50a3a",03,"System.Core Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll",0" [Source: 66e06cea88f93_BlueSapphire.exe.log] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00007256-00000C28-1334182637] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00007256-00000C28-1334532224] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00007256-00000C28-1334646553] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00007256-00000C28-1334713194] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00007256-00000C28-1335004992] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00007256-00000C28-1335038806] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00007256-00000C28-1335096321] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00007256-00000C28-1335180677] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00007256-00000C28-1335249657] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00007256-00000C28-1335396772] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" [Source: 00000000-00007256-00000C28-1336739110] Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00007256-00000C28-1337336000] Observed system executable string:"%WINDIR%\system32\kernel32.dll" [Source: 00000000-00007256-00000C28-1337598079] Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00007256-00000C28-1337723779] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00007256-00000C28-1337830125] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00007256-00000C28-1338843856] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00007256-00000C28-1338875372] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll" [Source: 00000000-00007256-00000C28-1338910410]41:T45d,The input sample is signed with a certificate issued by "CN=WE1, O=Google Trust Services, C=US" (SHA1: A1:B2:B9:3E:D0:27:35:59:A2:9B:C0:9C:54:E9:5D:E3:EA:33:5B:14; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R4, O=Google Trust Services LLC, C=US" (SHA1: 10:8F:BF:79:4E:18:EC:53:47:A4:14:E4:37:0C:C4:50:6C:29:7A:B2; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 93:2B:ED:33:9A:A6:92:12:C8:93:75:B7:93:04:B4:75:49:0B:89:A0; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert SHA2 Extended Validation Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 03:15:62:D2:00:87:A3:66:F2:B1:19:C5:E4:F1:A5:48:63:D8:80:91; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 7E:2F:3A:4F:8F:E8:FA:8A:57:30:AE:CA:02:96:96:63:7E:98:6F:3F; see report for more information)42:T9f0,Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007256.00000000.149096.02B80000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportpolic;oftware\policies\microsoft\windows" - Source: "00000000-00007256.00000000.149096.04D50000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\?\volume" - Source: "00000000-00007256.00000000.149096.72011000.00000020.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&httpsigupdate_baseurlforceupdatefrommusignaturedisablenotificationcloudbasedbehaviorblockingsignaturecategoryiddisablescheduledsignatureupdateonbatterysignatureupdatecatchupintervalsignatureslastcheckednissignatureslastupdateddeltaupdatefailurenissignatureversionnissignaturelocation%mpconfig_productappdatapath%\definition" - Source: "00000000-00007256.00000000.149096.72011000.00000020.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportspynetreportinglocationlocalsettingoverridesubmitsamplesconsentdisableblockatfirstseenheartbeatdelayindaysheartbeatsamplingratessloptionsbypassinternetcheckmapslatencyretrytimeoutthreatseveritydefaultactionemptykeyvaluedisableprivacymode%mpconfig_productappdatapath%\telemetryallowuseruiaccessuilockdownnotification_suppresssuppressrebootnotificationsuppresswdonotificationmpconfig_productcodenamempconfig_productpathmpconfig_productappdatapathmpconfig_productuserappdatapathmpconfig_appdataroot12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_reportingguid\msmplics.dllpconfigut-53e7e780-2330-40c6-94c6-be75e946e933software\microsoft\removaltools\mrtguidfalsemp_config_type_szmp_config_type_dwordmp_config_type_multi_szmp_config_type_binarymp_config_type_nonemp_config_origin_nonemp_config_origin_defaultmp_config_origin_preferencesmp_config_origin_mdm_policymp_config_origin_policy*sof**eof*t%uh%um%uspt%uhp%udp%udt%uh2000-01-01t%02u:%02u:%02umpclient_nouseunifiedschedulingenginelocalsystem2100-01-01t00:00:00d:(a;;fa;;;sy)(a;;frfx;;;ls)maintenanceregularmicrosoft\windows\windows" - Source: "00000000-00007256.00000000.149096.72011000.00000020.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00007256.00000000.149096.720B1000.00000020.mdmp")43:Tb1c,"66e06cea88f93_BlueSapphire.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00007256) "66e06cea88f93_BlueSapphire.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00007256) "66e06cea88f93_BlueSapphire.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00007256) "66e06cea88f93_BlueSapphire.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00007256) "66e06cea88f93_BlueSapphire.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00007256) "66e06cea88f93_BlueSapphire.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00007256) "66e06cea88f93_BlueSapphire.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00007256) "66e06cea88f93_BlueSapphire.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00007256) "66e06cea88f93_BlueSapphire.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00007256) "66e06cea88f93_BlueSapphire.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00007256) "66e06cea88f93_BlueSapphire.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00007256) "66e06cea88f93_BlueSapphire.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00007256) "66e06cea88f93_BlueSapphire.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00007256) "66e06cea88f93_BlueSapphire.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00007256) "66e06cea88f93_BlueSapphire.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00007256) "66e06cea88f93_BlueSapphire.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00007256) "66e06cea88f93_BlueSapphire.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00007256) "66e06cea88f93_BlueSapphire.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00007256) "66e06cea88f93_BlueSapphire.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00007256) "66e06cea88f93_BlueSapphire.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00007256) "66e06cea88f93_BlueSapphire.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00007256) "66e06cea88f93_BlueSapphire.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00007256) "66e06cea88f93_BlueSapphire.exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00007256) "66e06cea88f93_BlueSapphire.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00007256)44:T5c6,Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; File: "66e06cea88f93_BlueSapphire.exe") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007256.00000000.149096.02B80000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007256.00000000.149096.02B80000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00007256.00000000.149096.02B80000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007256.00000000.149096.02B80000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007256.00000000.149096.02B80000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00007256.00000000.149096.02B80000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00007256.00000000.149096.02B80000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00007256.00000000.149096.02B80000.00000004.mdmp")45:T665,Detected alert "ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup (preachstrwnwjw .shop)" (SID: 2055789, Rev: 1, Severity: 1) categorized as "Domain Observed Used for C2 Detected" (PUA/PUP/Adware) Detected alert "ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup (charistmatwio .shop)" (SID: 2055783, Rev: 1, Severity: 1) categorized as "Domain Observed Used for C2 Detected" (PUA/PUP/Adware) Detected alert "ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup (grassemenwji .shop)" (SID: 2055779, Rev: 1, Severity: 1) categorized as "Domain Observed Used for C2 Detected" (PUA/PUP/Adware) Detected alert "ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup (ignoracndwko .shop)" (SID: 2055777, Rev: 1, Severity: 1) categorized as "Domain Observed Used for C2 Detected" (PUA/PUP/Adware) Detected alert "ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup (commisionipwn .shop)" (SID: 2055775, Rev: 1, Severity: 1) categorized as "Domain Observed Used for C2 Detected" (PUA/PUP/Adware) Detected alert "ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup (stitchmiscpaew .shop)" (SID: 2055781, Rev: 1, Severity: 1) categorized as "Domain Observed Used for C2 Detected" (PUA/PUP/Adware) Detected alert "ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup (complainnykso .shop)" (SID: 2055787, Rev: 1, Severity: 1) categorized as "Domain Observed Used for C2 Detected" (PUA/PUP/Adware) Detected alert "ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup (basedsymsotp .shop)" (SID: 2055785, Rev: 1, Severity: 1) categorized as "Domain Observed Used for C2 