26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 38:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T497,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Ransom.Gunra.Generic Sample 07224a91d2fc… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 07224a91d2fc…. Malware family: Ransom.Gunra.Generic. Threat score 100/100. 15/25 AV engines flagged this file. 5 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac","keywords":["Malicious","Ransom.Gunra.Generic","malware analysis","sandbox report","threat intelligence","07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac"],"about":{"@type":"SoftwareApplication","name":"file","applicationCategory":["peexe","executable"],"identifier":"07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Ransom.Gunra.Generic","antivirusDetections":{"malicious":15,"total":25},"behavioralIndicators":{"malicious":5,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T9ce,"file.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000018000000b4f3b2e4a383b47108ff5800687d6977b0ee590040b1b47108605d95feffffffcced59000272b37170ed59000000177568ee59001b72b371e0dfa87408000000000000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff3400000000000000f8ed590000000000080000000000000000000000000000000000000000000000000017759cf3b2e40000000038ee59006992e174ffffffff34000000f8ed590008000000000000000000177568ee59002794e17400ee59000b0000000000000050ee5900 (UID: 00000000-00004392) "file.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004392) "file.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004392) "file.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e02c527594ed5900226e867700009400000000002d6e867783a1ca652d000000ecb7487518ee5900b1ce980098859e0020ac9d00150000008000000058ed590000005d00dced590070c88777ef3d1f12feffffff2d000000d0cc577527000000aced5900856a88771c238d77eced5900f85f887708000000bb698777b2698777fba1ca652d000000ecb7487527000000d0cc5775c0ed59002d000000d0cc577527000000f0ed5900856a88771c238d7738ee59007e8a5675ee8c5675738a5675b44cb8732d000000ecb7487527000000d0cc5775fc9a9400909a9400b44cb87300ee5900fc529475ecee5900e0845675b4537306feffffff738a5675 (UID: 00000000-00004392)28:T4ec,"file.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004392) "file.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004392) "file.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004392) "file.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004392) "file.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004392) "file.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004392) "file.exe" called "LoadLibrary" with a parameter NTDLL.dll (UID: 00000000-00004392) "file.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00004392) "file.exe" called "LoadLibrary" with a parameter NTDLL (UID: 00000000-00004392) "file.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00004392) "file.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00004392) "file.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00004392) "file.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004392) "file.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00004392)29:T132f,"file.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004392) "file.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004392) "file.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004392) "file.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004392) "file.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004392) "file.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004392) "file.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004392) "file.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004392) "file.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004392) "file.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004392) "file.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004392) "file.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004392) "file.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004392) "file.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004392) "file.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004392) "file.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004392) "file.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004392) "file.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004392) "file.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004392) "file.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004392) "file.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004392) "file.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004392) "file.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004392) "file.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004392) "file.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004392) "file.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004392) "file.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004392) "file.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004392) "file.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004392) "file.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004392) "file.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004392) "file.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004392) "file.