26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 4a:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4a3,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Yogi.Generic Sample 0628c0d2ca16… — Score 90/100 — Hybrid Analysis","description":"Malicious verdict for sample 0628c0d2ca16…. Malware family: Yogi.Generic. Threat score 90/100. 8/27 AV engines flagged this file. 5 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/0628c0d2ca16727fefb2160576fbd9200f8d5d163a8ce550bbd87a650cc66fe1","keywords":["Malicious","Yogi.Generic","malware analysis","sandbox report","threat intelligence","0628c0d2ca16727fefb2160576fbd9200f8d5d163a8ce550bbd87a650cc66fe1"],"about":{"@type":"SoftwareApplication","name":"2026.07.21裁员名单及补偿方案wps.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"0628c0d2ca16727fefb2160576fbd9200f8d5d163a8ce550bbd87a650cc66fe1","additionalType":"Malicious sample"},"threatScore":90,"malwareFamily":"Yogi.Generic","antivirusDetections":{"malicious":8,"total":27},"behavioralIndicators":{"malicious":5,"suspicious":10},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T5df,Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "2026.07.21wps.exe") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "2026.07.21wps.exe") Found reference to API "CreateThreadpoolTimer() -> %p" (Indicator: "CreateThread"; File: "2026.07.21wps.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "2026.07.21wps.exe") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; File: "2026.07.21wps.exe") Found reference to API "CreateThreadpool" (Indicator: "CreateThread"; File: "2026.07.21wps.exe") Found reference to API "CreateThreadpoolCleanupGroup" (Indicator: "CreateThread"; File: "2026.07.21wps.exe") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; File: "2026.07.21wps.exe") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00003596.00000000.200101.5A8F8000.00000004.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00003596.00000000.200101.5A8F8000.00000004.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00003596.00000000.200101.5A8F8000.00000004.mdmp") Found reference to API "lVirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00003596.00000000.200101.5A8F8000.00000004.mdmp") Found reference to API "lVirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00003596.00000000.200101.5A8F8000.00000004.mdmp")28:T643,Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "2026.07.21wps.exe") Found reference to API "SleepEx" (Indicator: "SleepEx"; File: "2026.07.21wps.exe") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "2026.07.21wps.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "2026.07.21wps.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "2026.07.21wps.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "2026.07.21wps.exe") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; File: "2026.07.21wps.exe") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "2026.07.21wps.exe") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "2026.07.21wps.exe") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "2026.07.21wps.exe") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "2026.07.21wps.exe") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "2026.07.21wps.exe") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "2026.07.21wps.exe") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00003596.00000000.200101.5A8F8000.00000004.mdmp")29:T465,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "2026.07.21wps.exe") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "2026.07.21wps.exe") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "2026.07.21wps.exe") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "2026.07.21wps.exe") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; File: "2026.07.21wps.exe") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; File: "2026.07.21wps.exe")2a:T68c,"2026.07.21_wps.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\PROGID") "2026.07.21_wps.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\PROGID") "2026.07.21_wps.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\PROGID") "2026.07.21_wps.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") "2026.07.21_wps.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") "2026.07.21_wps.exe" (Access type: "OPEN"; Path: "HKCU\EXEFILE\SHELL\OPEN") "2026.07.21_wps.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\EXEFILE\SHELL\OPEN") "2026.07.21_wps.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "2026.07.21_wps.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "2026.07.21_wps.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\INPROCSERVER32") "2026.07.21_wps.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\INPROCSERVER32") "2026.07.21_wps.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\INPROCSERVER32") "2026.07.21_wps.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\INPROCSERVER32") "2026.07.21_wps.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\INPROCHANDLER32")2b:T420,"2026.07.21_wps.exe" queried SystemProcessInformation at 00000000-00003596-00000C15-2125947842 [PID: 3596] "2026.07.21_wps.exe" queried SystemProcessInformation at 00000000-00003596-00000C15-2125955607 [PID: 3596] "2026.07.21_wps.exe" queried SystemProcessInformation at 00000000-00003596-00000C15-2126048944 [PID: 3596] "2026.07.21_wps.exe" queried SystemProcessInformation at 00000000-00003596-00000C15-2126057648 [PID: 3596] "2026.07.21_wps.exe" queried SystemProcessInformation at 00000000-00003596-00000C15-2126174320 [PID: 3596] "2026.07.21_wps.exe" queried SystemProcessInformation at 00000000-00003596-00000C15-2126182534 [PID: 3596] "2026.07.21_wps.exe" queried SystemProcessInformation at 00000000-00003596-00000C15-2126246174 [PID: 3596] "2026.07.21_wps.exe" queried SystemProcessInformation at 00000000-00003596-00000C15-2126255204 [PID: 3596] "cmd.exe" queried SystemProcessInformation at 00000000-00004672-00000C15-2132677887 [PID: 4672] "cmd.exe" queried SystemProcessInformation at 00000000-00004672-00000C15-2132685382 [PID: 4672]2c:Tb49,Found api reference "CryptImportKey" (Indicator: "CryptImportKey"; File: "2026.07.21wps.exe") Found api reference "CryptAcquireContextA" (Indicator: "CryptAcquireContextA"; File: "2026.07.21wps.exe") Found api reference "CryptDestroyHash" (Indicator: "CryptDestroyHash"; File: "2026.07.21wps.exe") Found api reference "CryptHashData" (Indicator: "CryptHashData"; File: "2026.07.21wps.exe") Found api reference "CryptDestroyKey" (Indicator: "CryptDestroyKey"; File: "2026.07.21wps.exe") Found api reference "CryptCreateHash" (Indicator: "CryptCreateHash"; File: "2026.07.21wps.exe") Found api reference "CryptGetHashParam" (Indicator: "CryptGetHashParam"; File: "2026.07.21wps.exe") Found api reference "CryptEncrypt" (Indicator: "CryptEncrypt"; File: "2026.07.21wps.exe") Found api reference "CryptReleaseContext" (Indicator: "CryptReleaseContext"; File: "2026.07.21wps.exe") Found api reference "CertAddCertificateContextToStore" (Indicator: "CertAddCertificateContextToStore"; File: "2026.07.21wps.exe") Found api reference "CertFreeCertificateChainEngine" (Indicator: "CertFreeCertificateChain"; File: "2026.07.21wps.exe") Found api reference "CertFreeCertificateChainEngine" (Indicator: "CertFreeCertificateChainEngine"; File: "2026.07.21wps.exe") Found api reference "CertFreeCertificateChain" (Indicator: "CertFreeCertificateChain"; File: "2026.07.21wps.exe") Found api reference "CryptDecodeObjectEx" (Indicator: "CryptDecodeObject"; File: "2026.07.21wps.exe") Found api reference "CryptDecodeObjectEx" (Indicator: "CryptDecodeObjectEx"; File: "2026.07.21wps.exe") Found api reference "CryptQueryObject" (Indicator: "CryptQueryObject"; File: "2026.07.21wps.exe") Found api reference "CertCloseStore" (Indicator: "CertCloseStore"; File: "2026.07.21wps.exe") Found api reference "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; File: "2026.07.21wps.exe") Found api reference "CertOpenStore" (Indicator: "CertOpenStore"; File: "2026.07.21wps.exe") Found api reference "CertCreateCertificateChainEngine" (Indicator: "CertCreateCertificateChainEngine"; File: "2026.07.21wps.exe") Found api reference "CertFindExtension" (Indicator: "CertFindExtension"; File: "2026.07.21wps.exe") Found api reference "CertGetCertificateChain" (Indicator: "CertGetCertificateChain"; File: "2026.07.21wps.exe") Found api reference "CertEnumCertificatesInStore" (Indicator: "CertEnumCertificatesInStore"; File: "2026.07.21wps.exe") Found api reference "CertFindCertificateInStore" (Indicator: "CertFindCertificateInStore"; File: "2026.07.21wps.exe") Found api reference "CryptStringToBinaryA" (Indicator: "CryptStringToBinaryA"; File: "2026.07.21wps.exe") Found api reference "PFXImportCertStore" (Indicator: "PFXImportCertStore"; File: "2026.07.21wps.exe") Found api reference "CertGetNameStringA" (Indicator: "CertGetNameStringA"; File: "2026.07.21wps.exe")2d:T1edf,Assembly shows XOR instruction xor eax ebp in Stream UID: 55214-792-000000014030C2D0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 55214-792-000000014030C2D0 Assembly shows XOR instruction xor eax ebp in Stream UID: 55214-4025-0000000140376F90 Assembly shows XOR instruction xor ecx ebp in Stream UID: 55214-4025-0000000140376F90 Assembly shows XOR instruction xor eax ebp in Stream UID: 55214-4027-0000000140377020 Assembly shows XOR instruction xor ecx ebp in Stream UID: 55214-4027-0000000140377020 Assembly shows XOR instruction xor eax ebp in Stream UID: 55214-5882-00000001402F7690 Assembly shows XOR instruction xor ecx ebp in Stream UID: 55214-5882-00000001402F7690 Assembly shows XOR instruction xor eax ebp in Stream UID: 55214-7013-000000014028D800 Assembly shows XOR instruction xor eax 01h in Stream UID: 55214-7013-000000014028D800 Assembly shows XOR instruction xor ecx ebp in Stream UID: 55214-7013-000000014028D800 Assembly shows XOR instruction xor eax ebp in Stream UID: 55214-8444-0000000140215530 Assembly shows XOR instruction xor ecx ebp in Stream UID: 55214-8444-0000000140215530 Assembly shows XOR instruction xor rbx rax in Stream UID: 55214-10306-0000000140108880 Assembly shows XOR instruction xor ebx eax in Stream UID: 55214-10306-0000000140108880 Assembly shows XOR instruction xor rdi r8 in Stream UID: 55214-10306-0000000140108880 Assembly shows XOR instruction xor edi eax in Stream UID: 55214-10306-0000000140108880 Assembly shows XOR instruction xor rax rsp in Stream UID: 55214-10323-0000000140106330 Assembly shows XOR instruction xor eax esp in Stream UID: 55214-10323-0000000140106330 Assembly shows XOR instruction xor rcx rsp in Stream UID: 55214-10323-0000000140106330 Assembly shows XOR instruction xor ecx esp in Stream UID: 55214-10323-0000000140106330 Assembly shows XOR instruction xor rax rsp in Stream UID: 55214-10326-0000000140105F80 Assembly shows XOR instruction xor eax esp in Stream UID: 55214-10326-0000000140105F80 Assembly shows XOR instruction xor rcx rsp in Stream UID: 55214-10326-0000000140105F80 Assembly shows XOR instruction xor ecx esp in Stream UID: 55214-10326-0000000140105F80 Assembly shows XOR instruction xor rax rsp in Stream UID: 55214-10343-0000000140103440 Assembly shows XOR instruction xor eax esp in Stream UID: 55214-10343-0000000140103440 Assembly shows XOR instruction xor rcx rsp in Stream UID: 55214-10343-0000000140103440 Assembly shows XOR instruction xor ecx esp in Stream UID: 55214-10343-0000000140103440 Assembly shows XOR instruction xor rax rsp in Stream UID: 55214-10346-0000000140101F20 Assembly shows XOR instruction xor eax esp in Stream UID: 55214-10346-0000000140101F20 Assembly shows XOR instruction xor rcx rsp in Stream UID: 55214-10346-0000000140101F20 Assembly shows XOR instruction xor ecx esp in Stream UID: 55214-10346-0000000140101F20 Assembly shows XOR instruction xor rax rsp in Stream UID: 55214-10370-00000001400FCC80 Assembly shows XOR instruction xor eax esp in Stream UID: 55214-10370-00000001400FCC80 Assembly shows XOR instruction xor rcx rsp in Stream UID: 55214-10370-00000001400FCC80 Assembly shows XOR instruction xor ecx esp in Stream UID: 55214-10370-00000001400FCC80 Assembly shows XOR instruction xor rax rsp in Stream UID: 55214-10386-00000001400C2E60 Assembly shows XOR instruction xor eax esp in Stream UID: 55214-10386-00000001400C2E60 Assembly shows XOR instruction xor rcx rsp in Stream UID: 55214-10386-00000001400C2E60 Assembly shows XOR instruction xor ecx esp in Stream UID: 55214-10386-00000001400C2E60 Assembly shows XOR instruction xor rax rsp in Stream UID: 55214-10387-00000001400C3DF0 Assembly shows XOR instruction xor eax esp in Stream UID: 55214-10387-00000001400C3DF0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 55214-10387-00000001400C3DF0 Assembly shows XOR instruction xor ecx esp in Stream UID: 55214-10387-00000001400C3DF0 Assembly shows XOR instruction xor rax rsp in Stream UID: 55214-10461-00000001400F5190 Assembly shows XOR instruction xor eax esp in Stream UID: 55214-10461-00000001400F5190 Assembly shows XOR instruction xor rcx rsp in Stream UID: 55214-10461-00000001400F5190 Assembly shows XOR instruction xor ecx esp in Stream UID: 55214-10461-00000001400F5190 Assembly shows XOR instruction xor rax rsp in Stream UID: 55214-10463-00000001400F4EF0 Assembly shows XOR instruction xor eax esp in Stream UID: 55214-10463-00000001400F4EF0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 55214-10463-00000001400F4EF0 Assembly shows XOR instruction xor ecx esp in Stream UID: 55214-10463-00000001400F4EF0 Assembly shows XOR instruction xor rax rsp in Stream UID: 55214-10466-00000001400F44E0 Assembly shows XOR instruction xor eax esp in Stream UID: 55214-10466-00000001400F44E0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 55214-10466-00000001400F44E0 Assembly shows XOR instruction xor ecx esp in Stream UID: 55214-10466-00000001400F44E0 Assembly shows XOR instruction xor rax rsp in Stream UID: 55214-10473-00000001400EF210 Assembly shows XOR instruction xor eax esp in Stream UID: 55214-10473-00000001400EF210 Assembly shows XOR instruction xor rcx rsp in Stream UID: 55214-10473-00000001400EF210 Assembly shows XOR instruction xor ecx esp in Stream UID: 55214-10473-00000001400EF210 Assembly shows XOR instruction xor rax rsp in Stream UID: 55214-10475-00000001400F4380 Assembly shows XOR instruction xor eax esp in Stream UID: 55214-10475-00000001400F4380 Assembly shows XOR instruction xor rcx rsp in Stream UID: 55214-10475-00000001400F4380 Assembly shows XOR instruction xor ecx esp in Stream UID: 55214-10475-00000001400F4380 Assembly shows XOR instruction xor rax rsp in Stream UID: 55214-10567-00000001400C0FD0 Assembly shows XOR instruction xor eax esp in Stream UID: 55214-10567-00000001400C0FD0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 55214-10567-00000001400C0FD0 Assembly shows XOR instruction xor ecx esp in Stream UID: 55214-10567-00000001400C0FD0 Assembly shows XOR instruction xor rax rsp in Stream UID: 55214-10647-00000001400E5B70 Assembly shows XOR instruction xor eax esp in Stream UID: 55214-10647-00000001400E5B70 Assembly shows XOR instruction xor rcx rsp in Stream UID: 55214-10647-00000001400E5B70 Assembly shows XOR instruction xor ecx esp in Stream UID: 55214-10647-00000001400E5B70 Assembly shows XOR instruction xor rax rsp in Stream UID: 55214-10650-00000001400E5A80 Assembly shows XOR instruction xor eax esp in Stream UID: 55214-10650-00000001400E5A80 Assembly shows XOR instruction xor rcx rsp in Stream UID: 55214-10650-00000001400E5A80 Assembly shows XOR instruction xor ecx esp in Stream UID: 55214-10650-00000001400E5A80 Assembly shows XOR instruction xor rax rsp in Stream UID: 55214-10734-00000001400E5C40 Assembly shows XOR instruction xor eax esp in Stream UID: 55214-10734-00000001400E5C40 Assembly shows XOR instruction xor rcx rsp in Stream UID: 55214-10734-00000001400E5C40 Assembly shows XOR instruction xor ecx esp in Stream UID: 55214-10734-00000001400E5C40 Assembly shows XOR instruction xor rax rsp in Stream UID: 55214-10797-00000001400CD470 Assembly shows XOR instruction xor eax esp in Stream UID: 55214-10797-00000001400CD470 Assembly shows XOR instruction xor rcx rsp in Stream UID: 55214-10797-00000001400CD470 Assembly shows XOR instruction xor ecx esp in Stream UID: 55214-10797-00000001400CD470 Assembly shows XOR instruction xor rax rsp in Stream UID: 55214-10805-00000001400CC400 Assembly shows XOR instruction xor eax esp in Stream UID: 55214-10805-00000001400CC400 Assembly shows XOR instruction xor rcx rsp in Stream UID: 55214-10805-00000001400CC400 Assembly shows XOR instruction xor ecx esp in Stream UID: 55214-10805-00000001400CC4002e:Tc6b,Found reference to API "CryptImportKey" (Indicator: "CryptImportKey"; File: "2026.07.21wps.exe") Found reference to API "CryptAcquireContextA" (Indicator: "CryptAcquireContext"; File: "2026.07.21wps.exe") Found reference to API "CryptDestroyHash" (Indicator: "CryptDestroyHash"; File: "2026.07.21wps.exe") Found reference to API "CryptHashData" (Indicator: "CryptHashData"; File: "2026.07.21wps.exe") Found reference to API "CryptDestroyKey" (Indicator: "CryptDestroyKey"; File: "2026.07.21wps.exe") Found reference to API "CryptCreateHash" (Indicator: "CryptCreateHash"; File: "2026.07.21wps.exe") Found reference to API "CryptGetHashParam" (Indicator: "CryptGetHashParam"; File: "2026.07.21wps.exe") Found reference to API "CryptEncrypt" (Indicator: "CryptEncrypt"; File: "2026.07.21wps.exe") Found reference to API "CryptReleaseContext" (Indicator: "CryptReleaseContext"; File: "2026.07.21wps.exe") Found reference to API "CryptDecodeObjectEx" (Indicator: "CryptDecodeObject"; File: "2026.07.21wps.exe") Found reference to API "CertCloseStore" (Indicator: "CertCloseStore"; File: "2026.07.21wps.exe") Found reference to API "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; File: "2026.07.21wps.exe") Found reference to API "CertEnumCertificatesInStore" (Indicator: "CertEnumCertificatesInStore"; File: "2026.07.21wps.exe") Found reference to API "CertFindCertificateInStore" (Indicator: "CertFindCertificateInStore"; File: "2026.07.21wps.exe") Found reference to API "CertGetNameStringA" (Indicator: "CertGetNameString"; File: "2026.07.21wps.exe") Found reference to API "BCryptSetProperty" (Indicator: "BCryptSetProperty"; File: "2026.07.21wps.exe") Found reference to API "BCryptGetProperty" (Indicator: "BCryptGetProperty"; File: "2026.07.21wps.exe") Found reference to API "BCryptGenerateSymmetricKey" (Indicator: "BCryptGenerateSymmetricKey"; File: "2026.07.21wps.exe") Found reference to API "BCryptEncrypt" (Indicator: "BCryptEncrypt"; File: "2026.07.21wps.exe") Found reference to API "BCryptEncrypt" (Indicator: "CryptEncrypt"; File: "2026.07.21wps.exe") Found reference to API "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; File: "2026.07.21wps.exe") Found reference to API "BCryptDestroyKey" (Indicator: "CryptDestroyKey"; File: "2026.07.21wps.exe") Found reference to API "BCryptDecrypt" (Indicator: "BCryptDecrypt"; File: "2026.07.21wps.exe") Found reference to API "BCryptDecrypt" (Indicator: "CryptDecrypt"; File: "2026.07.21wps.exe") Found reference to API "schannel: CryptDecodeObjectEx() returned no alternate name information." (Indicator: "CryptDecodeObject"; File: "2026.07.21wps.exe") Found reference to API "schannel: CertGetNameString() returned no certificate name information" (Indicator: "CertGetNameString"; File: "2026.07.21wps.exe") Found reference to API "schannel: CertGetNameString() returned certificate name information of unexpected size" (Indicator: "CertGetNameString"; File: "2026.07.21wps.exe") Found reference to API "schannel: CertGetNameString() failed to match connection hostname (%s) against server certificate names" (Indicator: "CertGetNameString"; File: "2026.07.21wps.exe")2f:T447,Found string "-----BEGIN PUBLIC KEY-----" (Indicator: "public key"; File: "2026.07.21wps.exe") Found string "-----END PUBLIC KEY-----" (Indicator: "public key"; File: "2026.07.21wps.exe") Found string "public key hash: sha256//%s" (Indicator: "public key"; File: "2026.07.21wps.exe") Found string "SSL public key does not match pinned public key" (Indicator: "public key"; File: "2026.07.21wps.exe") Found string "SSL: public key does not match pinned public key" (Indicator: "public key"; File: "2026.07.21wps.exe") Found string "SSL: failed retrieving public key from server certificate" (Indicator: "public key"; File: "2026.07.21wps.exe") Found string "ECC Public Key (%zu bits)" (Indicator: "public key"; File: "2026.07.21wps.exe") Found string "ECC Public Key" (Indicator: "public key"; File: "2026.07.21wps.exe") Found string "RSA Public Key (%zu bits)" (Indicator: "public key"; File: "2026.07.21wps.exe") Found string "RSA Public Key" (Indicator: "public key"; File: "2026.07.21wps.exe") Found string "Public Key Algorithm" (Indicator: "public key"; File: "2026.07.21wps.exe")30:T4f3,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Able to import cryptographic keys (seen in ransomware) Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains key cryptographic functions (API string) Matched sigs: Contains ability to encrypt/encode message (API string) Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains asymmetric cryptographic functions (API string) Matched sigs: Able to utilize the Windows bcrypt cryptographic API Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Contains CRYPTO related strings Matched sigs: Possibly contains Public/Private key (encryption) Matched sigs: Contains reference to cryptographic keys Matched sigs: Contains reference to crypto DLLs Matched sigs: Uses Windows cryptography API for obfuscation Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: Contains key cryptographic functions of the CryptoAPI Matched sigs: YARA signature match – Encryption algorithm31:T2c30,Found XOR loop in file "sample.bin" at offset 985012; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3061356; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4393638; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4501184; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4573179; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4575223; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4576639; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4578263; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4581427; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4582903; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4584889; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4596815; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4614607; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4624489; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4631125; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4636517; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4651669; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4673645; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4675639; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4678567; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4682645; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4688195; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4692973; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4700565; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4707231; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4709907; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4842412; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 629174; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 636107; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 745470; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1051571; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1486519; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1950885; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2037149; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2037156; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2147985; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2209556; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2209571; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2319180; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2319247; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2319311; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3012611; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3106502; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3158502; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3158509; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3240716; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3287235; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3319470; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3319541; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3735609; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3751312; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3752223; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3752250; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3752350; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3752409; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3752449; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3752727; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3752754; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3752854; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3752913; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3752953; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3753472; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3754912; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3760347; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3760484; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3760810; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3876674; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4187010; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4187021; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4284547; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4475223; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4475240; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4496486; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4496574; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4586431; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4587031; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4593461; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4598579; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4612769; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4620527; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4625617; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4631805; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4638749; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4642533; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4645299; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4653379; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4656403; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4659093; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4660677; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4666041; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4673877; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4692109; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4692481; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4695069; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4695921; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4700401; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 285817; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 286453; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 484694; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 484709; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1055134; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1121156; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1877060; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1995955; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2053903; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2054103; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2435874; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2460259; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3006814; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3558238; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3616906; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3801039; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3808774; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4264040; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4295964; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4315310; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4573140; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4575184; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4576618; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4578224; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4580026; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4581402; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4582864; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4584850; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4596776; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4600922; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4606992; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4607806; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4608276; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4610556; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4618456; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4638596; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4640282; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4642980; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4644248; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4655492; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4663252; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4664788; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4672336; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4675162; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4685136; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4688178; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4689936; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4690308; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4690989; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4696266; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4701162; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4705382; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4707204; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4709900; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4921412; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4933658; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4938167; code bytes = 803032:T115a,"2026.07.21_wps.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003596) "2026.07.21_wps.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003596) "2026.07.21_wps.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0ac7272fe7f0000000000000000000051edcf73fe7f0000000000009b02000000000000000000004c7168e181a900002a000000000000005076545c9b0200008feccf73fe7f0000e0ac7272fe7f0000e0ac7272fe7f0000000000000000000000000000fe7f0000ffffff7f97a2000000000000000000000000000000000000d8ce6672fe7f00002a0000000000000069c31f72fe7f00003100000000000000c401000000000000c8010000000000001100011000000000b0e58f5ace00000003a3ab73fe7f0000b0e58f5ace00000000000000000000002b00000000000000000000000000000020b02572fe7f0000b43f2472fe7f0000e0ce6672 (UID: 00000000-00003596) "2026.07.21_wps.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000000008abcf5ace00000000000000000000000c00000000000000c000000000000000ac000000000000000000535c9b0200003289cd73fe7f0000400000000000000000000000d04f0000ac0000000000000000000000fe7f000098aacf5ace00000003000000000000008a0000000000000002000000fe7f000008a6cf5ace00000019decb73fe7f00000100000000000000faffffffffffffff010000000000000010a6cf5ace0000005c3628e181a9000008a6cf5ace000000000000000000000020a8cf5ace00000008abcf5ace00000003000000000000008a00000000000000d667cd73fe7f00000000000000000000fffffffffe7f000000000000 (UID: 00000000-00003596) "2026.07.21_wps.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003596) "cmd.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004672) "cmd.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004672)33:T15e9,"2026.07.21_wps.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003596) "2026.07.21_wps.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003596) "2026.07.21_wps.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003596) "2026.07.21_wps.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003596) "2026.07.21_wps.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00003596) "2026.07.21_wps.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003596) "2026.07.21_wps.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00003596) "2026.07.21_wps.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00003596) "2026.07.21_wps.exe" called "GetProcAddress" with a parameter fputc (UID: 00000000-00003596) "2026.07.21_wps.exe" called "GetProcAddress" with a parameter fwrite (UID: 00000000-00003596) "2026.07.21_wps.exe" called "GetProcAddress" with a parameter __setusermatherr (UID: 00000000-00003596) "2026.07.21_wps.exe" called "GetProcAddress" with a parameter localeconv (UID: 00000000-00003596) "2026.07.21_wps.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00003596) "2026.07.21_wps.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00003596) "2026.07.21_wps.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003596) "2026.07.21_wps.exe" called "GetProcAddress" with a parameter IsUserAnAdmin (UID: 00000000-00003596) "2026.07.21_wps.exe" called "GetProcAddress" with a parameter RtlDecompressBuffer (UID: 00000000-00003596) "2026.07.21_wps.exe" called "GetProcAddress" with a parameter EnumServicesStatusExW (UID: 00000000-00003596) "2026.07.21_wps.exe" called "GetProcAddress" with a parameter StartServiceW (UID: 00000000-00003596) "2026.07.21_wps.exe" called "GetProcAddress" with a parameter OpenSCManagerW (UID: 00000000-00003596) "2026.07.21_wps.exe" called "GetProcAddress" with a parameter QueryServiceStatus (UID: 00000000-00003596) "2026.07.21_wps.exe" called "GetProcAddress" with a parameter CloseServiceHandle (UID: 00000000-00003596) "2026.07.21_wps.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00003596) "2026.07.21_wps.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00003596) "2026.07.21_wps.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00003596) "2026.07.21_wps.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00003596) "2026.07.21_wps.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00003596) "2026.07.21_wps.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00003596) "2026.07.21_wps.exe" called "GetProcAddress" with a parameter NtOpenProcess (UID: 00000000-00003596) "2026.07.21_wps.exe" called "GetProcAddress" with a parameter NtAllocateVirtualMemory (UID: 00000000-00003596) "2026.07.21_wps.exe" called "GetProcAddress" with a parameter NtWriteVirtualMemory (UID: 00000000-00003596) "2026.07.21_wps.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00003596) "2026.07.21_wps.exe" called "GetProcAddress" with a parameter NtAlpcCreatePort (UID: 00000000-00003596) "2026.07.21_wps.exe" called "GetProcAddress" with a parameter TpAllocAlpcCompletion (UID: 00000000-00003596) "2026.07.21_wps.exe" called "GetProcAddress" with a parameter NtAlpcSetInformation (UID: 00000000-00003596) "2026.07.21_wps.exe" called "GetProcAddress" with a parameter NtAlpcConnectPort (UID: 00000000-00003596) "2026.07.21_wps.exe" called "GetProcAddress" with a parameter VirtualAllocEx (UID: 00000000-00003596) "2026.07.21_wps.exe" called "GetProcAddress" with a parameter WriteProcessMemory (UID: 00000000-00003596) "2026.07.21_wps.exe" called "GetProcAddress" with a parameter GetProcessHeap (UID: 00000000-00003596) "2026.07.21_wps.exe" called "GetProcAddress" with a parameter HeapReAlloc (UID: 00000000-00003596) "2026.07.21_wps.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00003596) "2026.07.21_wps.exe" called "GetProcAddress" with a parameter GetProcessId (UID: 00000000-00003596) "2026.07.21_wps.