Detected" (PUA/PUP/Adware)46:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAABmZkZmRERmZnAAAAAAAAAAZmZmZkREZmZ3gAAAAAAAAGZmRGZkREZmeIAAAAAAAABERkRmZmRGZmZwAAAAAAAARGZkZmZkRmZmYAAAAAAAAGZmRGZmZmZmZmAAAAAAAABmZkZmRERmZmZwAAAAAAAAZmZmZkRERmZmcAAAAAAAAGZmZmZEREZmZnAAAAAAAABmZmZkRERmZniAAAAAAAAAZmZmZEREZmZ4gAAAAAAAAGZmZmRERGZmd4AAAAAAAABmZmZmRERmZmZgAAAAAAAAZmZ2ZkRGZmZmYAAAAAAAAGZmdmZ3d3d3ZnAAAAAAAABmZ3dmZkZmZmZgAAAAAAAAd3d3d3dmd4iHYAAAAAAAAGd4d3d3dnZm5mAAAAAAAABneHeHdmZ2ZuZwAAAAAAAAZ3h3h3d2ZmZmYAAAAAAAAHd3d3d3d2ZmZoAAAAAAAAB3d3d3d3dmbmdwAAAAAAAAd3h3d3d2Zu5mcAAAAAAAAHd4d3d3dmZuaIAAAAAAAAB3iHd3d3dmZmdwAAAAAAAAeIiHd3d3dmaIgAAAAAAAAIiIiHd3d3fmeIAAAAAAAACIiIh3d3h3ZmiAAAAAAAAAiIiIh3d3iGYAAAAAAAAAAIiIiIiHeHAAAAAAAAAAAACIiIiIgAAAAAAAAAAAAAAAAIiIAAAAAAAAAAAAD+AAD//gAAP/4AAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAD/AAAA/+AAAP/4AAD/+AAA//gAAP/4AAD/+AAA//gAAP/4AAD/+AAA//gAAP/4AAD/+AAA//gAAP/4AAD/+AAA//gAAP/4AAD/+AAA//gAB//4AD//+AP///4f//w==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790895870117,"unified_at":"2026-10-01T23:04:30.117Z","metadata":{"hashes":{"sha256":"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e","sha1":"8c24b6f02987b0e768af17ef34d5d40df8b13cf2","md5":"0feebe85e6413561e738588cad1076a3","sha512":"b71ab723274a8b35ae46f8e4f236057bb28dbd4a13673f00596910a8d71d7f814894c09c1fedc6981e0e4077236871170b9819490df31e092ad0d36fcd75e033","ssdeep":"49152:A9zw3eubztBBCJwXEsUBc5FW/bGMeO4D7oN96TIaZ80Yjhz7bB:AK3vVIaIwECMeO4YNARxYN7bB","ssdeep_chunks":["49152:A9zw3eu","49152:9zw3eub","49152:zw3eubz","49152:w3eubzt","49152:3eubztB","49152:eubztBB","49152:ubztBBC","49152:bztBBCJ","49152:ztBBCJw","49152:tBBCJwX","49152:BBCJwXE","49152:BCJwXEs","49152:CJwXEsU","49152:JwXEsUB","49152:wXEsUBc","49152:XEsUBc5","49152:EsUBc5F","49152:sUBc5FW","49152:UBc5FW/","49152:Bc5FW/b","49152:c5FW/bG","49152:5FW/bGM","49152:FW/bGMe","49152:W/bGMeO","49152:/bGMeO4","49152:bGMeO4D","49152:GMeO4D7","49152:MeO4D7o","49152:eO4D7oN","49152:O4D7oN9","49152:4D7oN96","49152:D7oN96T","49152:7oN96TI","49152:oN96TIa","49152:N96TIaZ","49152:96TIaZ8","49152:6TIaZ80","49152:TIaZ80Y","49152:IaZ80Yj","49152:aZ80Yjh","49152:Z80Yjhz","49152:80Yjhz7","49152:0Yjhz7b","49152:Yjhz7bB","98304:A9zw3eu","98304:9zw3eub","98304:zw3eubz","98304:w3eubzt","98304:3eubztB","98304:eubztBB","98304:ubztBBC","98304:bztBBCJ","98304:ztBBCJw","98304:tBBCJwX","98304:BBCJwXE","98304:BCJwXEs","98304:CJwXEsU","98304:JwXEsUB","98304:wXEsUBc","98304:XEsUBc5","98304:EsUBc5F","98304:sUBc5FW","98304:UBc5FW/","98304:Bc5FW/b","98304:c5FW/bG","98304:5FW/bGM","98304:FW/bGMe","98304:W/bGMeO","98304:/bGMeO4","98304:bGMeO4D","98304:GMeO4D7","98304:MeO4D7o","98304:eO4D7oN","98304:O4D7oN9","98304:4D7oN96","98304:D7oN96T","98304:7oN96TI","98304:oN96TIa","98304:N96TIaZ","98304:96TIaZ8","98304:6TIaZ80","98304:TIaZ80Y","98304:IaZ80Yj","98304:aZ80Yjh","98304:Z80Yjhz","98304:80Yjhz7","98304:0Yjhz7b","98304:Yjhz7bB","49152:AK3vVIa","49152:K3vVIaI","49152:3vVIaIw","49152:vVIaIwE","49152:VIaIwEC","49152:IaIwECM","49152:aIwECMe","49152:IwECMeO","49152:wECMeO4","49152:ECMeO4Y","49152:CMeO4YN","49152:MeO4YNA","49152:eO4YNAR","49152:O4YNARx","49152:4YNARxY","49152:YNARxYN","49152:NARxYN7","49152:ARxYN7b","49152:RxYN7bB"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"66e06cea88f93_BlueSapphire.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":2590720,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1726010112000,"last_seen":1789892292000,"last_multi_scan":1789892292000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["credentialharvesting","commodity","lummastealer","criminal","informationstealer","malicious","slashnext:socialengineering"]},"stats":{"av":{"malicious_count":18,"suspicious_count":0,"total_engines":24},"attributions":{"malware_families_count":2,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":72},"sandbox_signatures":{"informative_count":186,"suspicious_count":17,"malicious_count":11,"total":214},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/MSIL.Crypt","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W32.MalwareX","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Lazy.601031","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Packed.Malwarex-10033462-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Lazy.601031 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/Kryptik.AMGY trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"malicious","threat_name":"UDS:Trojan.MSIL.Crypt.gen.hzsu","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"TrojanSpy/MSIL.Agent.dz","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005d05be1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"high_entropy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/MSIL_Kryptik.LNB.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.MSIL.HGW","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Kryptik.Win32.4877662","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Lazy.Generic","sources":[{"report_type":"quickscan","report_id":""}]},{"value":"LummaStealer","sources":[{"report_type":"qsp","report_id":""}]}]},"mitre_attacks":[{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to gather system information (Dotnet)"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Reads the active computer name"},{"type":"suspicious","value":"Contains ability to query CPU information"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"tactic":"Discovery","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"suspicious","value":"Queries kernel debugger information"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"tactic":"Collection","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about pressed keystrokes (API string)"},{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"},{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"},{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – Anomalous PE file structure"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"}]},{"tactic":"Discovery","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Found Native API in Dotnet file"},{"type":"informative","value":".NET source code contains suspicious native API"},{"type":"informative","value":"Contains native function calls (syscalls strings)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Dotnet source code contains suspicious native API"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Can loads assembly that contains the code that is currently executing [Dotnet]"},{"type":"informative","value":"Dotnet code contains potential unpacker"},{"type":"informative","value":"Contains ability to generate intermediate language instructions (Dotnet)"},{"type":"informative","value":"Can load assembly that contains the code that is currently executing (Dotnet)"},{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Able to retrieve running process details (.NET)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Contains ability to gather process details (Dotnet)"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"}]},{"tactic":"Privilege Escalation","technique":"Shortcut Modification","attack_id":"T1547.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/009","identifiers":[{"type":"informative","value":"Contains ability to register hotkeys (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to perform CryptoStream operations (Dotnet)"},{"type":"informative","value":"Contains ability to perform symmetric encryption (Dotnet)"},{"type":"informative","value":"Contains ability to perform crypto operations"},{"type":"informative","value":"YARA signature match – high entropy image embedded in .NET resource"},{"type":"informative","value":"Dotnet file contains encryption/decryption functions"},{"type":"informative","value":"Contains ability to perform AES cryptographic operations (Dotnet)"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Dotnet file resource with suspicious entropy"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Contains ability to load content from resource"},{"type":"informative","value":"Contains ability to load manifest resource from assembly (Dotnet)"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"tactic":"Defense Evasion","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform AES decryption (Dotnet String)"},{"type":"informative","value":"Able to load content into memory (.NET)"},{"type":"informative","value":"Contains symmetric decryption functionality in .NET code"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"},{"type":"informative","value":"Contains ability to perform symmetric decryption (Dotnet)"},{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Contains ability to decode base64 data"},{"type":"informative","value":"Able to decode string content at runtime (.NET)"},{"type":"informative","value":"Contains ability to decode string content at runtime (Dotnet)"},{"type":"informative","value":"Contains ability to load content into memory (Dotnet)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Reads files"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contacts server"},{"type":"suspicious","value":"Detected Suricata Alert - CnC Activity"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1021.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1021/001","identifiers":[{"type":"informative","value":"Contains ability to perform remote desktop activity (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","identifiers":[{"type":"malicious","value":"Application communicates with a malicious domain"}],"sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Connects to LPC ports"}],"sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes shellcode to a remote process"},{"type":"informative","value":"Found PE header in memory"},{"type":"malicious","value":"Writes data to a remote process"},{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"}],"sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"},{"type":"suspicious","value":"Adjusts debug privileges"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify process memory (API string)"},{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"informative","value":"Contains ability to unmap view of a section from a process (API string)"},{"type":"malicious","value":"Sets thread context in a remote process (often injection or process hollowing)"}],"sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains strings related to AMSI (Anti Malware Scan Interface)"},{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"}],"sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"}]},{"tactic":"Defense Evasion","technique":"MSBuild","attack_id":"T1127.