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004392) "file.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004392) "file.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004392) "file.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004392) "file.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004392) "file.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004392) "file.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004392) "file.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004392) "file.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004392) "file.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004392) "file.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004392) "file.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004392) "file.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004392) "file.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00004392) "file.exe" called "GetProcAddress" with a parameter timeGetTime (UID: 00000000-00004392) "file.exe" called "GetProcAddress" with a parameter NtOpenThread (UID: 00000000-00004392) "file.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00004392) "file.exe" called "GetProcAddress" with a parameter RtlAllocateHeap (UID: 00000000-00004392)2a:T524,"file.exe" loaded module "KERNEL32" at base 775c0000 "file.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 74d10000 "file.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 74d10000 "file.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 74d10000 "file.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 75140000 "file.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74d10000 "file.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74d10000 "file.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74d10000 "file.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 731c0000 "file.exe" loaded module "USER32.DLL" at base 748c0000 "file.exe" loaded module "ADVAPI32.DLL" at base 74b90000 "file.exe" loaded module "NTDLL.DLL" at base 77b20000 "file.exe" loaded module "WINMM.DLL" at base 730f0000 "file.exe" loaded module "NTDLL" at base 77b20000 "file.exe" loaded module "KERNEL32.DLL" at base 775c0000 "file.exe" loaded module "SHELL32.DLL" at base 75460000 "file.exe" loaded module "GDI32.DLL" at base 75170000 "file.exe" loaded module "OLE32.DLL" at base 771a0000 "file.exe" loaded module "OLEAUT32.DLL" at base 778e0000 "file.exe" loaded module "EXT-MS-WIN-KERNEL32-ERRORHANDLING-L1-1-0.DLL" at base 775c00002b:T443,"file" file has an entrypoint instructions - "jmp 0x88b00a,pmaxsw mm3, qword ptr [ebx],add byte ptr [eax], al,add byte ptr [eax], al,add cl, ch,add byte ptr [eax], ah,add byte ptr [eax], al,add byte ptr [edi], al,or al, byte ptr [eax],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], dh,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax + eax], ah,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,and dword ptr [eax], eax,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,push es,add byte ptr [eax], 0,add byte ptr [eax], al,add byte ptr [eax], al,adc byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add al, 0xa,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,adc byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add cl, byte ptr [edx],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"2c:T53f,"file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\DISABLE8AND16BITMITIGATION"; Key: ""; Value: "")2d:T93d,"file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "FILE.EXE"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "")2e:T553,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00004392.00000000.149586.009D0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00004392.00000000.149586.009D0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00004392.00000000.149586.009D0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00004392.00000000.149586.009D0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00004392.00000000.149586.009D0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00004392.00000000.149586.009D0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00004392.00000000.149586.009D0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00004392.00000000.149586.009D0000.00000004.mdmp")2f:T710,"07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK") "07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS") "07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS") "07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK") "07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK") "07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP6") "07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP6") "07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS") "07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS") "07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS NT\DNSCLIENT") "07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS")30:T3cca,Assembly shows XOR instruction xor edx eax in Stream UID: 00000000-00005180-15888-241-000C7710 Assembly shows XOR instruction xor edx 01h in Stream UID: 00000000-00005180-15888-241-000C7710 Assembly shows XOR instruction xor eax dword ptr [esp+4Ch] in Stream UID: 