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00003596) "2026.07.21_wps.exe" called "GetProcAddress" with a parameter NtQueryObject (UID: 00000000-00003596) "2026.07.21_wps.exe" called "GetProcAddress" with a parameter wsprintfA (UID: 00000000-00003596) "2026.07.21_wps.exe" called "GetProcAddress" with a parameter ShellExecuteExA (UID: 00000000-00003596) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004672) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004672) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004672) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004672) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004672) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004672) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00004672) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00004672)34:T5c1,LoadLibraryA@KERNEL32.dll at 55214-10487-00000001400B54B0 LoadLibraryW@KERNEL32.dll at 55214-13603-000000014001082F LoadLibraryW@KERNEL32.dll at 55214-13649-000000014009BD10 LoadLibraryA@KERNEL32.dll at 55214-14517-0000000140088E6A LoadLibraryA@KERNEL32.dll at 55214-14536-000000014008949A LoadLibraryA@KERNEL32.dll at 55214-14557-000000014008A70A LoadLibraryA@KERNEL32.dll at 55214-14565-000000014008AEF2 LoadLibraryA@KERNEL32.dll at 55214-14581-000000014008B6DA LoadLibraryA@KERNEL32.dll at 55214-14588-000000014008BED4 LoadLibraryA@KERNEL32.dll at 55214-14599-000000014008C634 LoadLibraryA@KERNEL32.dll at 55214-14610-000000014008CE40 LoadLibraryA@KERNEL32.dll at 55214-14636-000000014008DC94 LoadLibraryA@KERNEL32.dll at 55214-14648-000000014008E481 LoadLibraryA@KERNEL32.dll at 55214-14668-000000014008EFC5 LoadLibraryA@KERNEL32.dll at 55214-14682-000000014008FE27 LoadLibraryA@KERNEL32.dll at 55214-14692-0000000140090653 LoadLibraryA@KERNEL32.dll at 55214-14707-0000000140090EDE LoadLibraryA@KERNEL32.dll at 55214-14734-000000014009169F LoadLibraryA@KERNEL32.dll at 55214-14740-0000000140091E60 LoadLibraryA@KERNEL32.dll at 55214-14758-0000000140092621 LoadLibraryA@KERNEL32.dll at 55214-14769-0000000140092BFE LoadLibraryA@KERNEL32.dll at 55214-14787-00000001400931DB LoadLibraryA@KERNEL32.dll at 55214-14804-0000000140093C84 LoadLibraryA@KERNEL32.dll at 55214-14821-0000000140094261 LoadLibraryA@KERNEL32.dll at 55214-14831-0000000140094AD035:T651f,Found reference to API (Indicator: "CryptImportKey"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "CryptAcquireContextA"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "CryptDestroyHash"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "CryptHashData"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "CryptDestroyKey"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "CryptCreateHash"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "CryptGetHashParam"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "CryptEncrypt"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "CryptReleaseContext"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "CertAddCertificateContextToStore"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "CertFreeCertificateChainEngine"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "CertFreeCertificateChain"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "CryptDecodeObjectEx"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "CryptQueryObject"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "CertCloseStore"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "CertFreeCertificateContext"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "CertOpenStore"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "CertCreateCertificateChainEngine"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "CertFindExtension"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "CertGetCertificateChain"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "CertEnumCertificatesInStore"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "CertFindCertificateInStore"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "CryptStringToBinaryA"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "PFXImportCertStore"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "CertGetNameStringA"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "ExitProcess"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "VerifyVersionInfoW"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "VirtualAlloc"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "LeaveCriticalSection"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "GetModuleFileNameW"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "GetModuleHandleExW"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "WideCharToMultiByte"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "GetEnvironmentVariableA"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "AreFileApisANSI"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "GetLastError"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "AcquireSRWLockExclusive"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "SetLastError"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "lstrcatA"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "HeapAlloc"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "GetFullPathNameW"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "RtlCaptureContext"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "lstrcatW"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "GetFileSizeEx"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "LoadLibraryW"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "GetFileInformationByHandle"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "CloseHandle"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "GetModuleHandleA"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "IsDebuggerPresent"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "GetProcAddress"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "MoveFileExA"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "GetSystemDirectoryA"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "RtlVirtualUnwind"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "RtlLookupFunctionEntry"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "WaitForMultipleObjects"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "FreeLibrary"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "CreateFileA"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "LoadLibraryExW"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "MultiByteToWideChar"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "Process32FirstW"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "SleepConditionVariableSRW"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "InitializeCriticalSectionEx"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "EncodePointer"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "VirtualQuery"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "DeleteCriticalSection"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "EnterCriticalSection"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "Process32NextW"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "GetSystemDirectoryW"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "SleepEx"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "PeekNamedPipe"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "InitializeSListHead"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "GetStartupInfoW"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "CreateFileW"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "WaitForSingleObjectEx"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "WakeAllConditionVariable"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "VirtualFree"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "lstrcmpiW"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "HeapFree"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "GetProcessHeap"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "GetFileType"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "GetTickCount"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "VirtualProtect"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "FormatMessageW"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "RaiseException"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "GetStdHandle"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "Sleep"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "VerSetConditionMask"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "GetModuleFileNameA"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "TerminateProcess"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "ReadFile"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "GetDriveTypeW"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "IdnToAscii"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "IdnToUnicode"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "TranslateMessage"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "DispatchMessageW"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "gethostname"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "htonl"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "__WSAFDIsSet"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "WSASetLastError"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "getsockname"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "getpeername"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "WSAIoctl"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "WSAGetLastError"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "htons"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "getsockopt"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "recvfrom"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "closesocket"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "ntohs"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "ioctlsocket"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "BCryptGenRandom"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "SleepConditionVariableCS"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "FlushFileBuffers"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "GlobalMemoryStatusEx"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "NtQueryInformationProcess"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "NtQuerySystemInformation"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "MessageBoxW"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "NtQueryVolumeInformationFile"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "GetTempPathW"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "RtlNtStatusToDosError"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "ConvertStringSecurityDescriptorToSecurityDescriptorW"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "LookupPrivilegeValueW"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "BCryptOpenAlgorithmProvider"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "BCryptSetProperty"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "BCryptGetProperty"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "BCryptCloseAlgorithmProvider"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "BCryptGenerateSymmetricKey"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "BCryptEncrypt"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "BCryptDestroyKey"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "BCryptDecrypt"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "RegisterEventSourceW"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "ReportEventW"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "DeregisterEventSource"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "RtlCaptureStackBackTrace"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "DisableThreadLibraryCalls"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "K32GetProcessMemoryInfo"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "K32QueryWorkingSetEx"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "HeapDestroy"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "HeapSetInformation"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "GetNativeSystemInfo"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "GetSystemInfo"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "CreateFileMappingW"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "MapViewOfFileEx"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "UnmapViewOfFile"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "EventRegister"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "EventUnregister"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "DuplicateHandle"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "CreateEventW"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "GetOverlappedResult"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "WriteFile"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "LocalAlloc"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "LocalFree"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "DebugBreak"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "CreateProcessW"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "RaiseFailFastException"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "GetLocalTime"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "OutputDebugStringA"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "GetSystemWindowsDirectoryW"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "SetEvent"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "SetConsoleCtrlHandler"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "GetVersionExW"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "RegOpenKeyExW"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "RegQueryValueExW"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "RegCloseKey"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "IsWow64Process"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "TlsAlloc"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "TlsSetValue"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "TlsFree"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "GetExitCodeThread"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "TlsGetValue"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "GetCurrentThread"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "SetHandleInformation"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "CreateThread"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "SetThreadPriority"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "SetThreadPriorityBoost"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "ResumeThread"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "ReleaseMutex"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "OpenFileMappingW"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "MapViewOfFile"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "CreateMutexW"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "OpenMutexW"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "OpenEventW"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "WaitForMultipleObjectsEx"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "ResetEvent"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "DeviceIoControl"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "SetFilePointerEx"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "WriteFileGather"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "ReadFileScatter"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "GetVolumePathNameW"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "GetDiskFreeSpaceExW"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "GetVolumeNameForVolumeMountPointW"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "GetFileAttributesExW"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "GetTempFileNameW"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "CreateDirectoryW"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "RemoveDirectoryW"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "DeleteFileW"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "MoveFileExW"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "CopyFileExW"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "OpenProcessToken"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "FindNextFileW"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "FindFirstFileW"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "GetFileAttributesW"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "FindClose"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "GetWindowsDirectoryW"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "RegCreateKeyExW"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "RegSetValueExW"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "CreateThreadpoolTimer"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "SetThreadpoolTimer"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "WaitForThreadpoolTimerCallbacks"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "CloseThreadpoolTimer"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "CreateMemoryResourceNotification"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "QueryMemoryResourceNotification"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "GetConsoleScreenBufferInfo"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "CreateIoCompletionPort"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "PostQueuedCompletionStatus"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "GetQueuedCompletionStatus"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "SetThreadErrorMode"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "GetLocaleInfoW"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "GetLocaleInfoEx"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "GetNLSVersionEx"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "LCMapStringEx"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "LCMapStringW"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "LCIDToLocaleName"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "LocaleNameToLCID"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "GetCompressedFileSizeW"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "SetFileValidData"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "SetFileInformationByHandle"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "SetEndOfFile"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "GetTickCount64"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "GetSystemTime"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "SystemTimeToFileTime"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "SystemTimeToTzSpecificLocalTime"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "FileTimeToSystemTime"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "GetDateFormatW"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "GetTimeFormatW"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "QueryUnbiasedInterruptTime"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "QueryPerformanceFrequency"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "OpenFileById"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "GetFinalPathNameByHandleW"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "GetFileInformationByHandleEx"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "FindFirstVolumeW"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "FindNextVolumeW"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "FindVolumeClose"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "GetVolumeInformationW"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "OpenThread"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "CreateThreadpool"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "CreateThreadpoolCleanupGroup"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "CreateThreadpoolWork"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "SubmitThreadpoolWork"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "CloseThreadpoolCleanupGroupMembers"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "CloseThreadpoolCleanupGroup"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "CloseThreadpoolWork"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "CloseThreadpool"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "VirtualUnlock"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "VirtualQueryEx"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "CreateSemaphoreExW"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "ReleaseSemaphore"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "GetThreadIdealProcessorEx"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "GetLogicalProcessorInformationEx"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "GetProfileStringW"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "GetSystemPowerStatus"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "UnregisterWaitEx"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "RegisterWaitForSingleObject"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "QueueUserWorkItem"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "WerRegisterMemoryBlock"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "DelayLoadFailureHook"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "RtlCompressBuffer"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "LoadLibraryExA"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "RtlVerifyVersionInfo"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "AcquireCredentialsHandle"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "InitializeSecurityContext"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "QueryContextAttributes"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "EncryptMessage"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "DecryptMessage"; File: "2026.07.21wps.exe") Found reference to API (Indicator: "SeDebugPrivilege"; Source: "00000000-00003596.00000000.200101.5A8F8000.00000004.mdmp, 00000000-00003596.00000000.200101.5C530000.00000004.mdmp") Found reference to API (Indicator: "GetProcessId"; Source: "00000000-00003596.00000000.200101.5A8F8000.00000004.mdmp") Found reference to API (Indicator: "DuplicateHandle"; Source: "00000000-00003596.00000000.200101.5A8F8000.00000004.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00003596.00000000.200101.5A8F8000.00000004.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00003596.00000000.200101.5A8F8000.00000004.mdmp") Found reference to API (Indicator: "NtQuerySystemInformation"; Source: "00000000-00003596.00000000.200101.5A8F8000.00000004.mdmp") Found reference to API (Indicator: "VirtualAllocEx"; Source: "00000000-00003596.00000000.200101.5A8F8000.00000004.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00003596.00000000.200101.5A8F8000.00000004.mdmp") Found reference to API (Indicator: "NtAlpcConnectPort"; Source: "00000000-00003596.00000000.200101.5A8F8000.00000004.mdmp") Found reference to API (Indicator: "WriteProcessMemory"; Source: "00000000-00003596.00000000.200101.5A8F8000.00000004.mdmp") Found reference to API (Indicator: "RtlDecompressBuffer"; Source: "00000000-00003596.00000000.200101.5A8F8000.00000004.mdmp") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00003596.00000000.200101.5C530000.00000004.mdmp") Found reference to API (Indicator: "SessionEnv"; Source: "00000000-00003596.00000000.200101.5E420000.00000004.mdmp, 00000000-00003596.00000001.200222.5E420000.00000004.mdmp")36:T91c,"HKCU\" in Source: 2026.07.21wps.exe "HKEY_LOCAL_MACHINE\" in Source: 2026.07.21wps.exe "HKLM\" in Source: 2026.07.21wps.exe "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\W\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B31118B2-1F49-48E5-B6F" in Source: 00000000-00003596.00000001.200222.5C530000.00000004.mdmp "e\Software\C" in Source: 00000000-00003596.00000001.200222.5C530000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00003596.00000001.200222.5C530000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}" in Source: 00000000-00003596.00000001.200222.5C530000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\" in Source: 00000000-00003596.00000001.200222.5C530000.00000004.mdmp "\Machine\Software\Classes\CLSID\{0000032A-0000-0000-C00" in Source: 00000000-00003596.00000001.200222.5C530000.00000004.mdmp "XT=.COM;.EXE;.BAT;.\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00" in Source: 00000000-00003596.00000001.200222.5C530000.00000004.mdmp "574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-000-" in Source: 00000000-00003596.00000001.200222.5C530000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}" in Source: 00000000-00003596.00000001.200222.5C530000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}" in Source: 00000000-00003596.00000001.200222.5C530000.00000004.mdmp "574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AA" in Source: 00000000-00003596.00000001.200222.5C530000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00003596.00000001.200222.5C530000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}" in Source: 00000000-00003596.00000001.200222.5C530000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}" in Source: 00000000-00003596.00000001.200222.5C530000.00000004.mdmp37:T501,Process 2026.07.21_wps.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:3596:304:WilStaging_02" Process 2026.07.21_wps.exe created mutex with name "\BaseNamedObjects\SyncRootManager" Process 2026.07.21_wps.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:3596:120:WilError_01" Process 2026.07.21_wps.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process 2026.07.21_wps.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process 2026.07.21_wps.exe created mutex with name "Local\SM0:3596:120:WilError_01" Process 2026.07.21_wps.exe created mutex with name "Local\SM0:3596:304:WilStaging_02" Process 2026.07.21_wps.exe created mutex with name "Local\ZonesLockedCacheCounterMutex" Process 2026.07.21_wps.exe created mutex with name "SM0:3596:120:WilError_01" Process 2026.07.21_wps.exe created mutex with name "Local\ZonesCacheCounterMutex" Process 2026.07.21_wps.exe created mutex with name "SM0:3596:304:WilStaging_02" Process 2026.07.21_wps.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:3596:304:WilStaging_02" Process 2026.07.21_wps.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:3596:120:WilError_01"38:T89c,"Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\W\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B31118B2-1F49-48E5-B6F" in Source: 00000000-00003596.00000001.200222.5C530000.00000004.mdmp "e\Software\C" in Source: 00000000-00003596.00000001.200222.5C530000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00003596.00000001.200222.5C530000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}" in Source: 00000000-00003596.00000001.200222.5C530000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\" in Source: 00000000-00003596.00000001.200222.5C530000.00000004.mdmp "\Machine\Software\Classes\CLSID\{0000032A-0000-0000-C00" in Source: 00000000-00003596.00000001.200222.5C530000.00000004.mdmp "XT=.COM;.EXE;.BAT;.\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00" in Source: 00000000-00003596.00000001.200222.5C530000.00000004.mdmp "574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-000-" in Source: 00000000-00003596.00000001.200222.5C530000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}" in Source: 00000000-00003596.00000001.200222.5C530000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}" in Source: 00000000-00003596.00000001.200222.5C530000.00000004.mdmp "574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AA" in Source: 00000000-00003596.00000001.200222.5C530000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00003596.00000001.200222.5C530000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}" in Source: 00000000-00003596.00000001.200222.5C530000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}" in Source: 00000000-00003596.00000001.200222.5C530000.00000004.mdmp39:T6d9,"2026.07.21_wps.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffe5d850000 "2026.07.21_wps.exe" loaded module "ADVAPI32" at base 7ffe71e50000 "2026.07.21_wps.exe" loaded module "SHELL32.DLL" at base 7ffe72140000 "2026.07.21_wps.exe" loaded module "KERNEL32.DLL" at base 7ffe73bd0000 "2026.07.21_wps.exe" loaded module "ADVAPI32.DLL" at base 7ffe71e50000 "2026.07.21_wps.exe" loaded module "RPCRT4.DLL" at base 7ffe737d0000 "2026.07.21_wps.exe" loaded module "NTDLL.DLL" at base 7ffe73cb0000 "2026.07.21_wps.exe" loaded module "USER32.DLL" at base 7ffe71ca0000 "2026.07.21_wps.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffe6e640000 "2026.07.21_wps.exe" loaded module "%WINDIR%\SYSTEM32\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 7ffe6a410000 "2026.07.21_wps.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 7ffe70980000 "2026.07.21_wps.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 7ffe6c680000 "2026.07.21_wps.exe" loaded module "%WINDIR%\SYSTEM32\\WINDOWS.STATEREPOSITORYPS.DLL" at base 7ffe59ee0000 "2026.07.21_wps.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 7ffe72140000 "2026.07.21_wps.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 7ffe65770000 "2026.07.21_wps.exe" loaded module "MSISO.DLL" at base 7ffe62a30000 "2026.07.21_wps.exe" loaded module "SSPICLI.DLL" at base 7ffe6ff00000 "2026.07.21_wps.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 7ffe70320000 "2026.07.21_wps.exe" loaded module "%WINDIR%\SYSTEM32\SFC_OS.DLL" at base 7ffe5d420000 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffe5d850000 "cmd.exe" loaded module "KERNEL32.DLL" at base 7ffe73bd0000 "cmd.exe" loaded module "NTDLL.DLL" at base 7ffe73cb00003a:T10c9,"2026.07.21_wps.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "2026.07.21_wps.exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "2026.07.21_wps.exe" touched "Recycle Bin" (Path: "HKCU\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "2026.07.21_wps.exe" touched "Control Panel" (Path: "HKCU\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "2026.07.21_wps.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "2026.07.21_wps.exe" touched "UsersLibraries" (Path: "HKCU\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "2026.07.21_wps.exe" touched "CLSID_SearchFolder" (Path: "HKCU\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "2026.07.21_wps.exe" touched "Microsoft OneNote Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER") "2026.07.21_wps.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "2026.07.21_wps.exe" touched "@C:\Program Files (x86)\Microsoft Office\Office15\MAPISHELL.DLL,-110" (Path: "HKCU\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER") "2026.07.21_wps.exe" touched "Public Folder" (Path: "HKCU\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "2026.07.21_wps.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "2026.07.21_wps.exe" touched "This Device" (Path: "HKCU\CLSID\{5B934B42-522B-4C34-BBFE-37A3EF7B9C90}\SHELLFOLDER") "2026.07.21_wps.exe" touched "CLSID_AppInstanceFolder" (Path: "HKCU\CLSID\{64693913-1C21-4F30-A98F-4E52906D3B56}\SHELLFOLDER") "2026.07.21_wps.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "2026.07.21_wps.exe" touched "DXP" (Path: "HKCU\CLSID\{8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}\SHELLFOLDER") "2026.07.21_wps.exe" touched "CLSID_SearchHome" (Path: "HKCU\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "2026.07.21_wps.exe" touched "CLSID_StartMenuLauncherProviderFolder" (Path: "HKCU\CLSID\{98F275B4-4FFF-11E0-89E2-7B86DFD72085}\SHELLFOLDER") "2026.07.21_wps.exe" touched "CLSID_StartMenuCommandingProviderFolder" (Path: "HKCU\CLSID\{A00EE528-EBD9-48B8-944A-8942113D46AC}\SHELLFOLDER") "2026.07.21_wps.exe" touched "Other Users Folder" (Path: "HKCU\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "2026.07.21_wps.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "2026.07.21_wps.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "2026.07.21_wps.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "2026.07.21_wps.exe" touched "Games Explorer" (Path: "HKCU\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER") "2026.07.21_wps.exe" touched "StreamBackedFolder" (Path: "HKCU\CLSID\{EDC978D6-4D53-4B2F-A265-5805674BE568}\SHELLFOLDER") "2026.07.21_wps.exe" touched "Computers and Devices" (Path: "HKCU\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "2026.07.21_wps.exe" touched "Removable Drives" (Path: "HKCU\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\SHELLFOLDER") "2026.07.21_wps.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "2026.07.21_wps.exe" touched "Sync root manager" (Path: "HKCU\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") "2026.07.21_wps.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "2026.07.21_wps.exe" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "2026.07.21_wps.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "2026.07.21_wps.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS")3b:T4ee,The input sample is signed with a certificate issued by "OU=Class 3 Public Primary Certification Authority, O="VeriSign Inc.", C=US" (SHA1: 74:2C:31:92:E6:07:E4:24:EB:45:49:54:2B:E1:BB:C5:3E:61:74:E2; see report for more information) The input sample is signed with a certificate issued by "CN=VeriSign Time Stamping Services CA, O="VeriSign Inc.", C=US" (SHA1: AD:A8:AA:A6:43:FF:7D:C3:8D:D4:0F:A4:C9:7A:D5:59:FF:48:46:DE; see report for more information) The input sample is signed with a certificate issued by "CN=Thawte Timestamping CA, OU=Thawte Certification, O=Thawte, L=Durbanville, ST=Western Cape, C=ZA" (SHA1: F4:6A:C0:C6:EF:BB:8C:6A:14:F5:5F:09:E2:D3:7D:F4:C0:DE:01:2D; see report for more information) The input sample is signed with a certificate issued by "OU=Class 3 Public Primary Certification Authority, O="VeriSign Inc.", C=US" (SHA1: 12:D4:87:2B:C3:EF:01:9E:7E:0B:6F:13:24:80:AE:29:DB:5B:1C:A3; see report for more information) The input sample is signed with a certificate issued by "CN=VeriSign Class 3 Code Signing 2009-2 CA, OU=Terms of use at https://www.verisign.com/rpa c09, OU=VeriSign Trust Network, O="VeriSign Inc.", C=US" (SHA1: C8:8E:76:90:98:5C:2A:63:BB:3F:38:11:B4:27:B6:D9:DC:F9:04:F3; see report for more information)3c:Ta84,"2026.07.21_wps.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}"; Key: ""; Value: "") "2026.07.21_wps.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}\PROPERTIES"; Key: ""; Value: "") "2026.07.21_wps.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME"; Key: ""; Value: "") "2026.07.21_wps.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-100000000000}\"; Key: ""; Value: "") "2026.07.21_wps.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-501F00000000}\"; Key: ""; Value: "") "2026.07.21_wps.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME"; Key: ""; Value: "") "2026.07.21_wps.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID"; Key: ""; Value: "") "2026.07.21_wps.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: ""; Value: "") "2026.07.21_wps.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION\CUSTOMATTRIBUTES"; Key: ""; Value: "") "2026.07.21_wps.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE\DIAGNOSIS"; Key: ""; Value: "") "2026.07.21_wps.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER"; Key: ""; Value: "") "2026.07.21_wps.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: ""; Value: "") "2026.07.21_wps.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\DEBUGINFORMATION"; Key: ""; Value: "") "2026.07.21_wps.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY\CUSTOMATTRIBUTES"; Key: ""; Value: "") "2026.07.21_wps.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "2026.07.21_wps.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "2026.07.21_wps.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "2026.07.21_wps.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "")3d:Ted9,"2026.07.21_wps.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-100000000000}"; Key: "DATA"; Value: "") "2026.07.21_wps.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-100000000000}"; Key: "GENERATION"; Value: "") "2026.07.21_wps.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-501F00000000}"; Key: "DATA"; Value: "") "2026.07.21_wps.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-501F00000000}"; Key: "GENERATION"; Value: "") "2026.07.21_wps.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATIONTYPE"; Value: "") "2026.07.21_wps.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "SERVER"; Value: "") "2026.07.21_wps.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "DLLPATH"; Value: "") "2026.07.21_wps.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "THREADING"; Value: "") "2026.07.21_wps.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "TRUSTLEVEL"; Value: "") "2026.07.21_wps.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "REMOTESERVER"; Value: "") "2026.07.21_wps.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATEASUSER"; Value: "") "2026.07.21_wps.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATEINSHAREDBROKER"; Value: "") "2026.07.21_wps.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "PERMISSIONS"; Value: "") "2026.07.21_wps.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "EXEPATH"; Value: "") "2026.07.21_wps.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "COMMANDLINE"; Value: "") "2026.07.21_wps.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "IDENTITYTYPE"; Value: "") "2026.07.21_wps.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "PERMISSIONS"; Value: "") "2026.07.21_wps.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "ACTIVATABLECLASSES"; Value: "") "2026.07.21_wps.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "SERVERTYPE"; Value: "") "2026.07.21_wps.