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1127/001","identifiers":[{"type":"suspicious","value":"Detected MSBuild process execution"}],"sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy resources"},{"type":"informative","value":"Dotnet file contains function to dynamically call methods at runtime"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"},{"type":"suspicious","value":"section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"The input sample contains the RDTSCP instruction"},{"type":"informative","value":"The input sample possibly contains the RDTSCP instruction"}],"sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Able to modify Remote Configuration"},{"type":"informative","value":"Calls an API typically used to register an interface (RPC)"}],"sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Able to capture drag-drop file operations"},{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains ability to perform encryption/decryption using RSA algorithm"},{"type":"informative","value":"Contains ability to perform asymmetric crypto operations"}],"sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Calls an API typically used to send the specified request to the HTTP server"},{"type":"informative","value":"GETs files from a webserver (HTTPS)"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"}],"sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"},{"type":"malicious","value":"Makes HTTPS connections using an insecure TLS/SSL version"},{"type":"informative","value":"Uses HTTPS for communication"}],"sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"},{"type":"informative","value":"Contains ability to perform symmetric crypto operations"}],"sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"}],"sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"}]},{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Short-term SSL certificate detected"},{"type":"informative","value":"Recently renewed or created SSL certificate"}],"sources":[{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"informative","value":"Contains ability to interact with Microsoft Outlook"}],"sources":[{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"suspicious","value":"Found a potential E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Writes log files"}],"sources":[{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"May execute SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","sources":[{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]}],"sandbox_signatures":[{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – Anomalous PE file structure","description":"YARA signature for invalid number of Rva and Size of PE file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1027.013","id":"yara-153","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (On Sensor) detected file with low confidence","description":"\"Portable Executable (On Sensor) Model\" detected file as \"dirty\" with \"low\" confidence","origin":"Static Analysis","id":"mlmodel-14","sources":[{"report_type":"qsp","report_id":""}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (Cloud) detected file with medium confidence","description":"\"Portable Executable (Cloud) Model\" detected file as \"dirty\" with \"medium\" confidence","origin":"Static Analysis","id":"mlmodel-17","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains native function calls (syscalls strings)","description":"$27","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-5000","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$28","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"General","name":"Can load assembly that contains the code that is currently executing (Dotnet)","description":"Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1620","id":"string-615","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"}]},{"level":"informative","category":"General","name":"Contains ability to register hotkeys (API string)","description":"Found reference to API \"RegisterHotKey\" (Indicator: \"RegisterHotKey\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1547.009","id":"string-545","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-272","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1564.003","id":"string-208","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"MapVirtualKey\" (Indicator: \"MapVirtualKey\"; Source: \"sample.bin\"), Found reference to API \"RegisterHotKey\" (Indicator: \"RegisterHotKey\"; Source: \"sample.bin\"), Found reference to API \"GetAsyncKeyState\" (Indicator: \"GetAsyncKeyState\"; Source: \"sample.bin\"), Found reference to API \"UnregisterHotKey\" (Indicator: \"UnregisterHotKey\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1056.001","id":"string-88","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-427","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetProcessById\" (Indicator: \"GetProcessById\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-85","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"GetDesktopWindow\" (Indicator: \"GetDesktopWindow\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1113","id":"string-78","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"System.Security.Cryptography\" (Indicator: \"System.Security.Cryptography\"; Source: \"sample.bin\"), Found string \"CreateDecryptor\" (Indicator: \"createdecryptor\"; Source: \"sample.bin\"), Found string \"System.Security.Cryptography.AesCryptoServiceProvider\" (Indicator: \"aes\"; Source: \"sample.bin\"), Found string \"System.Security.Cryptography.AesCryptoServiceProvider\" (Indicator: \"aescryptoserviceprovider\"; Source: \"sample.bin\"), Found string \"System.Security.Cryptography.AesCryptoServiceProvider\" (Indicator: \"System.Security.Cryptography\"; Source: \"sample.bin\"), Found string \"AesCryptoServiceProvider\" (Indicator: \"aes\"; Source: \"sample.bin\"), Found string \"AesCryptoServiceProvider\" (Indicator: \"aescryptoserviceprovider\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-57","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-317","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; Source: \"sample.bin\"), Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1033","id":"string-121","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-205","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"ErrorGetTempPath\" (Indicator: \"GetTempPath\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-207","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameEx\" (Indicator: \"GetModuleFileName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-164","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-131","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"Oid2rnw8Xx46hGuUtVt\" (Indicator: \"Oid\"; Source: \"sample.bin\"), Found reference to \"SymmetricAlgorithm\" (Indicator: \"SymmetricAlgorithm\"; Source: \"sample.bin\"), Found reference to \"SHA256CryptoServiceProvider\" (Indicator: \"SHA256CryptoServiceProvider\"; Source: \"sample.bin\"), Found reference to \"HashAlgorithm\" (Indicator: \"HashAlgorithm\"; Source: \"sample.bin\"), Found reference to \"System.Security.Cryptography.AesCryptoServiceProvider\" (Indicator: \"Aes\"; Source: \"sample.bin\"), Found reference to \"System.Security.Cryptography.AesCryptoServiceProvider\" (Indicator: \"AesCryptoServiceProvider\"; Source: \"sample.bin\"), Found reference to \"AesCryptoServiceProvider\" (Indicator: \"Aes\"; Source: \"sample.bin\"), Found reference to \"AesCryptoServiceProvider\" (Indicator: \"AesCryptoServiceProvider\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-138","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"MsgWaitForMultipleObjects\" (Indicator: \"WaitForMultipleObjects\"; Source: \"sample.bin\"), Found reference to API \"MsgWaitForMultipleObjectsEx\" (Indicator: \"WaitForMultipleObjects\"; Source: \"sample.bin\"), Found reference to API \"MsgWaitForMultipleObjectsEx\" (Indicator: \"WaitForMultipleObjectsEx\"; Source: \"sample.bin\"), Found reference to API \"SetTimer\" (Indicator: \"SetTimer\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-226","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"sample.bin\"), Found reference to API \"LoadLibrary\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.001","id":"string-318","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"WTSRegisterSessionNotification\" in \"sample.bin\", Found system information discovery API: \"GetUserObjectInformationW\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-89","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"SendMessageW\" (Indicator: \"sendmessage\"; Source: \"sample.bin\"), Found reference to API \"PostMessage\" (Indicator: \"postmessage\"; Source: \"sample.bin\"), Found reference to API \"SendMessageTimeout\" (Indicator: \"sendmessage\"; Source: \"sample.bin\"), Found reference to API \"PostMessageW\" (Indicator: \"postmessage\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.015","id":"string-721","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to perform remote desktop activity (API string)","description":"Found reference to API \"WTSRegisterSessionNotification\" (Indicator: \"WTSRegisterSessionNotification\"; Source: \"sample.bin\"), Found reference to API \"WTSUnRegisterSessionNotification\" (Indicator: \"WTSUnRegisterSessionNotification\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1021.001","id":"string-436","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"bluesapphire_portable.my\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-183","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"Found reference to API \"UnhookWinEvent\" (Indicator: \"UnhookWinEvent\"; Source: \"sample.bin\"), Found reference to API \"SetWinEventHook\" (Indicator: \"SetWinEventHook\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1056.001","id":"string-91","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"Found reference to API \"CreateDecryptor\" (Indicator: \"CreateDecryptor\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1140","id":"string-356","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES decryption (Dotnet String)","description":"Observed string: \"System.Security.Cryptography.AesCryptoServiceProvider.System.Security.Cryptography.AesCryptoServiceProvider.CreateDecryptor\" in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1140","id":"string-445","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibrary\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-310","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"Found string \"system.io.compression.zipfile.dll\" (Source: \"00000000-00005720.00000001.80881.000C0000.00000004.mdmp\")\n Found string \"clrcompression.dll\" (Source: \"00000000-00005720.00000001.80881.000C0000.00000004.mdmp\")\n Found string \"system.io.compression.dll\" (Source: \"00000000-00005720.00000001.80881.000C0000.00000004.mdmp\")\n Found string \"system.io.compression.filesystem.dll\" (Source: \"00000000-00005720.00000001.80881.000C0000.00000004.mdmp\")\n Found string \"Switch.System.IO.Compression.DoNotUseNativeZipLibraryForDecompression\" (Source: \"00000000-00005720.00000001.80881.01D90000.00000004.mdmp\")\n Found string \"decompression failed or archive is corrupted\" (Source: \"00000000-00005720.00000001.80881.01D90000.00000004.mdmp\")\n Found string \"compression failed\" (Source: \"00000000-00005720.00000001.80881.01D90000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00005720.00000000.80738.01D90000.00000004.mdmp\")\n Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00005720.00000001.80881.01D90000.00000004.mdmp\")\n Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00005720.00000001.80881.01D90000.00000004.mdmp\")\n Found reference to API \"WriteProcessMemory\" (Indicator: \"WriteProcessMemory\"; Source: \"00000000-00005720.00000001.80881.01D90000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to load content into memory (.NET)","description":"$29","origin":"Static Parser","mitre_attack_id":"T1140","relevance":5,"id":"static-107","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify process memory (API string)","description":"Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00005720.00000001.80881.01D90000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","id":"string-439","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00005720.00000001.80881.01D90000.00000004.mdmp\")\n Found reference to API \"Wow64SetThreadContext\" (Indicator: \"SetThreadContext\"; Source: \"00000000-00005720.00000001.80881.01D90000.00000004.mdmp\")\n Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; Source: \"00000000-00005720.00000001.80881.01D90000.00000004.mdmp\")\n Found reference to API \"Wow64GetThreadContext\" (Indicator: \"GetThreadContext\"; Source: \"00000000-00005720.00000001.80881.01D90000.00000004.mdmp\")\n Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; Source: \"00000000-00005720.00000001.80881.01D90000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to generate intermediate language instructions (Dotnet)","description":"Observed namespace \"System.Reflection.Emit.DynamicMethod\" and TypeReference \"GetILGenerator\" in \"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e\"\n Observed namespace \"System.Reflection.Emit.ILGenerator\" and TypeReference \"Emit\" in \"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e\"","origin":"Static Parser","mitre_attack_id":"T1620","relevance":1,"id":"static-171","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load content from resource","description":"Observed function \"ResourceManager.GetObject\" in \"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-112","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load manifest resource from assembly (Dotnet)","description":"Observed namespace \"System.Reflection.Assembly\" and TypeReference \"GetManifestResourceStream\" in \"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-173","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00005720.00000001.80881.01D90000.00000004.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00005720.00000001.80881.01D90000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to unmap view of a section from a process (API string)","description":"Found reference to API \"ZwUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00005720.00000001.80881.01D90000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.012","relevance":1,"id":"string-90","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"Observed string: \"AmsiScanBuffer\" (Indicator: \"amsiscanbuffer\") in Source: 00000000-00005720.00000001.80881.00317000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-231","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet code contains potential unpacker","description":"Observed function \"System.Reflection.Load\" in \"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e\"","origin":"Static Parser","mitre_attack_id":"T1620","relevance":1,"id":"static-115","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file contains encryption/decryption functions","description":"Observed namespace \"System.Security.Cryptography\" and MemberReference \"CreateDecryptor\" in \"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e\"\n Observed namespace \"System.Security.Cryptography\" and MemberReference \"TransformFinalBlock\" in \"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-134","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file contains function to dynamically call methods at runtime","description":"Observed namespace \"System.Diagnostics\" and MemberReference \"GetMethod\" in \"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e\"\n Observed namespace \"System\" and MemberReference \"GetMethod\" in \"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":1,"id":"static-135","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file resource with suspicious entropy","description":"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e has big resource with name: \"K4EOAq6xxwi0sWXp06.g6LWBYlatv4X6y5Xas\" size: \"1838410\" and abnormal entropy:\"7.9999080817148345\"\n 038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e has big resource with name: \"oir4dsOgEyh9279aHk.b0pdTMJxynYZ8VPRGv\" size: \"235497\" and abnormal entropy:\"7.999218189562049\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-129","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00005720.00000001.80881.005B0000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005720.00000001.80881.01D90000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005720.00000001.80881.04760000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005720.00000001.80881.04940000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decode string content at runtime (.NET)","description":"Observed function \"FromBase64String\" in \"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e\"\n Observed function \"ToBase64String\" in \"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":5,"id":"static-106","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$2a","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"00000000-00005720.00000001.80881.005B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES cryptographic operations (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.AesCryptoServiceProvider\" and TypeReference \"CreateDecryptor\" in \"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-167","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform CryptoStream operations (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.CryptoStream\" and TypeReference \"FlushFinalBlock\" in \"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-166","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform asymmetric crypto operations","description":"Observed namespace \"System.Security.Cryptography.RSACryptoServiceProvider\" and TypeReference \"set_UseMachineKeyStore\" in \"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e\"","origin":"Static Parser","mitre_attack_id":"T1573.002","relevance":1,"id":"static-141","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform crypto operations","description":"Observed namespace \"System.Security.Cryptography\" in [Source: \"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e\"]","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-118","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"RSACryptoServiceProvider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00005720.00000001.80881.005B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-352","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform symmetric crypto operations","description":"Observed namespace \"System.Security.Cryptography.AesCryptoServiceProvider\" and TypeReference \"CreateDecryptor\" in \"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e\"\n Observed namespace \"System.Security.Cryptography.AesCryptoServiceProvider\" and TypeReference \".ctor\" in \"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e\"\n Observed namespace \"System.Security.Cryptography.AesCryptoServiceProvider\" and TypeReference \"set_Key\" in \"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e\"\n Observed namespace \"System.Security.Cryptography.RijndaelManaged\" and TypeReference \".ctor\" in \"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e\"","origin":"Static Parser","mitre_attack_id":"T1573.001","relevance":1,"id":"static-140","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform symmetric encryption (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateEncryptor\" in \"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-165","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00005720.00000000.80738.000C0000.00000004.mdmp, 00000000-00005720.00000001.80881.000C0000.00000004.mdmp\")\n Found string \"C:\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00005720.00000000.80738.01D90000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains symmetric decryption functionality in .NET code","description":"Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateDecryptor\" in \"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-168","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.82199","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$2b","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2c","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00005720.00000001.80881.01D90000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00005720-00000C2C-266278635\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00005720-00000C2C-266279550\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00006056-00000C2C-271122340\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00005720)\n \"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00005720)\n \"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe\" called \"GlobalMemoryStatusEx\" with parameters (UID: 00000000-00005720)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00005720)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe\" called \"IsWow64Process\" with parameter \"5720\" - (UID: 00000000-00005720)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005720)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2d","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe\" called \"GetVersionExA\" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000001005c005300c051100011000011a93d00008092110040fd0f00b1080000aaa8640000200000b0080000580f00000d004200a2000000b1080000a1000000a1080000c9570000000000000000000036a8ffff5c00500000000000b1080000 (UID: 00000000-00005720)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00005720)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00005720)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to gather system information (Dotnet)","description":"Observed function \"get_OSVersion\" in \"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":1,"id":"static-120","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe\" queries volume information of \"C:\\038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe\" at 00000000-00005720-0000010C-2783836","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"General","name":".NET source code contains suspicious native API","description":"Observed API \"GetProcAddress\" in \"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e\"\n Observed API \"LoadLibrary\" in \"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e\"\n Observed API \"MapVirtualKey\" in \"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e\"\n Observed API \"GetAsyncKeyState\" in \"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":5,"id":"static-126","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe\" called \"CreateProcessA\" with parameter \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe\" - (UID: 00000000-00005720)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2e","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2f","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"54.146.6.253:443\"\n \"3.222.192.211:443\"\n \"52.27.79.221:443\"\n \"44.244.22.128:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"SelectionItemPattern_RemoveFromSelection\" (Source: 038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e, Indicator: \"selectionitempattern_removefromselection\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; Source: \"00000000-00005720.00000001.80881.01D90000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00005720.00000001.80881.01D90000.00000004.mdmp\")\n Found reference to API \"Wow64SetThreadContext\" (Indicator: \"SetThreadContext\"; Source: \"00000000-00005720.00000001.80881.01D90000.00000004.mdmp\")\n Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; Source: \"00000000-00005720.00000001.80881.01D90000.00000004.mdmp\")\n Found reference to API \"Wow64GetThreadContext\" (Indicator: \"GetThreadContext\"; Source: \"00000000-00005720.00000001.80881.01D90000.00000004.mdmp\")\n Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; Source: \"00000000-00005720.00000001.80881.01D90000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"System\\CurrentControlSet\\Control\\Nls\\RegionMapping\" in Source: 00000000-00005720.00000000.80738.01D90000.00000004.mdmp\n 00000000-00005720.00000001.80881.01D90000.00000004.mdmp\n \"SOFTWARE\\Microsoft\\.NETFramework\\AppContext\" in Source: 00000000-00005720.00000000.80738.01D90000.00000004.mdmp\n 00000000-00005720.00000001.80881.01D90000.00000004.mdmp\n \"o turn this feature off, remove the registry value [HKLM\\Software\\Microsoft\\Fusion!EnableLog].\" in Source: 00000000-00005720.00000001.80881.000C0000.00000004.mdmp\n \"o enable assembly bind failure logging, set the registry value [HKLM\\Software\\Microsoft\\Fusion!EnableLog] (DWORD) to 1.\" in Source: 00000000-00005720.00000001.80881.000C0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process 038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex\"","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$30","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"General","name":"Found Native API in Dotnet file","description":"$31","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-101","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"\"System\\CurrentControlSet\\Control\\Nls\\RegionMapping\" in Source: 00000000-00005720.00000000.80738.01D90000.00000004.mdmp\n \"SOFTWARE\\Microsoft\\.NETFramework\\AppContext\" in Source: 00000000-00005720.00000000.80738.01D90000.00000004.mdmp\n \"o turn this feature off, remove the registry value [HKLM\\Software\\Microsoft\\Fusion!EnableLog].\" in Source: 00000000-00005720.00000001.80881.000C0000.00000004.mdmp\n \"o enable assembly bind failure logging, set the registry value [HKLM\\Software\\Microsoft\\Fusion!EnableLog] (DWORD) to 1.\" in Source: 00000000-00005720.00000001.80881.000C0000.00000004.mdmp\n \"System\\CurrentControlSet\\Control\\Nls\\RegionMapping\" in Source: 00000000-00005720.00000001.80881.01D90000.00000004.mdmp\n \"SOFTWARE\\Microsoft\\.NETFramework\\AppContext\" in Source: 00000000-00005720.00000001.80881.01D90000.00000004.mdmp","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$32","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 632D0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 63F30000\n \"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 646E0000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 77140000\n \"MSBuild.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 77140000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"0b000c00cc02926b@ADVAPI32.dll\"\n \"10001100da02926b@ADVAPI32.dll\"\n \"1500160020732a6b@ADVAPI32.dll\"\n \"0e000f00e4732a6b@ADVAPI32.dll\"\n \"0e000f0050742a6b@ADVAPI32.dll\"\n \"11001200d47d2a6b@ADVAPI32.dll\"\n \"110012007c7e2a6b@ADVAPI32.dll\"\n \"12001300cc7e2a6b@ADVAPI32.dll\"\n \"12001300387f2a6b@ADVAPI32.dll\"\n \"14001500e4b72a6b@ADVAPI32.dll\"\n \"1400150000b82a6b@ADVAPI32.dll\"\n \"140015001cb82a6b@ADVAPI32.dll\"\n \"1700180038b82a6b@ADVAPI32.dll\"\n \"0d000e0054b82a6b@ADVAPI32.dll\"\n \"1100120064b82a6b@ADVAPI32.dll\"\n \"110012007cb82a6b@ADVAPI32.dll\"\n \"0f001000ecb92a6b@ADVAPI32.dll\"\n \"1400150038ba2a6b@ADVAPI32.dll\"\n \"1400150054ba2a6b@ADVAPI32.dll\"\n \"0c000d00a8ba2a6b@ADVAPI32.dll\"\n \"0c000d00b8ba2a6b@ADVAPI32.dll\"\n \"0e000f00c8ba2a6b@ADVAPI32.dll\"\n \"0e000f00dcba2a6b@ADVAPI32.dll\"\n \"0b000c00f0ba2a6b@ADVAPI32.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e\" was detected as \".NET\" and name: \"Library\"\n \"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e\" was detected as \"VB.NET\" and name: \"Compiler\"\n \"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","id":"static-144","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$33","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x24e800\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x24e654\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe\" [Source: 00000000-00005720-00000C46-16040893158]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"MSBuild.exe\" (UID: 00000000-00006056) was launched with new environment variables: \"USERDNSDOMAIN=\"%OSUSER%-PC\"\"\n Process \"MSBuild.exe\" (UID: 00000000-00006056) was launched with modified environment variables: \"NUMBER_OF_PROCESSORS\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"basedsymsotp.shop\"\n \"charistmatwio.shop\"\n \"commisionipwn.shop\"\n \"complainnykso.shop\"\n \"cutesliprpepo.shop\"\n \"grassemenwji.shop\"\n \"ignoracndwko.shop\"\n \"preachstrwnwjw.shop\"\n \"stitchmiscpaew.shop\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")\n \"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"MSBuild.exe\" (UID: 00000000-00006056)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"MSBuild.exe\" (UID: 00000000-00006056)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"General","name":"The input sample contains the RDTSCP instruction","description":"Found VM detection artifact \"RDTSCP trick\" in \"sample.bin\" (Offset: 130954)","origin":"Binary File","mitre_attack_id":"T1497","relevance":5,"id":"binary-26","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","mitre_attack_id":"T1559","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$35","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe\" queries basic process information of the \"C:\\Windows\\System32\\cryptsp.dll\" (UID: 5720)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$36","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$37","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: The input sample contains the RDTSCP instruction","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$38","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$39","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$3a","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to register an interface (RPC)","description":"\"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00005720)","origin":"API Call","mitre_attack_id":"T1021","relevance":3,"id":"api-219","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to send the specified request to the HTTP server","description":"$3b","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-190","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSASend\" (Indicator: \"WSASend\"; Source: \"00000000-00006056-00000C2C-294352038\")\n Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; Source: \"00000000-00006056-00000C2C-294352326\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"AUTHUI.DLL: Shutdown Choices Message Window\" (Indicator: \" shutdown \"; Source: \"00000000-00005720.00000000.80738.00D90000.00000002.mdmp\")\n Found reference to API \"o enable assembly bind failure logging, set the registry value [HKLM\\Software\\Microsoft\\Fusion!EnableLog] (DWORD) to 1.\" (Indicator: \" bind \"; Source: \"00000000-00005720.00000001.80881.000C0000.00000004.mdmp\")\n Found reference to API \"ote: There is some performance penalty associated with assembly bind failure logging.\" (Indicator: \" bind \"; Source: \"00000000-00005720.00000001.80881.000C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"\\nmmx.\" [Source: 00000000-00005720.00000001.80881.00D62000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Potential IP \"4.0.0.0\" found in string \"g,4.0.0.0,,b77a5c561\"\n Potential IP \"4.0.0.0\" found in string \"rsion=4.0.0.0, Culture=neutral, Public\"\n \"4.0.0.0\"\n Potential IP \"4.0.0.0\" found in string \"System.Core,4.0.0.0,,b77a5c561934e\"\n \"192.168.0.2\"\n \"1.1.0.5\"\n \"1.1.0.9\"\n \"11.0.0.0\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"charistmatwio.shop\" has high entropy\n Contacted domain: \"complainnykso.shop\" has high entropy\n Contacted domain: \"grassemenwji.shop\" has high entropy\n Contacted domain: \"ignoracndwko.shop\" has high entropy\n Contacted domain: \"preachstrwnwjw.shop\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 05af1f5ca1b87cc9cc9b25185115607d","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"54.146.6.253\" on port \"443\"\n HTTPS traffic to \"3.222.192.211\" on port \"443\"\n HTTPS traffic to \"52.27.79.221\" on port \"443\"\n HTTPS traffic to \"44.244.22.128\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – high entropy image embedded in .NET resource","description":"YARA signature for high entropy images embedded in resource process \"00000000-00005720\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":7,"id":"yara-214","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"}]},{"level":"informative","category":"Remote Access Related","name":"Able to modify Remote Configuration","description":"Found string \":\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Runtime.Remoting\\v4.0_4.0.0.0__b77a5c561934e089\\System.Runtime.Remoting.dll\" (Source: \"00000000-00005720.00000000.80738.000C0000.00000004.mdmp, 00000000-00005720.00000001.80881.000C0000.00000004.mdmp\")\n Found string \"System.Runtime.Remoting, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\" (Source: \"00000000-00005720.00000000.80738.000C0000.00000004.mdmp\")\n Found string \"System.Runtime.Remoting\" (Source: \"00000000-00005720.00000000.80738.00318000.00000004.mdmp, 00000000-00005720.00000001.80881.005B0000.00000004.mdmp\")\n Found string \"indows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Runtime.Remoting\\v4.0_4.0.0.0__b77a5c561934e089\\System.Runtime.Remoting.dll\" (Source: \"00000000-00005720.00000001.80881.000C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1021","relevance":1,"id":"string-940","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLE6E97625A777B44BFBBB333D2410E]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00005720.00000001.80881.000C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00005720.00000001.80881.000C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture drag-drop file operations","description":"Found string \"GetClipboardData\" (Source: \"00000000-00005720.00000001.80881.01D90000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-915","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00005720.00000001.80881.01D90000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve running process details (.NET)","description":"Found string \"GetProcessById\" (Source: \"00000000-00005720.00000001.80881.005B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-931","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$3c","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"MSBuild.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; Source: \"00000000-00005720.00000001.80881.01D90000.00000004.mdmp\")\n Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"00000000-00005720.00000001.80881.01D90000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to gather process details (Dotnet)","description":"Observed function \"GetProcessById\" in \"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e\"","origin":"Static Parser","mitre_attack_id":"T1057","relevance":1,"id":"static-100","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe\" called an API \"AdjustTokenPrivileges\"on file: C:\\Windows\\System32\\cryptsp.dll\" (UID: 00000000-00005720)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\HarddiskVolume2\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll\" (Indicator: \"\\Device\\\"; Source: \"00000000-00005720.00000000.80738.000C0000.00000004.mdmp, 00000000-00005720.00000001.80881.000C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00005720.00000000.80738.000C0000.00000004.mdmp, 00000000-00005720.00000000.80738.01D90000.00000004.mdmp, 00000000-00005720.00000001.80881.01D90000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00005720.00000001.80881.01D90000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e\" was detected as \"Microsoft Visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Detected MSBuild process execution","description":"Process \"MSBuild.exe\" with commandline \"\" (UID: 00000000-00006056)","origin":"Monitored Target","mitre_attack_id":"T1127.001","relevance":5,"id":"target-300","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Queries kernel debugger information","description":"\"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe\" at 00000000-00005720-00000105-5303907","origin":"API Call","mitre_attack_id":"T1622","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Uses a Windows Living Off The Land Binaries (LOL bins)","description":"Process \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe\" launched with commandline \"\" (UID: 00000000-00006056)","origin":"Monitored Target","relevance":3,"id":"target-411","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e\" has section name .text with entropy \"7.88443109047708\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query CPU information","description":"cpuid at 00000000-00006056-59998-319-00429C70\n cpuid at 00000000-00006056-59998-376-00428560\n cpuid at 00000000-00006056-59998-382-004282B2\n cpuid at 00000000-00006056-59998-1367-0042887C\n cpuid at 00000000-00006056-59998-1368-004288C6\n cpuid at 00000000-00006056-59998-1666-00428824\n cpuid at 00000000-00006056-59998-1877-0042889B","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":10,"id":"stream-13","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"}]},{"level":"suspicious","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO TLS Handshake Failure\" (SID: 2029340, Rev: 2, Severity: 2) categorized as \"Potentially Bad Traffic\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-1","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"17/23 Antivirus vendors marked sample as malicious (73% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"}]},{"level":"suspicious","category":"General","name":"PE file has unusual entropy resources","description":"\"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e\" has resource with unusual entropy \"RT_ICON:7.991516232922212\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":5,"id":"static-92","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 54.146.6.253 on port 443 is sent without HTTP header\n TCP traffic to 3.222.192.211 on port 443 is sent without HTTP header\n TCP traffic to 52.27.79.221 on port 443 is sent without HTTP header\n TCP traffic to 44.244.22.128 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"suspicious","category":"Pattern Matching","name":"Yara Signature Match - Indicators","description":"YARA signature \"INDICATOR_EXE_Packed_DotNetReactor\" matched file \"sample.bin\" as \"Detects executables packed with unregistered version of .NET Reactor\"","origin":"YARA Signature","relevance":9,"id":"yara-553","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"}]},{"level":"suspicious","category":"System Security","name":"Adjusts debug privileges","description":"\"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe\" adjusted SE_DEBUG_PRIVILEGE on file \"C:\\Windows\\System32\\cryptsp.dll\"","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-28","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e\" claims program is from Sun Oct 20 19:02:55 2052","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe\" called \"CreateProcessA\" with parameter \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe\" - (UID: 00000000-00005720)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"malicious","category":"Exploit/Shellcode","name":"Writes shellcode to a remote process","description":"$3e","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1055","relevance":8,"id":"stream-38","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"17/23 Antivirus vendors marked sample as malicious (73% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"}]},{"level":"malicious","category":"Network Related","name":"Application communicates with a malicious domain","description":"Contacted Domain: \"preachstrwnwjw.shop\" has been identified as malicious\n Contacted Domain: \"basedsymsotp.shop\" has been identified as malicious\n Contacted Domain: \"charistmatwio.shop\" has been identified as malicious\n Contacted Domain: \"commisionipwn.shop\" has been identified as malicious","origin":"Network Traffic","mitre_attack_id":"T1566","relevance":10,"id":"network-88","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"malicious","category":"Network Related","name":"Makes HTTPS connections using an insecure TLS/SSL version","description":"Connection was made using TLSv1.0 [tls.handshake.version: 0x0301]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":10,"id":"network-53","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to find a resource in a module","description":"\"66e06cea88f93_BlueSapphire.exe\" called \"FindResourceW\" with parameter \"7\" - (UID: 00000000-00007256)\n \"66e06cea88f93_BlueSapphire.exe\" called \"FindResourceW\" with parameter \"63\" - (UID: 00000000-00007256)\n \"66e06cea88f93_BlueSapphire.exe\" called \"FindResourceW\" with parameter \"64\" - (UID: 00000000-00007256)\n \"66e06cea88f93_BlueSapphire.exe\" called \"FindResourceW\" with parameter \"8\" - (UID: 00000000-00007256)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to load a resource in memory","description":"\"66e06cea88f93_BlueSapphire.exe\" called \"LoadResource with parameter {'hModule': '82313217', 'hResInfo': '82314464'}\" (UID: 00000000-00007256)\n \"66e06cea88f93_BlueSapphire.exe\" called \"LoadResource with parameter {'hModule': '82313217', 'hResInfo': '82314496'}\" (UID: 00000000-00007256)\n \"66e06cea88f93_BlueSapphire.exe\" called \"LoadResource with parameter {'hModule': '82313217', 'hResInfo': '82314512'}\" (UID: 00000000-00007256)\n \"66e06cea88f93_BlueSapphire.exe\" called \"LoadResource with parameter {'hModule': '82313217', 'hResInfo': '82314480'}\" (UID: 00000000-00007256)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load content into memory (Dotnet)","description":"$3f","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-107","sources":[{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00007256.00000000.149096.02B80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode string content at runtime (Dotnet)","description":"Observed function \"FromBase64String\" in \"66e06cea88f93_BlueSapphire.exe\"\n Observed function \"ToBase64String\" in \"66e06cea88f93_BlueSapphire.exe\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-106","sources":[{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform symmetric decryption (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateDecryptor\" in \"66e06cea88f93_BlueSapphire.exe\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-168","sources":[{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; File: \"66e06cea88f93_BlueSapphire.exe\")\n Found reference to API \"WTSRegisterSessionNotification\" (Indicator: \"WTSRegisterSessionNotification\"; File: \"66e06cea88f93_BlueSapphire.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"General","name":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)","description":"\"66e06cea88f93_BlueSapphire.