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "APPID"; Value: "") "2026.07.21_wps.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "IDENTITY"; Value: "")3e:T4b1,"2026.07.21_wps.exe" trying to touch file "C:\Windows\System32\apphelp.dll" "2026.07.21_wps.exe" trying to touch file "C:\2026.07.21_wps.exe" "2026.07.21_wps.exe" trying to touch file "C:\Windows\System32\ntdll.dll" "2026.07.21_wps.exe" trying to touch file "C:\Windows\System32\kernel32.dll" "2026.07.21_wps.exe" trying to touch file "C:\Windows\System32\KernelBase.dll" "2026.07.21_wps.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "2026.07.21_wps.exe" trying to touch file "C:\BCRYPT.DLL" "2026.07.21_wps.exe" trying to touch file "C:\Windows\System32\bcrypt.dll" "2026.07.21_wps.exe" trying to touch file "C:\Windows\System32\rpcrt4.dll" "2026.07.21_wps.exe" trying to touch file "C:\Windows\System32\ws2_32.dll" "2026.07.21_wps.exe" trying to touch file "C:\Windows\System32\ucrtbase.dll" "2026.07.21_wps.exe" trying to touch file "C:\Windows\System32\Wldap32.dll" "2026.07.21_wps.exe" trying to touch file "C:\Windows\System32\msvcrt.dll" "2026.07.21_wps.exe" trying to touch file "C:\Windows\System32\sechost.dll" "2026.07.21_wps.exe" trying to touch file "C:\Windows\System32\advapi32.dll" "2026.07.21_wps.exe" trying to touch file "C:\Windows\System32\msasn1.dll"3f:T6e9,"2026.07.21_wps.exe" trying to access non-existent file "C:\BCRYPT.DLL" "2026.07.21_wps.exe" trying to access non-existent file "C:\FLTLIB.DLL" "2026.07.21_wps.exe" trying to access non-existent file "C:\MSVCP140.DLL" "2026.07.21_wps.exe" trying to access non-existent file "C:\VCRUNTIME140.DLL" "2026.07.21_wps.exe" trying to access non-existent file "C:\VCRUNTIME140_1.DLL" "2026.07.21_wps.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "2026.07.21_wps.exe" trying to access non-existent file "C:\CRYPTBASE.DLL" "2026.07.21_wps.exe" trying to access non-existent file "C:\PROPSYS.DLL" "2026.07.21_wps.exe" trying to access non-existent file "C:\PROPSYS.dll" "2026.07.21_wps.exe" trying to access non-existent file "C:\CMD.EXE" "2026.07.21_wps.exe" trying to access non-existent file "C:\cmd.exe" "2026.07.21_wps.exe" trying to access non-existent file "C:\CLDAPI.DLL" "2026.07.21_wps.exe" trying to access non-existent file "C:\CLDAPI.dll" "2026.07.21_wps.exe" trying to access non-existent file "C:\AEPIC.DLL" "2026.07.21_wps.exe" trying to access non-existent file "C:\AEPIC.dll" "2026.07.21_wps.exe" trying to access non-existent file "C:\EDPUTIL.DLL" "2026.07.21_wps.exe" trying to access non-existent file "C:\edputil.dll" "2026.07.21_wps.exe" trying to access non-existent file "C:\URLMON.DLL" "2026.07.21_wps.exe" trying to access non-existent file "C:\urlmon.dll" "2026.07.21_wps.exe" trying to access non-existent file "C:\IERTUTIL.DLL" "2026.07.21_wps.exe" trying to access non-existent file "C:\iertutil.dll" "2026.07.21_wps.exe" trying to access non-existent file "C:\SSPICLI.DLL" "2026.07.21_wps.exe" trying to access non-existent file "C:\SspiCli.dll" "2026.07.21_wps.exe" trying to access non-existent file "C:\MPR.DLL"40:T4c6,Found string "SMTPUTF8H9G" (Indicator: "smtp"; File: "2026.07.21wps.exe") Found string "smtps" (Indicator: "smtp"; File: "2026.07.21wps.exe") Found string "cr-smtp-eob" (Indicator: "smtp"; File: "2026.07.21wps.exe") Found string "SMTPUTF8" (Indicator: "smtp"; File: "2026.07.21wps.exe") Found string "Got unexpected smtp-server response: %d" (Indicator: "smtp"; File: "2026.07.21wps.exe") Found string "smtp_done(status=%d, premature=%d) -> %d" (Indicator: "smtp"; File: "2026.07.21wps.exe") Found string "smtp_perform(), start" (Indicator: "smtp"; File: "2026.07.21wps.exe") Found string "smtp_perform() -> %d, connected=%d, done=%d" (Indicator: "smtp"; File: "2026.07.21wps.exe") Found string "smtp_do() -> %d, done=%d" (Indicator: "smtp"; File: "2026.07.21wps.exe") Found string "smtp_disconnect(), finished" (Indicator: "smtp"; File: "2026.07.21wps.exe") Found string "smtp_doing() -> %d, done=%d" (Indicator: "smtp"; File: "2026.07.21wps.exe") Found string "smtp_regular_transfer() -> %d, done=%d" (Indicator: "smtp"; File: "2026.07.21wps.exe") Found string "smtp_setup_connection() -> %d" (Indicator: "smtp"; File: "2026.07.21wps.exe") Found string "smtp." (Indicator: "smtp"; File: "2026.07.21wps.exe")41:Tc81,Found reference to API "gethostname" (Indicator: "gethostname"; File: "2026.07.21wps.exe") Found reference to API "__WSAFDIsSet" (Indicator: "__wsafdisset"; File: "2026.07.21wps.exe") Found reference to API "WSAGetLastError" (Indicator: "wsagetlasterror"; File: "2026.07.21wps.exe") Found reference to API "database was not shutdown cleanly (%s)" (Indicator: " shutdown "; File: "2026.07.21wps.exe") Found reference to API "%hs: Periodic trim will not run for a database in inc reseed or revert or dirty and patched shutdown status." (Indicator: " shutdown "; File: "2026.07.21wps.exe") Found reference to API "Database was not shutdown cleanly. Recovery must first be run to properly complete database operations for the previous shutdown." (Indicator: " shutdown "; File: "2026.07.21wps.exe") Found reference to API "The instance was shutdown successfully but all the attached databases were left in a dirty state by request via JET_bitTermDirty" (Indicator: " shutdown "; File: "2026.07.21wps.exe") Found reference to API "WARNING: no socket in pollset or timer, transfer may stall!" (Indicator: " socket "; File: "2026.07.21wps.exe") Found reference to API "SSL shutdown timeout" (Indicator: " shutdown "; File: "2026.07.21wps.exe") Found reference to API "%s connect timeout after %lldms, move on!" (Indicator: " connect "; File: "2026.07.21wps.exe") Found reference to API "%s connect -> %d, connected=%d" (Indicator: " connect "; File: "2026.07.21wps.exe") Found reference to API "Failed to connect to %s port %u after %lld ms: %s" (Indicator: " connect "; File: "2026.07.21wps.exe") Found reference to API "query connect reply: %dms" (Indicator: " connect "; File: "2026.07.21wps.exe") Found reference to API "[SHUTDOWN] shutdown all" (Indicator: " shutdown "; File: "2026.07.21wps.exe") Found reference to API "[SHUTDOWN] shutdown finished cleanly" (Indicator: " shutdown "; File: "2026.07.21wps.exe") Found reference to API "[SHUTDOWN] shutdown finished, %s" (Indicator: " shutdown "; File: "2026.07.21wps.exe") Found reference to API "[SHUTDOWN] shutdown finished, aborted" (Indicator: " shutdown "; File: "2026.07.21wps.exe") Found reference to API "[SHUTDOWN] discarding oldest shutdown connection due to connection limit of %zu" (Indicator: " shutdown "; File: "2026.07.21wps.exe") Found reference to API "Could not connect to server" (Indicator: " connect "; File: "2026.07.21wps.exe") Found reference to API "FTP: The server failed to connect to data port" (Indicator: " connect "; File: "2026.07.21wps.exe") Found reference to API "FTP: Accepting server connect has timed out" (Indicator: " connect "; File: "2026.07.21wps.exe") Found reference to API "SSL connect error" (Indicator: " connect "; File: "2026.07.21wps.exe") Found reference to API "schannel: Windows version is old and may not be able to connect to some servers due to lack of SNI, algorithms, etc." (Indicator: " connect "; File: "2026.07.21wps.exe") Found reference to API "schannel: server indicated shutdown in a prior call" (Indicator: " shutdown "; File: "2026.07.21wps.exe") Found reference to API "LDAP local: Cannot connect to %s:%u" (Indicator: " connect "; File: "2026.07.21wps.exe")42:T520,Pattern match: "https://curl.se/docs/http-cookies.html#" Pattern match: "https://curl.se/docs/alt-svc.html#" Pattern match: "https://curl.se/docs/hsts.html#" Heuristic match: ".onion" Heuristic match: "sigf0430d7755150d0cf0031b6d463b634b4f8a03274db72140536d4bd944dc13041ee79ada84f5368659a151e9b00f33e24351.sige253af9702a6ab27d63193f9114afbc3de9452651773b074 pmxdcwdtbviioqdxfmm17ia6mp0_cert-sse21c97xa7khwzmqs8tz2keosxq8e6l5dyl4pdz6bx0rgaeal3wopgy5zavaei33m_" Pattern match: "http://www.w3.org/2001/xmlschema-instance" Heuristic match: "ystem.activityhistory.id" Heuristic match: "ystem.appusermodel.id" Heuristic match: "ystem.identityprovider.name" Heuristic match: "ystem.protocol.name" Heuristic match: "ystem.sam.name" Heuristic match: "ystem.structuredquery.is" Heuristic match: "ystem.structuredquery.virtual.cc" Heuristic match: "ystem.structuredquery.virtual.to" Heuristic match: "system.activityhistory.id" Heuristic match: "system.identityprovider.name" Heuristic match: "system.sam.name" Heuristic match: "system.structuredquery.virtual.cc" Heuristic match: "system.structuredquery.virtual.to" Heuristic match: "system.structuredquery.is" Heuristic match: "system.protocol.name" Heuristic match: "system.appusermodel.id" Heuristic match: "system.structuredquerytype.implicit.is"43:T5d8,Found string "# Netscape HTTP Cookie File# https://curl.se/docs/http-cookies.html# This file was generated by libcurl! Edit at your own risk." (Indicator: "libcurl"; File: "2026.07.21wps.exe") Found string "# Your alt-svc cache. https://curl.se/docs/alt-svc.html# This file was generated by libcurl! Edit at your own risk." (Indicator: "libcurl"; File: "2026.07.21wps.exe") Found string "# Your HSTS cache. https://curl.se/docs/hsts.html# This file was generated by libcurl! Edit at your own risk." (Indicator: "libcurl"; File: "2026.07.21wps.exe") Found string "A requested feature, protocol or option was not found built-in in this libcurl due to a build-time decision." (Indicator: "libcurl"; File: "2026.07.21wps.exe") Found string "A libcurl function was given a bad argument" (Indicator: "libcurl"; File: "2026.07.21wps.exe") Found string "An unknown option was passed in to libcurl" (Indicator: "libcurl"; File: "2026.07.21wps.exe") Found string "libcurl lacks IDN support" (Indicator: "libcurl"; File: "2026.07.21wps.exe") Found string "CLIENT libcurl 8.13.0-DEVMATCH %s %s %sQUIT" (Indicator: "libcurl"; File: "2026.07.21wps.exe") Found string "CLIENT libcurl 8.13.0-DEVDEFINE %s %sQUIT" (Indicator: "libcurl"; File: "2026.07.21wps.exe") Found string "CLIENT libcurl 8.13.0-DEV%sQUIT" (Indicator: "libcurl"; File: "2026.07.21wps.exe") Found string "Unrecognized content encoding type. libcurl understands %s content encodings." (Indicator: "libcurl"; File: "2026.07.21wps.exe")44:T847,Found string "base64" (Indicator: "base64"; File: "2026.07.21wps.exe") Found string "CALG_3DES_112" (Indicator: "3des"; File: "2026.07.21wps.exe") Found string "CALG_3DES" (Indicator: "3des"; File: "2026.07.21wps.exe") Found string "CALG_AES_128" (Indicator: "aes"; File: "2026.07.21wps.exe") Found string "CALG_AES_192" (Indicator: "aes"; File: "2026.07.21wps.exe") Found string "CALG_AES_256" (Indicator: "aes"; File: "2026.07.21wps.exe") Found string "CALG_AES" (Indicator: "aes"; File: "2026.07.21wps.exe") Found string "CALG_ECDSA" (Indicator: "ecdsa"; File: "2026.07.21wps.exe") Found string "ecdsa-with-SHA1" (Indicator: "ecdsa"; File: "2026.07.21wps.exe") Found string "ecdsa-with-SHA224" (Indicator: "ecdsa"; File: "2026.07.21wps.exe") Found string "ecdsa-with-SHA256" (Indicator: "ecdsa"; File: "2026.07.21wps.exe") Found string "ecdsa-with-SHA384" (Indicator: "ecdsa"; File: "2026.07.21wps.exe") Found string "ecdsa-with-SHA512" (Indicator: "ecdsa"; File: "2026.07.21wps.exe") Found string "ystem.OfflineFiles.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00003596.00000001.200222.5C780000.00000002.mdmp") Found string "ystem.Security.EncryptionOwners" (Indicator: ".encrypt"; Source: "00000000-00003596.00000001.200222.5C780000.00000002.mdmp") Found string "ystem.Security.EncryptionOwnersDisplay" (Indicator: ".encrypt"; Source: "00000000-00003596.00000001.200222.5C780000.00000002.mdmp") Found string "ystem.ZipFolder.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00003596.00000001.200222.5C780000.00000002.mdmp") Found string "System.Security.EncryptionOwnersDisplay" (Indicator: ".encrypt"; Source: "00000000-00003596.00000001.200222.5E520000.00000002.mdmp") Found string "System.Security.EncryptionOwners" (Indicator: ".encrypt"; Source: "00000000-00003596.00000001.200222.5E520000.00000002.mdmp") Found string "System.OfflineFiles.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00003596.00000001.200222.5E520000.00000002.mdmp") Found string "System.ZipFolder.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00003596.00000001.200222.5E520000.00000002.mdmp")45:T41c,Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "2026.07.21wps.exe") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "2026.07.21wps.exe") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "2026.07.21wps.exe") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "2026.07.21wps.exe") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "2026.07.21wps.exe") Found reference to API "GetTempPath2W" (Indicator: "GetTempPath"; File: "2026.07.21wps.exe") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; File: "2026.07.21wps.exe") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; File: "2026.07.21wps.exe") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "2026.07.21wps.exe") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; File: "2026.07.21wps.exe")46:T7ad,Found string "Hostname in DNS cache was stale, zapped" (Indicator: "hostname"; File: "2026.07.21wps.exe") Found string "Hostname in DNS cache does not have needed family, zapped" (Indicator: "hostname"; File: "2026.07.21wps.exe") Found string "Hostname %s was found in DNS cache" (Indicator: "hostname"; File: "2026.07.21wps.exe") Found string "Could not resolve hostname" (Indicator: "hostname"; File: "2026.07.21wps.exe") Found string "Bad hostname" (Indicator: "hostname"; File: "2026.07.21wps.exe") Found string "WS: PING frame must not be fragmented" (Indicator: "ping"; File: "2026.07.21wps.exe") Found string "WS: auto-respond to PING with a PONG" (Indicator: "ping"; File: "2026.07.21wps.exe") Found string "Hostname '%s' was found" (Indicator: "hostname"; File: "2026.07.21wps.exe") Found string "SOCKS4: too long hostname" (Indicator: "hostname"; File: "2026.07.21wps.exe") Found string "SOCKS5: the destination hostname is too long to be resolved remotely by the proxy." (Indicator: "hostname"; File: "2026.07.21wps.exe") Found string "SOCKS5: hostname '%s' found" (Indicator: "hostname"; File: "2026.07.21wps.exe") Found string "aws-sigv4: service missing in parameters and hostname" (Indicator: "hostname"; File: "2026.07.21wps.exe") Found string "aws-sigv4: region missing in parameters and hostname" (Indicator: "hostname"; File: "2026.07.21wps.exe") Found string "schannel: connection hostname (%s) matched cert's IP address!" (Indicator: "hostname"; File: "2026.07.21wps.exe") Found string "schannel: connection hostname (%s) validated against certificate name (%s)" (Indicator: "hostname"; File: "2026.07.21wps.exe") Found string "schannel: connection hostname (%s) did not match against certificate name (%s)" (Indicator: "hostname"; File: "2026.07.21wps.exe") Found string "schannel: CertGetNameString() failed to match connection hostname (%s) against server certificate names" (Indicator: "hostname"; File: "2026.07.21wps.exe")47:T42a,"2026.07.21_wps.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "") "2026.07.21_wps.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "LDAPCLIENTINTEGRITY"; Value: "") "2026.07.21_wps.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEOLDHOSTRESOLUTIONORDER"; Value: "") "2026.07.21_wps.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEHOSTNAMEASALIAS"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\TIMEOUT.EXE"; Value: "")48:T665,"2026.07.21_wps.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") "2026.07.21_wps.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "0100000000") "2026.07.21_wps.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0100000000") "2026.07.21_wps.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0000000000") "2026.07.21_wps.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "2BA67E4B771ADD010000000000000000000000000200000000") "2026.07.21_wps.