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00007256)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":1,"id":"api-179","sources":[{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"General","name":"Can loads assembly that contains the code that is currently executing [Dotnet]","description":"Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; File: \"66e06cea88f93_BlueSapphire.exe\")","origin":"File/Memory","mitre_attack_id":"T1620","relevance":1,"id":"string-615","sources":[{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"66e06cea88f93_BlueSapphire.exe\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"General","name":"Dotnet source code contains suspicious native API","description":"Observed API \"GetProcAddress\" in \"66e06cea88f93_BlueSapphire.exe\"\n Observed API \"LoadLibrary\" in \"66e06cea88f93_BlueSapphire.exe\"\n Observed API \"MapVirtualKey\" in \"66e06cea88f93_BlueSapphire.exe\"\n Observed API \"GetAsyncKeyState\" in \"66e06cea88f93_BlueSapphire.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-126","sources":[{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"66e06cea88f93_BlueSapphire.exe\" loaded module \"%WINDIR%\\SysWOW64\\amsi.dll\" at 72100000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"66e06cea88f93_BlueSapphire.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 73F80000\n \"66e06cea88f93_BlueSapphire.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 72CD0000\n \"MSBuild.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 73F80000\n \"MSBuild.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 72CD0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"General","name":"May execute SQL queries","description":"\"SelectionItemPattern_RemoveFromSelection\" (Source: 66e06cea88f93_BlueSapphire.exe, Indicator: \"selectionitempattern_removefromselection\")","origin":"File/Memory","mitre_attack_id":"T1005","relevance":1,"id":"string-605","sources":[{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"66e06cea88f93_BlueSapphire.exe\" touched \"Windows Defender IOfficeAntiVirus implementation\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\WOW6432NODE\\CLSID\\{2781761E-28E0-4109-99FE-B9D127C57AFE}\\INPROCSERVER32\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"$40","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$41","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"General","name":"The input sample possibly contains the RDTSCP instruction","description":"Found VM detection artifact \"RDTSCP trick\" in \"sample.bin\" (Offset: 130954)","origin":"Binary File","mitre_attack_id":"T1497","relevance":5,"id":"binary-26","sources":[{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"66e06cea88f93_BlueSapphire.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"66e06cea88f93_BlueSapphire.exe.log\" has type \"ASCII text with CRLF line terminators\"- Location: [%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\66e06cea88f93_BlueSapphire.exe.log]- [targetUID: 00000000-00007256]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"66e06cea88f93_BlueSapphire.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\microsoft\\clr_v4.0_32\\usagelogs\\66e06cea88f93_bluesapphire.exe.log\"\n \"66e06cea88f93_BlueSapphire.exe\" writes file \"%localappdata%\\microsoft\\clr_v4.0_32\\usagelogs\\66e06cea88f93_bluesapphire.exe.log\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"66e06cea88f93_BlueSapphire.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\UsageLogs\\66e06cea88f93_BlueSapphire.exe.log\"\n \"66e06cea88f93_BlueSapphire.exe\" writes a file \"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\66e06cea88f93_BlueSapphire.exe.log\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"Network Related","name":"Contains ability to interact with Microsoft Outlook","description":"Observed string: \"Microsoft.Office.Interop.Outlook\" [Source: 00000000-00007256.00000000.149096.02B80000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1559.001","relevance":1,"id":"string-196","sources":[{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$42","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"Network Related","name":"GETs files from a webserver (HTTPS)","description":"GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-Alive\n User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36\n Host: steamcommunity.com\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"Network Related","name":"Recently renewed or created SSL certificate","description":"Newly renewed or created SSL certificate: \"sergei-esenin.com\" (1 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-4","sources":[{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://steamcommunity.com/profiles/76561199724331900\n Found HTTPS POST request to https://sergei-esenin.com/api","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"sergei-esenin.com\" (89 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"66e06cea88f93_BlueSapphire.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$43","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$44","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"MapVirtualKey\" (Indicator: \"MapVirtualKey\"; File: \"66e06cea88f93_BlueSapphire.exe\")\n Found reference to API \"GetAsyncKeyState\" (Indicator: \"GetAsyncKeyState\"; File: \"66e06cea88f93_BlueSapphire.exe\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; File: \"66e06cea88f93_BlueSapphire.exe\")\n Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; File: \"66e06cea88f93_BlueSapphire.exe\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"\"66e06cea88f93_BlueSapphire.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\MICROSOFT.NET\\FRAMEWORK\\V4.0.30319\\MSBUILD.EXE\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"66e06cea88f93_BlueSapphire.exe.log\" - Location: [%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\66e06cea88f93_BlueSapphire.exe.log]- [targetUID: 00000000-00007256]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"section contains high entropy","description":"\"66e06cea88f93_BlueSapphire.exe\" has section name .text with entropy \"7.88443109048\"\n \"66e06cea88f93_BlueSapphire.exe\" has section name .rsrc with entropy \"6.42108312309\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"suspicious","category":"External Systems","name":"Detected Suricata Alert - CnC Activity","description":"$45","origin":"Suricata Alerts","mitre_attack_id":"T1071","relevance":1,"id":"suricata-7","sources":[{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"suspicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively low confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_60% (D)","origin":"External System","relevance":10,"id":"avtest-9","sources":[{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"r@j.r\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"malicious","category":"Installation/Persistence","name":"Sets thread context in a remote process (often injection or process hollowing)","description":"\"66e06cea88f93_BlueSapphire.exe\" set thread context in remote process \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe\" (PID: ae8)","origin":"API Call","mitre_attack_id":"T1055.012","relevance":10,"id":"api-14","sources":[{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"66e06cea88f93_BlueSapphire.exe\" wrote 00000004 bytes to a remote process \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe\" (Handle: 1044)\n \"66e06cea88f93_BlueSapphire.exe\" wrote 00000400 bytes to a remote process \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe\" (Handle: 1044)\n \"66e06cea88f93_BlueSapphire.exe\" wrote 0003F400 bytes to a remote process \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe\" (Handle: 1044)\n \"66e06cea88f93_BlueSapphire.exe\" wrote 00002A00 bytes to a remote process \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe\" (Handle: 1044)\n \"66e06cea88f93_BlueSapphire.exe\" wrote 00005800 bytes to a remote process \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe\" (Handle: 1044)\n \"66e06cea88f93_BlueSapphire.exe\" wrote 00004200 bytes to a remote process \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe\" (Handle: 1044)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries kernel debugger information"}],"sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 9 domains and 9 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]}],"intel_graph":{"map":{"Domain:basedsymsotp.shop":{"type":"Domain","value":"basedsymsotp.shop"},"Domain:charistmatwio.shop":{"type":"Domain","value":"charistmatwio.shop"},"Domain:commisionipwn.shop":{"type":"Domain","value":"commisionipwn.shop"},"Domain:complainnykso.shop":{"type":"Domain","value":"complainnykso.shop"},"Domain:cutesliprpepo.shop":{"type":"Domain","value":"cutesliprpepo.shop"},"Domain:grassemenwji.shop":{"type":"Domain","value":"grassemenwji.shop"},"Domain:ignoracndwko.shop":{"type":"Domain","value":"ignoracndwko.shop"},"Domain:preachstrwnwjw.shop":{"type":"Domain","value":"preachstrwnwjw.shop"},"Domain:sergei-esenin.com":{"type":"Domain","value":"sergei-esenin.com"},"Domain:steamcommunity.com":{"type":"Domain","value":"steamcommunity.com"},"Domain:stitchmiscpaew.shop":{"type":"Domain","value":"stitchmiscpaew.shop"},"File:038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e":{"type":"File","value":"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["confirmed malicious file","confirmed relationship with a Threat LummaStealer"]}},"File:e4a01ea5e8e8d1961954504cd52677df6424c6ffb3fbfa7ba8645df16614c4ba":{"type":"File","value":"e4a01ea5e8e8d1961954504cd52677df6424c6ffb3fbfa7ba8645df16614c4ba"},"Ip:104.21.53.8":{"type":"Ip","value":"104.21.53.8"},"Ip:184.30.122.179":{"type":"Ip","value":"184.30.122.179"},"Ip:3.222.192.211":{"type":"Ip","value":"3.222.192.211"},"Ip:44.244.22.128":{"type":"Ip","value":"44.244.22.128"},"Ip:52.27.79.221":{"type":"Ip","value":"52.27.79.221"},"Ip:54.146.6.253":{"type":"Ip","value":"54.146.6.253"},"Threat:dd4dc8ef078bc29949bcb063ed3ccdd977308f2043f97c143c383e1202bf3c49":{"type":"Threat","value":"LummaStealer","verdict":{"verdict":"malicious","verdict_source":"indicator database"}}},"chains":[{"id":"1551145451561015359","root":"File:038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e","edges":[],"verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["confirmed malicious file","confirmed relationship with a Threat LummaStealer"]}},{"id":"1551145451556821054","root":"File:038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e","edges":[{"edge_kind":"in_crowdstrike_knowledge_database","from_key":"File:038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e","to_key":"Threat:dd4dc8ef078bc29949bcb063ed3ccdd977308f2043f97c143c383e1202bf3c49"}],"verdict":{"verdict":"malicious","verdict_source":"indicator database"}},{"id":"sandbox_network","root":"File:038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e","edges":[{"edge_kind":"contacted_ip","from_key":"File:038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e","to_key":"Ip:54.146.6.253"},{"edge_kind":"contacted_ip","from_key":"File:038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e","to_key":"Ip:3.222.192.211"},{"edge_kind":"contacted_ip","from_key":"File:038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e","to_key":"Ip:52.27.79.221"},{"edge_kind":"contacted_ip","from_key":"File:038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e","to_key":"Ip:44.244.22.128"},{"edge_kind":"contacted_ip","from_key":"File:038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e","to_key":"Ip:184.30.122.179"},{"edge_kind":"contacted_ip","from_key":"File:038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e","to_key":"Ip:104.21.53.8"},{"edge_kind":"contacted_domain","from_key":"File:038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e","to_key":"Domain:basedsymsotp.shop"},{"edge_kind":"resolves_to","from_key":"Domain:basedsymsotp.shop","to_key":"Ip:3.222.192.211"},{"edge_kind":"contacted_domain","from_key":"File:038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e","to_key":"Domain:charistmatwio.shop"},{"edge_kind":"resolves_to","from_key":"Domain:charistmatwio.shop","to_key":"Ip:52.27.79.221"},{"edge_kind":"contacted_domain","from_key":"File:038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e","to_key":"Domain:commisionipwn.shop"},{"edge_kind":"resolves_to","from_key":"Domain:commisionipwn.shop","to_key":"Ip:44.244.22.128"},{"edge_kind":"contacted_domain","from_key":"File:038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e","to_key":"Domain:complainnykso.shop"},{"edge_kind":"contacted_domain","from_key":"File:038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e","to_key":"Domain:cutesliprpepo.shop"},{"edge_kind":"contacted_domain","from_key":"File:038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e","to_key":"Domain:grassemenwji.shop"},{"edge_kind":"contacted_domain","from_key":"File:038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e","to_key":"Domain:ignoracndwko.shop"},{"edge_kind":"contacted_domain","from_key":"File:038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e","to_key":"Domain:preachstrwnwjw.shop"},{"edge_kind":"resolves_to","from_key":"Domain:preachstrwnwjw.shop","to_key":"Ip:54.146.6.253"},{"edge_kind":"contacted_domain","from_key":"File:038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e","to_key":"Domain:stitchmiscpaew.shop"},{"edge_kind":"contacted_domain","from_key":"File:038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e","to_key":"Domain:sergei-esenin.com"},{"edge_kind":"resolves_to","from_key":"Domain:sergei-esenin.com","to_key":"Ip:104.21.53.8"},{"edge_kind":"contacted_domain","from_key":"File:038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e","to_key":"Domain:steamcommunity.com"},{"edge_kind":"resolves_to","from_key":"Domain:steamcommunity.com","to_key":"Ip:184.30.122.179"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e","edges":[{"edge_kind":"extracted","from_key":"File:038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e","to_key":"File:e4a01ea5e8e8d1961954504cd52677df6424c6ffb3fbfa7ba8645df16614c4ba"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":2,"imported_dlls_count":105,"dropped_files_count":0,"extracted_files_count":1,"files_written_count":1,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":6,"dns_resolutions_count":11,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["credentialharvesting","commodity","lummastealer","criminal","informationstealer","malicious","slashnext:socialengineering"],"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"6aaf96c3ba68a168ee0ba46b","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"MSIL.Agent","contacted_countries":["USA"],"submit_name":"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e","analysis_start_time":"2026-09-20T08:18:12+00:00","indicators_count":{"informative":149,"suspicious":28,"malicious":7},"tags":["Network Traffic"],"is_in_unified_schema":true},{"id":"6704a32a994ad4200102059f","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["USA"],"submit_name":"66e06cea88f93_BlueSapphire.exe","analysis_start_time":"2024-10-08T03:12:42+00:00","indicators_count":{"informative":132,"suspicious":23,"malicious":5},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"54.146.6.253","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"}]},{"address":"3.222.192.211","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"}]},{"address":"52.27.79.221","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"}]},{"address":"44.244.22.128","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"}]},{"address":"184.30.122.179","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"address":"104.21.53.8","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]}],"dns_resolutions":[{"domain":"basedsymsotp.shop","address":"3.222.192.211","ttl":44,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"domain":"charistmatwio.shop","address":"52.27.79.221","ttl":195,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"domain":"commisionipwn.shop","address":"44.244.22.128","ttl":41,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"domain":"complainnykso.shop","ttl":1387,"country":"-","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"domain":"cutesliprpepo.shop","ttl":1800,"country":"-","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"domain":"grassemenwji.shop","ttl":1800,"country":"-","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"domain":"ignoracndwko.shop","ttl":1800,"country":"-","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"domain":"preachstrwnwjw.shop","address":"54.146.6.253","ttl":66,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"domain":"stitchmiscpaew.shop","ttl":1800,"country":"-","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"domain":"sergei-esenin.com","address":"104.21.53.8","ttl":300,"country":"United States","registrar_name":"WEBCC","registrar_organization":"Whoisprotection.cc","registrar_name_servers":"EVERTON.NS.CLOUDFLARE.COM","registrar_creation_date":"2024-10-06T09:46:19+00:00","sources":[{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]},{"domain":"steamcommunity.com","address":"184.30.122.179","ttl":20,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"}],"processes":[{"pid":5720,"ppid":0,"name":"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe","command_line":"","sha256":"038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e","normalized_path":"C:\\038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe","uid":"00000000-00005720","icon":"$46"},{"pid":6056,"ppid":5720,"name":"MSBuild.exe","command_line":"","sha256":"d94e9ea7dce3dd4760f48356f14a986ea1fc8f1c84864105bf815a32284296ab","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe","parent_uid":"00000000-00005720","uid":"00000000-00006056"}],"all_imported_dlls":["msasn1.dll","webio.dll","clr.dll","RpcRtRemote.dll","advapi32.dll","nsi.dll","nlssorting.dll","gdi32.dll","usp10.dll","vcruntime140.dll","api-ms-win-core-processthreads-l1-1-1.dll","api-ms-win-crt-filesystem-l1-1-0.dll","msctf.dll","version.dll","dnsapi.dll","fltLib.dll","api-ms-win-core-xstate-l2-1-0.dll","sspicli.dll","rasadhlp.dll","FWPUCLNT.DLL","mscorlib.ni.dll","winnsi.dll","schannel.dll","api-ms-win-core-file-l1-2-0.dll","rpcrt4.dll","api-ms-win-core-synch-l1-2-0.dll","api-ms-win-crt-convert-l1-1-0.dll","mscoreei.dll","clrjit.dll","rsaenh.dll","crypt32.dll","wshqos.dll","kernel32.dll","msvcp140.dll","api-ms-win-crt-math-l1-1-0.dll","rpcss.dll","System.ni.dll","Microsoft.VisualBasic.ni.dll","WSHTCPIP.DLL","ole32.dll","imm32.dll","winhttp.dll","credssp.dll","lpk.dll","oleaut32.dll","ucrtbase.dll","VxSSL32.dll","psapi.dll","KernelBase.dll","api-ms-win-core-localization-l1-2-0.dll","IPHLPAPI.DLL","api-ms-win-crt-environment-l1-1-0.dll","uxtheme.dll","mswsock.dll","wship6.dll","ntdll.dll","mscoree.dll","api-ms-win-core-timezone-l1-1-0.dll","ws2_32.dll","vcruntime140_clr0400.dll","api-ms-win-crt-heap-l1-1-0.dll","msvcrt.dll","user32.dll","shlwapi.dll","api-ms-win-crt-runtime-l1-1-0.dll","api-ms-win-crt-locale-l1-1-0.dll","api-ms-win-crt-time-l1-1-0.dll","api-ms-win-crt-utility-l1-1-0.dll","sechost.dll","api-ms-win-core-file-l2-1-0.dll","api-ms-win-crt-string-l1-1-0.dll","api-ms-win-crt-stdio-l1-1-0.dll","ucrtbase_clr0400.dll","cryptbase.dll","cryptsp.dll","mscorrc.dll","System.Core.ni.dll","apphelp.dll","userenv.dll","bcryptprimitives.dll","profapi.dll","MpOAV.dll","slc.dll","combase.dll","kernel.appcore.dll","bcrypt.dll","gpapi.dll","mskeyprotect.dll","ncrypt.dll","gdi32full.dll","sppc.dll","ntasn1.dll","wintrust.dll","ncryptsslp.dll","amsi.dll","dpapi.dll","wow64win.dll","OnDemandConnRouteHelper.dll","wow64cpu.dll","wow64.dll","MpClient.dll","win32u.dll","wldp.dll","msvcp_win.dll","Microsoft.VisualBasic.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"66e06cea88f93_BlueSapphire.exe.log","sha256":"e4a01ea5e8e8d1961954504cd52677df6424c6ffb3fbfa7ba8645df16614c4ba","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]}],"files_written":[{"path":"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\66e06cea88f93_BlueSapphire.exe.log","sources":[{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"},{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"6aaf96c3ba68a168ee0ba46b"}]},{"name":"SM0:7256:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6704a32a994ad4200102059f"}]}]}},"report_ids":{"sandbox_job_ids":["6aaf96c3ba68a168ee0ba46b","6704a32a994ad4200102059f"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Lazy.Generic Sample 038ae1968e1c… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 038ae1968e1c…. Malware family: Lazy.Generic. Threat score 100/100. 18/24 AV engines flagged this file. 11 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e"}],["$","meta","4",{"property":"og:title","content":"Malicious Lazy.Generic Sample 038ae1968e1c… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 038ae1968e1c…. Malware family: Lazy.Generic. Threat score 100/100. 18/24 AV engines flagged this file. 11 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Lazy.Generic Sample 038ae1968e1c… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 038ae1968e1c…. Malware family: Lazy.Generic. Threat score 100/100. 18/24 AV engines flagged this file. 11 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L47","11",{}]]