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC3475"; Value: "C80C000000000000040004000102040000000000630000000D787900010000006B507E000200000087DE830044000000A19F5E000400010000006F00000056737D00070000006B507E00010000009829B70007000000E6C53100010004000000090000001A9CB2000100050000000100000016F0B20001006500000078030000E6C5310000") "cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\TIMEOUT.EXE"; Value: "A105BF4B771ADD010000000000000000000000000200000000")49:T85e,file/memory contains long string with (Indicator: "cmd="; File: "2026.07.21wps.exe") Found string "Total Number of FCBs: %10ld" (Indicator: "cmd="; File: "2026.07.21wps.exe") Found string "In Use: %10ld" (Indicator: "cmd="; File: "2026.07.21wps.exe") Found string "Available: %10ld" (Indicator: "cmd="; File: "2026.07.21wps.exe") Found string "Purgeable FCBs (estimated*): %10ld" (Indicator: "cmd="; File: "2026.07.21wps.exe") Found string "Unpurgeable FCBs (estimated*): %10ld" (Indicator: "cmd="; File: "2026.07.21wps.exe") Found string "ESE TLS: %N" (Indicator: "cmd="; File: "2026.07.21wps.exe") Found string "OLDEST TRANSACTION: 0x%N" (Indicator: "cmd="; File: "2026.07.21wps.exe") Found string "_TLS * = 0x%p" (Indicator: "cmd="; File: "2026.07.21wps.exe") Found string "OSTLS * = 0x%p" (Indicator: "cmd="; File: "2026.07.21wps.exe") Found string "TLS * = 0x%p" (Indicator: "cmd="; File: "2026.07.21wps.exe") Found string "Avail: %8I64d (%6.2f%%)" (Indicator: "cmd="; File: "2026.07.21wps.exe") Found string "Untidy: %8I64d (%6.2f%%)" (Indicator: "cmd="; File: "2026.07.21wps.exe") Found string "Dirty: %8I64d (%6.2f%%)" (Indicator: "cmd="; File: "2026.07.21wps.exe") Found string "Filthy: %8I64d (%6.2f%%)" (Indicator: "cmd="; File: "2026.07.21wps.exe") Found string "Reading: %8I64d" (Indicator: "cmd="; File: "2026.07.21wps.exe")1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"0628c0d2ca16727fefb2160576fbd9200f8d5d163a8ce550bbd87a650cc66fe1","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":90,"unified_at_epoch_ms":1791852554907,"unified_at":"2026-10-13T00:49:14.907Z","metadata":{"hashes":{"sha256":"0628c0d2ca16727fefb2160576fbd9200f8d5d163a8ce550bbd87a650cc66fe1","sha1":"5d34e68044c630f8521b650c4f3dbe4da80edc12","md5":"1fe76b7c6e8be90ab3965b243aceed93","sha512":"ad140a8c3434b5f96e58bab51668ac8203814ce97e2c4bf7b43538d51eed6454082199875617d24287e70a846f7a929df4e4e7ee155332daaf2081c5d1322471","ssdeep":"98304:MEIL2C3iWwn75kSwcDCio5Lkp66e9HKIj5TgEhL+ZTKgJ/:MEILH3iWwn75kSwCWpkp66exKIj50WLa","ssdeep_chunks":["98304:MEIL2C3","98304:EIL2C3i","98304:IL2C3iW","98304:L2C3iWw","98304:2C3iWwn","98304:C3iWwn7","98304:3iWwn75","98304:iWwn75k","98304:Wwn75kS","98304:wn75kSw","98304:n75kSwc","98304:75kSwcD","98304:5kSwcDC","98304:kSwcDCi","98304:SwcDCio","98304:wcDCio5","98304:cDCio5L","98304:DCio5Lk","98304:Cio5Lkp","98304:io5Lkp6","98304:o5Lkp66","98304:5Lkp66e","98304:Lkp66e9","98304:kp66e9H","98304:p66e9HK","98304:66e9HKI","98304:6e9HKIj","98304:e9HKIj5","98304:9HKIj5T","98304:HKIj5Tg","98304:KIj5TgE","98304:Ij5TgEh","98304:j5TgEhL","98304:5TgEhL+","98304:TgEhL+Z","98304:gEhL+ZT","98304:EhL+ZTK","98304:hL+ZTKg","98304:L+ZTKgJ","98304:+ZTKgJ/","196608:MEIL2C3","196608:EIL2C3i","196608:IL2C3iW","196608:L2C3iWw","196608:2C3iWwn","196608:C3iWwn7","196608:3iWwn75","196608:iWwn75k","196608:Wwn75kS","196608:wn75kSw","196608:n75kSwc","196608:75kSwcD","196608:5kSwcDC","196608:kSwcDCi","196608:SwcDCio","196608:wcDCio5","196608:cDCio5L","196608:DCio5Lk","196608:Cio5Lkp","196608:io5Lkp6","196608:o5Lkp66","196608:5Lkp66e","196608:Lkp66e9","196608:kp66e9H","196608:p66e9HK","196608:66e9HKI","196608:6e9HKIj","196608:e9HKIj5","196608:9HKIj5T","196608:HKIj5Tg","196608:KIj5TgE","196608:Ij5TgEh","196608:j5TgEhL","196608:5TgEhL+","196608:TgEhL+Z","196608:gEhL+ZT","196608:EhL+ZTK","196608:hL+ZTKg","196608:L+ZTKgJ","196608:+ZTKgJ/","98304:MEILH3i","98304:EILH3iW","98304:ILH3iWw","98304:LH3iWwn","98304:H3iWwn7","98304:n75kSwC","98304:75kSwCW","98304:5kSwCWp","98304:kSwCWpk","98304:SwCWpkp","98304:wCWpkp6","98304:CWpkp66","98304:Wpkp66e","98304:pkp66ex","98304:kp66exK","98304:p66exKI","98304:66exKIj","98304:6exKIj5","98304:exKIj50","98304:xKIj50W","98304:KIj50WL","98304:Ij50WLa"],"imphash":"59a7dc582f22be673d298b13fa89ab62"},"file_info":{"file_name":"2026.07.21裁员名单及补偿方案wps.exe","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":4939680,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1784792729000,"last_seen":1784792729000,"last_multi_scan":1784792729000}},"detections":{"summary":{"verdict":"malicious","score":90,"tags":null},"stats":{"av":{"malicious_count":8,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":81},"sandbox_signatures":{"informative_count":179,"suspicious_count":10,"malicious_count":5,"total":194},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W64.Evo","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Yogi.33948","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_90% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Yogi.33948 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win64/Agent.JXN trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"HVM:Backdoor/Lotok.dd","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"capa_resolve_DNS","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Yogi.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Resource Development","technique":"Digital Certificates","attack_id":"T1588.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1588/004","identifiers":[{"type":"informative","value":"May contain SSL certificate"}],"sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"suspicious","value":"Imports suspicious APIs"}],"sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"suspicious","value":"Opened the service control manager"}],"sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"tactic":"Persistence","technique":"Transport Agent","attack_id":"T1505.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1505/002","identifiers":[{"type":"informative","value":"Able to establish persistence using Exchange transport agent (.NET)"}],"sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"}],"sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"tactic":"Privilege Escalation","technique":"Process Doppelgänging","attack_id":"T1055.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/013","identifiers":[{"type":"informative","value":"Contains ability to perform Process Doppelganging (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"},{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Able to modify process memory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Contains ability to encrypt/encode message (API string)"},{"type":"informative","value":"Able to utilize the Windows bcrypt cryptographic API"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"YARA signature match – Encryption algorithm"},{"type":"informative","value":"YARA signature match - Djb2 Hash Algorithm"},{"type":"informative","value":"Contains key cryptographic functions (API string)"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"tactic":"Defense Evasion","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to query local/system time as file time"}],"sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"},{"type":"informative","value":"Contains a Wine emulator-related string"}],"sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"suspicious","value":"Opens file with deletion access rights"}],"sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Contains ability to enumerate volumes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"Contains ability to detect virtual environment (API)"}],"sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"informative","value":"YARA signature match – Embedded PE executable"}],"sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"},{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Found strings related to keylogger"}],"sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve the host name of a computer (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Calls an API used to retrieve geographical location information"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve operating system version"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads information about supported languages"}],"sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Contains ability to retrieve process ID (API string)"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Spawns new processes"}],"sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Contains ability to enumerates all mounted drives"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains references to file movement (imports API)"}],"sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Possibly checks for the presence of an Antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Able to retrieve machine time (API string)"},{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"tactic":"Discovery","technique":"Domain Groups","attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"References Windows LDAP client module"},{"type":"informative","value":"Loads Windows LDAP client module"},{"type":"informative","value":"Imports a library used to perform LDAP operation"}],"sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"}],"sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"tactic":"Discovery","technique":"Internet Connection Discovery","attack_id":"T1016.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1016/001","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Contains ability to compress/decompress buffers (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Contains reference to Mail transfer protocol"},{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Shows ability to use asymmetric encryption algorithm"}],"sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Contains ability to transfer data using curl"}],"sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Contains ability to use Webdav for network"},{"type":"informative","value":"Uses cURL to communicate over HTTPS"},{"type":"informative","value":"Found string related to HTTP headers"}],"sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"tactic":"Command and Control","technique":"Remote Access Tools","attack_id":"T1219","attack_id_wiki":"https://attack.mitre.org/techniques/T1219","identifiers":[{"type":"informative","value":"Able to use IDE tunneling for remote connection"}],"sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"suspicious","value":"Contains indicators of bot communication commands"}],"sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Able to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Able to import cryptographic keys (seen in ransomware)"},{"type":"informative","value":"Contains reference to cryptographic keys"},{"type":"informative","value":"Contains reference to crypto DLLs"}],"sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"tactic":"Impact","technique":"Data Destruction","attack_id":"T1485","attack_id_wiki":"https://attack.mitre.org/techniques/T1485","identifiers":[{"type":"malicious","value":"Executes file deletion commands for data destruction"}],"sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify process memory (API string)","description":"Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00003596.00000000.200101.5A8F8000.00000004.mdmp\")\n Found reference to API \"lVirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00003596.00000000.200101.5A8F8000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","id":"string-439","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"OpenThread\" (Indicator: \"OpenThread\"; File: \"2026.07.21wps.exe\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to compress/decompress buffers (API string)","description":"Found reference to API \"RtlCompressBuffer\" (Indicator: \"RtlCompressBuffer\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"RtlDecompressBuffer\" (Indicator: \"RtlDecompressBuffer\"; Source: \"00000000-00003596.00000000.200101.5A8F8000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-404","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"2026.07.21wps.exe\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; File: \"2026.07.21wps.exe\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"2026.07.21wps.exe\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"$29","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"KeySizesCheckVsErrStateInconsistent\" (Indicator: \"KeySizes\"; File: \"2026.07.21wps.exe\")\n Found reference to \"CALG_RC2\" (Indicator: \"RC2\"; File: \"2026.07.21wps.exe\")\n Found reference to \"CALG_HMAC\" (Indicator: \"HMAC\"; File: \"2026.07.21wps.exe\")\n Found reference to \"%.*s4-HMAC-SHA256%s%s%s\" (Indicator: \"HMAC\"; File: \"2026.07.21wps.exe\")\n Found reference to \"Authorization: %.*s4-HMAC-SHA256 Credential=%s/%s, SignedHeaders=%s, Signature=%s%s%s\" (Indicator: \"HMAC\"; File: \"2026.07.21wps.exe\")\n Found reference to \"ecdsa-with-SHA384\" (Indicator: \"SHA384\"; File: \"2026.07.21wps.exe\")\n Found reference to \"ecdsa-with-SHA512\" (Indicator: \"SHA512\"; File: \"2026.07.21wps.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\PhysicalDrive%u; Source: \"2026.07.21wps.exe\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$2a","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2b","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"NtQueryInformationProcess\" (Indicator: \"NtQueryInformationProcess\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"OutputDebugStringA\" (Indicator: \"OutputDebugString\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"2026.07.21wps.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"2026.07.21wps.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to import cryptographic keys (seen in ransomware)","description":"Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; File: \"2026.07.21wps.exe\")\n Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00003596.00000000.200101.5C530000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-603","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to utilize the Windows bcrypt cryptographic API","description":"Found reference to API \"BCryptOpenAlgorithmProvider\" (Indicator: \"BCryptOpenAlgorithmProvider\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"BCryptCloseAlgorithmProvider\" (Indicator: \"BCryptCloseAlgorithmProvider\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"BCryptGenerateSymmetricKey\" (Indicator: \"BCryptGenerateSymmetricKey\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"BCryptEncrypt\" (Indicator: \"BCryptEncrypt\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"BCryptDestroyKey\" (Indicator: \"BCryptDestroyKey\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"BCryptDecrypt\" (Indicator: \"BCryptDecrypt\"; File: \"2026.07.21wps.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-927","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$2d","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to encrypt/encode message (API string)","description":"Found reference to API \"CryptStringToBinaryA\" (Indicator: \"CryptStringToBinary\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"EncryptMessage\" (Indicator: \"EncryptMessage\"; File: \"2026.07.21wps.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-213","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"BCryptDecrypt\" (Indicator: \"BCryptDecrypt\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"BCryptDecrypt\" (Indicator: \"CryptDecrypt\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"DecryptMessage\" (Indicator: \"DecryptMessage\"; File: \"2026.07.21wps.exe\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains key cryptographic functions (API string)","description":"Found reference to API \"CryptImportKey\" (Indicator: \"CryptImportKey\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"CryptAcquireContextA\" (Indicator: \"CryptAcquireContextA\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"CryptDestroyHash\" (Indicator: \"CryptDestroyHash\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"CryptHashData\" (Indicator: \"CryptHashData\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"CryptDestroyKey\" (Indicator: \"CryptDestroyKey\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"CryptCreateHash\" (Indicator: \"CryptCreateHash\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"CryptGetHashParam\" (Indicator: \"CryptGetHashParam\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"CryptEncrypt\" (Indicator: \"CryptEncrypt\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"CryptReleaseContext\" (Indicator: \"CryptReleaseContext\"; File: \"2026.07.21wps.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-195","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00003596.00000000.200101.5C530000.00000004.mdmp, 00000000-00003596.00000001.200222.5C530000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$30","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use asymmetric encryption algorithm","description":"The analysis found public/private key which shows ability to use asymmetric encryption algorithm. Matched sigs: Possibly contains Public/Private key (encryption)","origin":"Indicator Combinations","mitre_attack_id":"T1573.002","relevance":1,"id":"summary-33","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$31","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveTypeW\"; File: \"2026.07.21wps.exe\")","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00003596.00000000.200101.5A8F8000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"ystem.Identity.QualifiedUserName\" (Source: \"00000000-00003596.00000001.200222.5C780000.00000002.mdmp\")\n Found string \"ystem.Identity.UserName\" (Source: \"00000000-00003596.00000001.200222.5C780000.00000002.mdmp\")\n Found string \"ystem.UserName\" (Source: \"00000000-00003596.00000001.200222.5C780000.00000002.mdmp\")\n Found string \"System.Identity.UserName\" (Source: \"00000000-00003596.00000001.200222.5E520000.00000002.mdmp\")\n Found string \"System.Identity.QualifiedUserName\" (Source: \"00000000-00003596.00000001.200222.5E520000.00000002.mdmp\")\n Found string \"System.UserName\" (Source: \"00000000-00003596.00000001.200222.5E520000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; File: \"2026.07.21wps.exe\")\n Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00003596.00000000.200101.5A8F8000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"2026.07.21wps.exe\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"GetLocaleInfoEx\" (Indicator: \"GetLocaleInfo\"; File: \"2026.07.21wps.exe\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatus\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatusEx\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpaceEx\"; File: \"2026.07.21wps.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"GetTimeFormatW\" (Indicator: \"GetTimeFormat\"; File: \"2026.07.21wps.exe\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"getaddrinfo() thread failed to start\" (Indicator: \"getaddrinfo\"; File: \"2026.07.21wps.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"NtQuerySystemInformation\" in file \"2026.07.21wps.exe\"\n Found system information discovery API: \"RtlNtStatusToDosError\" in file \"2026.07.21wps.exe\"\n Found system information discovery API: \"GetNativeSystemInfo\" in file \"2026.07.21wps.exe\"\n Found system information discovery API: \"GetSystemInfo\" in file \"2026.07.21wps.exe\"\n Found system information discovery API: \"NtQuerySystemInformation\" in \"00000000-00003596.00000000.200101.5A8F8000.00000004.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"2026.07.21wps.exe\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"2026.07.21_wps.exe\" called \"RtlDecompressBuffer\" with parameters (UID: 00000000-00003596)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"2026.07.21_wps.exe\" called \"Process32FirstW\" with parameters (UID: 00000000-00003596)\n \"2026.07.21_wps.exe\" called \"Process32NextW\" with parameters (UID: 00000000-00003596)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"2026.07.21_wps.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00003596)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"2026.07.21_wps.exe\" called \"GetForegroundWindow\" (UID: 00000000-00003596)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"2026.07.21_wps.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00003596)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$32","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API used to retrieve geographical location information","description":"Observed import api \"getaddrinfo\" which can be \"used to convert host name to address\" [Source: 2026.07.21wps.exe]","origin":"Static Parser","mitre_attack_id":"T1082","relevance":5,"id":"static-190","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains a Wine emulator-related string","description":"\"wine_get_version\" (Indicator: \"wine_get_version\"; File: \"2026.07.21wps.exe\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":5,"id":"string-62","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount@KERNEL32.dll at 55214-10438-00000001400B72F0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; File: \"2026.07.21wps.exe\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate volumes (API string)","description":"Found reference to API \"GetVolumePathNameW\" (Indicator: \"GetVolumePathName\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"FindFirstVolumeW\" (Indicator: \"FindFirstVolume\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"FindNextVolumeW\" (Indicator: \"FindNextVolume\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"FindVolumeClose\" (Indicator: \"FindVolumeClose\"; File: \"2026.07.21wps.exe\")","origin":"File/Memory","mitre_attack_id":"T1006","relevance":1,"id":"string-194","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerates all mounted drives","description":"GetDriveTypeW@KERNEL32.dll at 55214-10323-0000000140106330","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-66","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"GetSystemTimeAsFileTime@KERNEL32.dll at 55214-23349-0000000140101761","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.dll at 55214-23349-0000000140101761","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"2026.07.21_wps.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"2026.07.21_wps.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"Found string \"Set (completed)\" (Indicator: \"set \"; File: \"2026.07.21wps.exe\")\n Found string \"set timeouts for state %d; Total % lld, retry %d maxtry %d\" (Indicator: \"set \"; File: \"2026.07.21wps.exe\")\n Found string \"set next attempt to start in %ums\" (Indicator: \"set \"; File: \"2026.07.21wps.exe\")\n Found string \"set filter for listen socket fd=%qd ip=%s:%d\" (Indicator: \"set \"; File: \"2026.07.21wps.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; File: \"2026.07.21wps.exe\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"Observed string: \"VER

\" (Indicator: \"ver \") in Source: 2026.07.21wps.exe\n Observed string: \"VER checksum is: %u (0x%08X)\" (Indicator: \"ver \") in Source: 2026.07.21wps.exe","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-327","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; File: \"2026.07.21wps.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"VerifyVersionInfoW\" (Indicator: \"VerifyVersionInfo\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"VerSetConditionMask\" (Indicator: \"VerSetConditionMask\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"JetGetVersionEx\" (Indicator: \"GetVersion\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"JetGetVersionEx( sesid, pVersion )\" (Indicator: \"GetVersion\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"JetGetVersion@8\" (Indicator: \"GetVersion\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"JetGetVersion\" (Indicator: \"GetVersion\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"RtlVerifyVersionInfo\" (Indicator: \"VerifyVersionInfo\"; File: \"2026.07.21wps.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"2026.07.21wps.exe\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"NtQueryVolumeInformationFile\" (Indicator: \"NtQueryVolumeInformationFile\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"GetVolumeNameForVolumeMountPointW\" (Indicator: \"GetVolumeNameForVolumeMountPoint\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; File: \"2026.07.21wps.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"GetProcessHeap@KERNEL32.dll at 55214-11146-0000000140022380","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"2026.07.21_wps.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"2026.07.21_wps.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyExW\" in file \"2026.07.21wps.exe\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileExA\" (Indicator: \"MoveFileExA\"; File: \"2026.07.21wps.exe\")\n Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; File: \"2026.07.21wps.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00003596.00000000.200101.5A8F8000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"2026.07.21_wps.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\cmd.exe\" /c timeout 2 & del /f /q \"C:\\2026.07.21_wps.exe\"\" - (UID: 00000000-00003596)\n \"cmd.exe\" called \"CreateProcessW\" with parameter \"timeout 2\" - (UID: 00000000-00004672)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"\"2026.07.21_wps.exe\" called \"LoadLibrary\" with a parameter advapi32 (UID: 00000000-00003596)\n \"2026.07.21_wps.exe\" called \"LoadLibrary\" with a parameter shell32.dll (UID: 00000000-00003596)\n \"2026.07.21_wps.exe\" called \"LoadLibrary\" with a parameter ADVAPI32.dll (UID: 00000000-00003596)\n \"2026.07.21_wps.exe\" called \"LoadLibrary\" with a parameter kernel32.dll (UID: 00000000-00003596)\n \"2026.07.21_wps.exe\" called \"LoadLibrary\" with a parameter ntdll.dll (UID: 00000000-00003596)\n \"2026.07.21_wps.exe\" called \"LoadLibrary\" with a parameter user32.dll (UID: 00000000-00003596)","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$33","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"esent.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"Inserting page %d into BadPages table\" (Source: 2026.07.21wps.exe, Indicator: \"inserting page %d into badpages table\")\n \"Inserted a column record (objidTable %d:columnid %d) into catalogs\" (Source: 2026.07.21wps.exe, Indicator: \"inserted a column record (objidtable %d:columnid %d) into catalogs\"), \"Inserting a column record (objidTable %d:columnid %d) into catalogs fails (%d)\" (Source: 2026.07.21wps.exe, Indicator: \"inserting a column record (objidtable %d:columnid %d) into catalogs fails (%d)\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; File: \"2026.07.21wps.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"2026.07.21wps.exe\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; File: \"2026.07.21wps.exe\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"OS DwOSIACreateFileW( path, %#x, %#x, %#x, %#x )\" (Indicator: \"CreateFile\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; File: \"2026.07.21wps.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"Sleep@KERNEL32.dll at 55214-10314-0000000140108000\n SleepEx@KERNEL32.dll at 55214-10547-00000001400ECD50\n WaitForSingleObjectEx@KERNEL32.dll at 55214-10563-00000001400C7340\n Sleep@KERNEL32.dll at 55214-10567-00000001400C0FD0\n WaitForMultipleObjects@KERNEL32.dll at 55214-10797-00000001400CD470\n Sleep@KERNEL32.dll at 55214-10865-00000001400C1700\n Sleep@KERNEL32.dll at 55214-10919-00000001400C4C70\n Sleep@KERNEL32.dll at 55214-14098-000000014005227A\n Sleep@KERNEL32.dll at 55214-15734-00000001400C1115\n Sleep@KERNEL32.dll at 55214-16922-000000014010C7E5","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"2026.07.21wps.exe\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: 2026.07.21wps.exe)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"$34","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$35","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"yncShellExecute\" (Indicator: \"ShellExecute\"; Source: \"00000000-00003596.00000001.200222.5C530000.00000004.mdmp\")\n Found reference to API \"yncShellExecutep\" (Indicator: \"ShellExecute\"; Source: \"00000000-00003596.00000001.200222.5C530000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileExA\" (Indicator: \"MoveFile\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; File: \"2026.07.21wps.exe\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThreadpoolTimer() -> %p\" (Indicator: \"CreateThread\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"OpenThread\" (Indicator: \"OpenThread\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"CreateThreadpool\" (Indicator: \"CreateThread\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"CreateThreadpoolCleanupGroup\" (Indicator: \"CreateThread\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"CreateThreadpoolWork\" (Indicator: \"CreateThread\"; File: \"2026.07.21wps.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"WSASetLastError\" (Indicator: \"SetLastError\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"WSAGetLastError\" (Indicator: \"GetLastError\"; File: \"2026.07.21wps.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"General","name":"Contains references to file movement (imports API)","description":"Found MoveFileExA in import section (Source: 2026.07.21wps.exe)","origin":"Static Parser","mitre_attack_id":"T1083","relevance":1,"id":"static-205","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$36","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$37","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$38","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"General","name":"Loads Windows LDAP client module","description":"\"2026.07.21_wps.exe\" loaded module \"%WINDIR%\\System32\\Wldap32.dll\" at 736E0000","origin":"Loaded Module","mitre_attack_id":"T1069.002","relevance":3,"id":"module-17","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$39","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"2026.07.21_wps.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 6FB60000\n \"2026.07.21_wps.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 702A0000\n \"cmd.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 702A0000\n \"timeout.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 702A0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"2026.07.21_wps.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 737D0000\n \"cmd.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 737D0000\n \"timeout.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 737D0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a00ce00000040c74970fe7f0000@ntdll.dll\"\n \"22002300ce00000018c74970fe7f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"2026.07.21wps.exe\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"2026.07.21wps.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$3a","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"2026.07.21wps.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"2026.07.21wps.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"2026.07.21wps.exe\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"2026.07.21wps.exe\" file has an entrypoint instructions - \"sub\trsp, 0x28,call\t0x140101740,add\trsp, 0x28,jmp\t0x140100d18,int3\t,int3\t,sub\trsp, 0x28,mov\tr8, qword ptr [r9 + 0x38],mov\trcx, rdx,mov\trdx, r9,call\t0x140100ec0,mov\teax, 1,add\trsp, 0x28,ret\t,int3\t,int3\t,int3\t,push\trbx,mov\tr11d, dword ptr [r8],mov\trbx, rdx,and\tr11d, 0xfffffff8,mov\tr9, rcx,test\tbyte ptr [r8], 4,mov\tr10, rcx,je\t0x140100eeb,mov\teax, dword ptr [r8 + 8],movsxd\tr10, dword ptr [r8 + 4],neg\teax,add\tr10, rcx,movsxd\trcx, eax,and\tr10, rcx,movsxd\trax, r11d,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x10c000\" greater than 0x100000\n Raw size of \".rdata\" is \"0x39dc00\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x10bfa6\" greater than 0x100000\n Virtual size of \".rdata\" is \"0x39db62\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"2026.07.21wps.exe\" has high imagebase \"0x140000000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"General","name":"Possibly checks for the presence of an Antivirus engine","description":"\"fProtected\" (Indicator: \"fprot\") in Source: 2026.07.21wps.exe","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":2,"id":"string-8","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\System32\\cmd.exe\" [Source: 00000000-00003596-00000BC1-2132355515]\n Observed system executable string:\"\"%WINDIR%\\System32\\cmd.exe\" /c timeout 2 & del /f /q \"C:\\2026.07.21_wps.exe\"\" [Source: 00000000-00003596-00000C47-15706318107]\n Observed system executable string:\"%WINDIR%\\system32\\timeout.exe\" [Source: 00000000-00004672-00000C47-516797110]\n Observed system executable string:\"%WINDIR%\\System32\\timeout.exe\" [Source: 00000000-00004672-00000BC0-2132774238]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"cmd.exe\" (UID: 00000000-00004672) was launched with new environment variables: \"USERDNSDOMAIN=\"YneorC0atEsdvEL\"\"\n Process \"cmd.exe\" (UID: 00000000-00004672) was launched with modified environment variables: \"NUMBER_OF_PROCESSORS\"\n Process \"timeout.exe\" (UID: 00000000-00004712) was launched with new environment variables: \"PROMPT=\"$P$G\"\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"2026.07.21_wps.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"2026.07.21_wps.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"General","name":"References Windows LDAP client module","description":"Found string \"WLDAP32.dll\" (File: \"2026.07.21wps.exe\")\n Found string \"WLDAP32.dll\" (Source: \"00000000-00003596.00000000.200101.5C530000.00000004.mdmp, 00000000-00003596.00000001.200222.5C530000.00000004.mdmp\")\n Found string \":\\WINDOWS\\System32\\WLDAP32.dll\" (Source: \"00000000-00003596.00000000.200101.5C530000.00000004.mdmp, 00000000-00003596.00000001.200222.5C530000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1069.002","relevance":1,"id":"string-987","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"cmd.exe\" with commandline \"/c timeout 2 & del /f /q \"C:\\\\2026.07.21_wps.exe\"\" (UID: 00000000-00004672)\n Spawned process \"timeout.exe\" with commandline \"timeout 2\" (UID: 00000000-00004712)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"cmd.exe\" with commandline \"/c timeout 2 & del /f /q \"C:\\\\2026.07.21_wps.exe\"\" (UID: 00000000-00004672)\n Spawned process \"timeout.exe\" with commandline \"timeout 2\" (UID: 00000000-00004712)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$3b","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Installation/Persistence","name":"Able to establish persistence using Exchange transport agent (.NET)","description":"Found string \"ystem.IsAttachment\" (Source: \"00000000-00003596.00000001.200222.5C780000.00000002.mdmp\")\n Found string \"ystem.Message.AttachmentContents\" (Source: \"00000000-00003596.00000001.200222.5C780000.00000002.mdmp\")\n Found string \"ystem.Message.AttachmentNames\" (Source: \"00000000-00003596.00000001.200222.5C780000.00000002.mdmp\")\n Found string \"ystem.Message.HasAttachments\" (Source: \"00000000-00003596.00000001.200222.5C780000.00000002.mdmp\")\n Found string \"System.IsAttachment\" (Source: \"00000000-00003596.00000001.200222.5E520000.00000002.mdmp\")\n Found string \"System.Message.AttachmentContents\" (Source: \"00000000-00003596.00000001.200222.5E520000.00000002.mdmp\")\n Found string \"System.Message.AttachmentNames\" (Source: \"00000000-00003596.00000001.200222.5E520000.00000002.mdmp\")\n Found string \"System.Message.HasAttachments\" (Source: \"00000000-00003596.00000001.200222.5E520000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1505.002","relevance":1,"id":"string-938","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; File: \"2026.07.21wps.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to perform Process Doppelganging (API string)","description":"Found reference to API \"JET_wrnDTCRollbackTransaction\" (Indicator: \"RollbackTransaction\"; File: \"2026.07.21wps.exe\")","origin":"File/Memory","mitre_attack_id":"T1055.013","relevance":1,"id":"string-420","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"2026.07.21_wps.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$3c","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"2026.07.21_wps.exe\" queries basic process information of the \"C:\\2026.07.21_wps.exe\" (UID: 3596)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$3d","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Contains a Wine emulator-related string\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)\n Matched sigs: Contains ability to delay the execution of current thread\n Matched sigs: Contains ability to detect virtual environment (API)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$3e","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"2026.07.21_wps.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"2026.07.21_wps.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$3f","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"2026.07.21_wps.exe\" trying to access non-existent file \"C:\\Windows\\System32\\cmd.exe:ZONE.IDENTIFIER\"\n \"2026.07.21_wps.exe\" trying to access non-existent file \"C:\\Windows\\System32\\cmd.exe:Zone.Identifier\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"2026.07.21wps.exe\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; File: \"2026.07.21wps.exe\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"2026.07.21wps.exe\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Network Related","name":"Contains ability to transfer data using curl","description":"Observed string: \"ALPN: curl offers %s\" (Indicator: \" curl \") in Source: 2026.07.21wps.exe","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-576","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Mail transfer protocol","description":"$40","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-499","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$41","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"imap.\" [Source: 2026.07.21wps.exe]\n Observed email domain:\"smtp.\" [Source: 2026.07.21wps.exe]\n Observed email domain:\"pop3.\" [Source: 2026.07.21wps.exe]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"103.80.135.19\"\n \"127.0.0.1\"\n Potential IP \"127.0.0.1\" found in string \"127.0.0.1/\"\n \"2.5.29.17\"\n \"2.5.4.3\"\n \"2.5.4.4\"\n \"2.5.4.5\"\n \"2.5.4.6\"\n \"2.5.4.7\"\n \"2.5.4.8\"\n \"2.5.4.9\"\n \"2.5.4.10\"\n \"2.5.4.11\"\n \"2.5.4.12\"\n \"2.5.4.13\"\n \"2.5.4.17\"\n \"2.5.4.41\"\n \"2.5.4.42\"\n \"2.5.4.43\"\n \"2.5.4.44\"\n \"2.5.4.45\"\n \"2.5.4.46\"\n \"2.5.4.65\"\n \"2.5.4.72\"\n \"2.5.29.18\"\n \"2.5.29.19\"\n Potential IP \"3.0.0.0\" found in string \"Windows Presentation Foundation Font Cache 3.0.0.0\"\n \"192.168.0.2\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$42","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"Forcing HTTP/1.1 for NTLM\" (Indicator: \"HTTP/1.1\"; File: \"2026.07.21wps.exe\")\n Found string \"HTTP/1.0 connection set to keep alive\" (Indicator: \"HTTP/1.0\"; File: \"2026.07.21wps.exe\")\n Found string \"HTTP/1.0 proxy connection set to keep alive\" (Indicator: \"HTTP/1.0\"; File: \"2026.07.21wps.exe\")\n Found string \"HTTP/1.1 proxy connection set close\" (Indicator: \"HTTP/1.1\"; File: \"2026.07.21wps.exe\")\n Found string \"installing subfilter for HTTP/1.1\" (Indicator: \"HTTP/1.1\"; File: \"2026.07.21wps.exe\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://curl.se\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Network Related","name":"Uses cURL to communicate over HTTPS","description":"$43","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-722","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Djb2 Hash Algorithm","description":"YARA signature for Djb2 Hash Algorithm matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-542","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Embedded PE executable","description":"YARA signature matched on embedded PE in file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":2,"id":"yara-140","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Encryption algorithm","description":"YARA signature for encryption algorithm file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":7,"id":"yara-208","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Remote Access Related","name":"Able to use IDE tunneling for remote connection","description":"Found string \"SSL peer certificate or SSH remote key was not OK\" (Indicator: \" ssh \"; File: \"2026.07.21wps.exe\")\n Found string \"Error in the SSH layer\" (Indicator: \" ssh \"; File: \"2026.07.21wps.exe\")","origin":"File/Memory","mitre_attack_id":"T1219","relevance":1,"id":"string-883","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"B+ncalrpc:[OLE59D7F227EE6B00C1C46EBD818DC5]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00003596.00000001.200222.5C530000.00000004.mdmp\")\n Found string \"9ncalrpc:[epmapper,Security=Impersonation Dynamic False]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00003596.00000001.200222.5C530000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLEFC12ABA5EF80370DE31DA3AA9B52]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00003596.00000001.200222.5C530000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE59D7F227EE6B00C1C46EBD818DC5]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00003596.00000001.200222.5C530000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; File: \"2026.07.21wps.exe\")\n Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00003596.00000001.200222.5C530000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegOpenKeyExW\" in file \"2026.07.21wps.exe\"\n Found registry query API: \"RegQueryValueExW\" in file \"2026.07.21wps.exe\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; File: \"2026.07.21wps.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"NtQueryInformationProcess\" (Indicator: \"NtQueryInformationProcess\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00003596.00000000.200101.5A8F8000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"2026.07.21_wps.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"2026.07.21_wps.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"2\"\n \"th32ProcessID\": \"0\"}\n \"cmd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$44","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; File: \"2026.07.21wps.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"CreateToolhelp32Snapshot\" (Indicator: \"CreateToolhelp32Snapshot\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"Process32FirstW\" (Indicator: \"Process32First\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"Process32NextW\" (Indicator: \"Process32Next\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"NtQueryInformationProcess\" (Indicator: \"QueryInformationProcess\"; File: \"2026.07.21wps.exe\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"2026.07.21wps.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"2026.07.21wps.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"2026.07.21wps.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$45","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve process ID (API string)","description":"Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; Source: \"00000000-00003596.00000000.200101.5A8F8000.00000004.mdmp\")\n Found reference to API \"lGetProcessId\" (Indicator: \"GetProcessId\"; Source: \"00000000-00003596.00000000.200101.5A8F8000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-478","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"2026.07.21wps.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host name of a computer (API string)","description":"Found reference to API \"gethostname\" (Indicator: \"gethostname\"; File: \"2026.07.21wps.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-532","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; File: \"2026.07.21wps.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"Found reference to API \"getsockname\" (Indicator: \"getsockname\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"getsockname() failed: %s\" (Indicator: \"getsockname\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"getsockname() failed with errno %d: %s\" (Indicator: \"getsockname\"; File: \"2026.07.21wps.exe\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-224","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"2026.07.21wps.exe\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"No password part in the URL\" (Indicator: \"password\"; File: \"2026.07.21wps.exe\")\n Found string \"Bad password\" (Indicator: \"password\"; File: \"2026.07.21wps.exe\")\n Found string \"schannel: Failed to import cert file %s, password is bad\" (Indicator: \"password\"; File: \"2026.07.21wps.exe\")\n Found string \"Excessive password length for proxy auth\" (Indicator: \"password\"; File: \"2026.07.21wps.exe\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found strings related to keylogger","description":"Found string \"[PAUSE] flushed %zu/%zu bytes, type=%x -> %d\" (Indicator: \"[pause]\"; File: \"2026.07.21wps.exe\")\n Found string \"[PAUSE] flushed 0/%zu bytes, type=%x -> %d\" (Indicator: \"[pause]\"; File: \"2026.07.21wps.exe\")\n Found string \"[PAUSE] writing %zu/%zu bytes of type %x -> %d\" (Indicator: \"[pause]\"; File: \"2026.07.21wps.exe\")\n Found string \"[PAUSE] buffer %zu more bytes of type %x, total=%zu -> %d\" (Indicator: \"[pause]\"; File: \"2026.07.21wps.exe\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-556","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"$46","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"2026.07.21_wps.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00003596)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\HarddiskVolume2\\2026.07.21_wps.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00003596.00000000.200101.5C530000.00000004.mdmp, 00000000-00003596.00000001.200222.5C530000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00003596.00000000.200101.5C530000.00000004.mdmp, 00000000-00003596.00000001.200222.5C530000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"JET_errRBSRCPageFDPDeleteFileCorrupt\" (Indicator: \"DeleteFile\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"2026.07.21wps.exe\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"SeBackupPrivilege\" (Indicator: \"SeBackupPrivilege\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"LookupPrivilegeValueW\" (Indicator: \"LookupPrivilegeValue\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00003596.00000000.200101.5A8F8000.00000004.mdmp, 00000000-00003596.00000000.200101.5C530000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"ShutDown\" (Indicator: \"shutdown\") in Source: 2026.07.21wps.exe\n Observed string: \"Shutdown send direction error: %d. Broken server? Proceeding as if everything is ok.\" (Indicator: \"shutdown \") in Source: 2026.07.21wps.exe\n Observed string: \"shutdown and remove SSL, start\" (Indicator: \"shutdown \") in Source: 2026.07.21wps.exe\n Observed string: \"shutdown and remove SSL, done -> %d\" (Indicator: \"shutdown \") in Source: 2026.07.21wps.exe\n Observed string: \"shutdown start on%s connection\" (Indicator: \"shutdown \") in Source: 2026.07.21wps.exe\n Observed string: \"shutdown timeout\" (Indicator: \"shutdown \") in Source: 2026.07.21wps.exe\n Observed string: \"shutdown -> %d, done=%d\" (Indicator: \"shutdown \") in Source: 2026.07.21wps.exe","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"2026.07.21wps.exe\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"Found reference to API \"SeManageVolumePrivilege\" (Indicator: \"SeManageVolumePrivilege\"; File: \"2026.07.21wps.exe\")","origin":"File/Memory","mitre_attack_id":"T1548","relevance":3,"id":"string-97","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"2026.07.21wps.exe\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"2026.07.21_wps.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CMD.EXE\"; Value: \"2BA67E4B771ADD010000000000000000000000000200000000\")\n \"cmd.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\TIMEOUT.EXE\"; Value: \"A105BF4B771ADD010000000000000000000000000200000000\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"System Security","name":"Imports a library used to perform LDAP operation","description":"Observed import dll \"wldap32.dll\" which can perform LDAP operation [Source: 2026.07.21wps.exe]","origin":"Static Parser","mitre_attack_id":"T1069.002","relevance":3,"id":"static-225","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"System Security","name":"May contain SSL certificate","description":"\"-----BEGIN CERTIFICATE-----\" (Indicator: \"----begin certificate----\") in Source: 2026.07.21wps.exe","origin":"File/Memory","mitre_attack_id":"T1588.004","relevance":1,"id":"string-574","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$47","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$48","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; File: \"2026.07.21wps.exe\")\n Found reference to API \"OpenMutexW\" (Indicator: \"OpenMutex\"; File: \"2026.07.21wps.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"SleepConditionVariableCS\" (Source: 2026.07.21wps.exe, API is part of module: KERNELBASE.DLL)\n Found string \"FlushFileBuffers\" (Source: 2026.07.21wps.exe, API is part of module: KERNELBASE.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"7/26 Antivirus vendors marked sample as malicious (26% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"suspicious","category":"General","name":"Opened the service control manager","description":"\"2026.07.21_wps.exe\" called \"OpenSCManagerW\" requesting access rights \"0X5\"","origin":"API Call","mitre_attack_id":"T1569.002","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"2026.07.21_wps.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"2026.07.21_wps.exe\" reads file \"C:\\Users\\%OSUSER%\\Documents\\desktop.ini\"\n \"2026.07.21_wps.exe\" reads file \"C:\\Users\\%OSUSER%\\Music\\desktop.ini\"\n \"2026.07.21_wps.exe\" reads file \"C:\\Users\\%OSUSER%\\Pictures\\desktop.ini\"\n \"2026.07.21_wps.exe\" reads file \"C:\\Users\\%OSUSER%\\Videos\\desktop.ini\"\n \"2026.07.21_wps.exe\" reads file \"C:\\Users\\%OSUSER%\\Downloads\\desktop.ini\"\n \"2026.07.21_wps.exe\" reads file \"C:\\Users\\%OSUSER%\\OneDrive\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to use Webdav for network","description":"Found string \"ystem.WebDavPath\" (Indicator: \"webdav\"; Source: \"00000000-00003596.00000001.200222.5C780000.00000002.mdmp\")\n Found string \"System.WebDavPath\" (Indicator: \"webdav\"; Source: \"00000000-00003596.00000001.200222.5E520000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-476","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains indicators of bot communication commands","description":"$49","origin":"File/Memory","mitre_attack_id":"T1041","relevance":3,"id":"string-29","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"cmd.exe\" opened \"C:\\2026.07.21_wps.exe\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"2026.07.21_wps.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"0100000000\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"2026.07.21wps.exe\" claimed CRC 2591504173 while the actual is CRC 4953040","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"CryptEncrypt\n VirtualAlloc\n GetModuleFileNameW\n GetModuleHandleExW\n CreateToolhelp32Snapshot\n GetFileSizeEx\n GetModuleHandleW\n LoadLibraryW\n GetModuleHandleA\n IsDebuggerPresent\n GetProcAddress\n GetSystemDirectoryA\n CreateFileA\n LoadLibraryExW\n UnhandledExceptionFilter\n Process32FirstW\n SleepConditionVariableSRW\n Process32NextW\n GetSystemDirectoryW\n SleepEx\n GetStartupInfoW\n CreateFileW\n GetTickCount\n VirtualProtect\n Sleep\n LoadLibraryA\n GetModuleFileNameA\n TerminateProcess\n GetDriveTypeW\n accept\n bind\n connect\n sendto\n listen\n socket\n recv\n send\n recvfrom\n closesocket","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"2026.07.21wps.exe\" claims program is from Thu Nov 11 20:18:56 2027","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"2026.07.21_wps.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\cmd.exe\" /c timeout 2 & del /f /q \"C:\\2026.07.21_wps.exe\"\" - (UID: 00000000-00003596)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_90% (D)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"2026.07.21_wps.exe\" wrote 00000BBC bytes to a remote process \"C:\\Windows\\System32\\svchost.exe\" (Handle: 564)\n \"2026.07.21_wps.exe\" wrote 00000128 bytes to a remote process \"C:\\Windows\\System32\\svchost.exe\" (Handle: 564)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"level":"malicious","category":"System Destruction","name":"Executes file deletion commands for data destruction","description":"[Recursive deletion on critical path] Process \"cmd.exe\" with commandline \"/c timeout 2 & del /f /q \"C:\\\\2026.07.21_wps.exe\"\" (UID: 00000000-00004672)","origin":"Monitored Target","mitre_attack_id":"T1485","relevance":3,"id":"target-9003","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Writes data to a remote process"},{"detail":"Creates new processes"}],"sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries sensitive IE security settings"},{"detail":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Contains ability to terminate a process"},{"detail":"Attempts to self-delete using a delete command"}],"sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]}]},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":13,"imported_dlls_count":58,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":2,"files_deleted_count":0,"registry_keys_created_count":3,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":3,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Multi-Process"],"sandbox_reports":[{"id":"6a61c69832ae4554240039d4","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":90,"malware_family":"Gen:Variant.Yogi","submit_name":"2026.07.21裁员名单及补偿方案wps.exe","analysis_start_time":"2026-07-23T07:45:30+00:00","indicators_count":{"informative":179,"suspicious":35,"malicious":5},"tags":["Multi-Process"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}],"processes":[{"pid":3596,"ppid":0,"name":"2026.07.21_wps.exe","command_line":"","sha256":"0628c0d2ca16727fefb2160576fbd9200f8d5d163a8ce550bbd87a650cc66fe1","normalized_path":"C:\\2026.07.21_wps.exe","uid":"00000000-00003596","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":4672,"ppid":3596,"name":"cmd.exe","command_line":"/c timeout 2 & del /f /q \"C:\\2026.07.21_wps.exe\"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00000000-00003596","uid":"00000000-00004672"},{"pid":4712,"ppid":4672,"name":"timeout.exe","command_line":"timeout 2","sha256":"b6d49416f9ad736b0de3e8e2f3b9174f7f274751de9cff9f5d0840dd1e03b56a","normalized_path":"%WINDIR%\\system32\\timeout.exe","parent_uid":"00000000-00004672","uid":"00000000-00004712"}],"all_imported_dlls":["fltLib.dll","kernel.appcore.dll","shell32.dll","windows.storage.dll","profapi.dll","cldapi.dll","combase.dll","bcryptprimitives.dll","powrprof.dll","gdi32.dll","gdi32full.dll","cryptsp.dll","OneCoreUAPCommonProxyStub.dll","aepic.dll","vcruntime140_1.dll","Wldap32.dll","shlwapi.dll","ntmarta.dll","imagehlp.dll","mpr.dll","rpcrt4.dll","user32.dll","Windows.StateRepositoryPS.dll","crypt32.dll","vcruntime140.dll","uxtheme.dll","msIso.dll","ws2_32.dll","ucrtbase.dll","sechost.dll","win32u.dll","KernelBase.dll","cfgmgr32.dll","urlmon.dll","sspicli.dll","pcacli.dll","ntdll.dll","edputil.dll","iertutil.dll","sfc_os.dll","advapi32.dll","bcrypt.dll","ole32.dll","oleaut32.dll","version.dll","msvcrt.dll","clbcatq.dll","apphelp.dll","msasn1.dll","msvcp140.dll","cryptbase.dll","kernel32.dll","VxSSL64.dll","SHCore.dll","propsys.dll","normaliz.dll","msvcp_win.dll","imm32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\DESKTOP\\NAMESPACE\\\\","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\DESKTOP\\NAMESPACE\\\\","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\DESKTOP\\NAMESPACE\\DELEGATEFOLDERS\\\\","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3596:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"name":"\\BaseNamedObjects\\SyncRootManager","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3596:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"name":"Local\\SM0:3596:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"name":"Local\\SM0:3596:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"name":"SM0:3596:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"name":"SM0:3596:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3596:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3596:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a61c69832ae4554240039d4"}]}]}},"report_ids":{"sandbox_job_ids":["6a61c69832ae4554240039d4"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Yogi.Generic Sample 0628c0d2ca16… — Score 90/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 0628c0d2ca16…. Malware family: Yogi.Generic. Threat score 90/100. 8/27 AV engines flagged this file. 5 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/0628c0d2ca16727fefb2160576fbd9200f8d5d163a8ce550bbd87a650cc66fe1"}],["$","meta","4",{"property":"og:title","content":"Malicious Yogi.Generic Sample 0628c0d2ca16… — Score 90/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 0628c0d2ca16…. Malware family: Yogi.Generic. Threat score 90/100. 8/27 AV engines flagged this file. 5 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/0628c0d2ca16727fefb2160576fbd9200f8d5d163a8ce550bbd87a650cc66fe1"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Yogi.Generic Sample 0628c0d2ca16… — Score 90/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 0628c0d2ca16…. Malware family: Yogi.Generic. Threat score 90/100. 8/27 AV engines flagged this file. 5 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L4a","11",{}]]