00000000-00005180-15888-405-00094BA0 Assembly shows XOR instruction xor eax 01h in Stream UID: 00000000-00005180-15888-405-00094BA0 Assembly shows XOR instruction xor ecx ebx in Stream UID: 00000000-00005180-15888-405-00094BA0 Assembly shows XOR instruction xor bl 01h in Stream UID: 00000000-00005180-15888-405-00094BA0 Assembly shows XOR instruction xor edx 00000088h in Stream UID: 00000000-00005180-15888-472-000B8190 Assembly shows XOR instruction xor ebx 01h in Stream UID: 00000000-00005180-15888-472-000B8190 Assembly shows XOR instruction xor al byte ptr [edx-6D5BFFF5h] in Stream UID: 00000000-00005180-15888-472-000B8190 Assembly shows XOR instruction xor edx 9B75E5E4h in Stream UID: 00000000-00005180-15888-473-000B80F0 Assembly shows XOR instruction xor edx 000000DFh in Stream UID: 00000000-00005180-15888-473-000B80F0 Assembly shows XOR instruction xor ebx edx in Stream UID: 00000000-00005180-15888-474-000B7FD0 Assembly shows XOR instruction xor esi eax in Stream UID: 00000000-00005180-15888-474-000B7FD0 Assembly shows XOR instruction xor al byte ptr [esp+edx+2Ch] in Stream UID: 00000000-00005180-15888-474-000B7FD0 Assembly shows XOR instruction xor edi ecx in Stream UID: 00000000-00005180-15888-474-000B7FD0 Assembly shows XOR instruction xor edx ecx in Stream UID: 00000000-00005180-15888-474-000B7FD0 Assembly shows XOR instruction xor ecx esi in Stream UID: 00000000-00005180-15888-474-000B7FD0 Assembly shows XOR instruction xor esi ebp in Stream UID: 00000000-00005180-15888-474-000B7FD0 Assembly shows XOR instruction xor edi ebp in Stream UID: 00000000-00005180-15888-474-000B7FD0 Assembly shows XOR instruction xor edi esi in Stream UID: 00000000-00005180-15888-474-000B7FD0 Assembly shows XOR instruction xor edx edi in Stream UID: 00000000-00005180-15888-474-000B7FD0 Assembly shows XOR instruction xor ecx edx in Stream UID: 00000000-00005180-15888-474-000B7FD0 Assembly shows XOR instruction xor eax 5F000B72h in Stream UID: 00000000-00005180-15888-474-000B7FD0 Assembly shows XOR instruction xor eax A7000B71h in Stream UID: 00000000-00005180-15888-474-000B7FD0 Assembly shows XOR instruction xor ebx ecx in Stream UID: 00000000-00005180-15888-547-000B3AA0 Assembly shows XOR instruction xor edi 02h in Stream UID: 00000000-00005180-15888-547-000B3AA0 Assembly shows XOR instruction xor ebx 57h in Stream UID: 00000000-00005180-15888-547-000B3AA0 Assembly shows XOR instruction xor edx 41h in Stream UID: 00000000-00005180-15888-555-000B3450 Assembly shows XOR instruction xor ebx 000000FDh in Stream UID: 00000000-00005180-15888-555-000B3450 Assembly shows XOR instruction xor esi 000000BEh in Stream UID: 00000000-00005180-15888-555-000B3450 Assembly shows XOR instruction xor edx 02h in Stream UID: 00000000-00005180-15888-555-000B3450 Assembly shows XOR instruction xor eax 09h in Stream UID: 00000000-00005180-15888-555-000B3450 Assembly shows XOR instruction xor al 0Bh in Stream UID: 00000000-00005180-15888-555-000B3450 Assembly shows XOR instruction xor esi 01h in Stream UID: 00000000-00005180-15888-649-000AE570 Assembly shows XOR instruction xor edx B6C696A8h in Stream UID: 00000000-00005180-15888-811-000A8E20 Assembly shows XOR instruction xor edx edi in Stream UID: 00000000-00005180-15888-811-000A8E20 Assembly shows XOR instruction xor edi 49h in Stream UID: 00000000-00005180-15888-811-000A8E20 Assembly shows XOR instruction xor cl byte ptr [edx+eax] in Stream UID: 00000000-00005180-15888-818-000A8AA0 Assembly shows XOR instruction xor ecx eax in Stream UID: 00000000-00005180-15888-818-000A8AA0 Assembly shows XOR instruction xor edx 7Fh in Stream UID: 00000000-00005180-15888-818-000A8AA0 Assembly shows XOR instruction xor eax ecx in Stream UID: 00000000-00005180-15888-818-000A8AA0 Assembly shows XOR instruction xor edx 000000CDh in Stream UID: 00000000-00005180-15888-818-000A8AA0 Assembly shows XOR instruction xor dl byte ptr [eax+ecx] in Stream UID: 00000000-00005180-15888-818-000A8AA0 Assembly shows XOR instruction xor edx 12h in Stream UID: 00000000-00005180-15888-818-000A8AA0 Assembly shows XOR instruction xor dl byte ptr [edi+ecx] in Stream UID: 00000000-00005180-15888-818-000A8AA0 Assembly shows XOR instruction xor dword ptr [ebx+0Ah] ebp in Stream UID: 00000000-00005180-15888-818-000A8AA0 Assembly shows XOR instruction xor ecx dword ptr [000D295Ch] in Stream UID: 00000000-00005180-15888-1022-0009CDA0 Assembly shows XOR instruction xor edx dword ptr [000D271Ch] in Stream UID: 00000000-00005180-15888-1039-0009C140 Assembly shows XOR instruction xor ecx dword ptr [000D2790h] in Stream UID: 00000000-00005180-15888-1040-0009C0D0 Assembly shows XOR instruction xor edx 000000ECh in Stream UID: 00000000-00005180-15888-1180-000A2670 Assembly shows XOR instruction xor ecx FFFFFFFFh in Stream UID: 00000000-00005180-15888-1180-000A2670 Assembly shows XOR instruction xor ecx 000000B8h in Stream UID: 00000000-00005180-15888-1180-000A2670 Assembly shows XOR instruction xor eax FFFFFFF1h in Stream UID: 00000000-00005180-15888-1180-000A2670 Assembly shows XOR instruction xor dl cl in Stream UID: 00000000-00005180-15888-1180-000A2670 Assembly shows XOR instruction xor al FFh in Stream UID: 00000000-00005180-15888-1180-000A2670 Assembly shows XOR instruction xor cl FFh in Stream UID: 00000000-00005180-15888-1180-000A2670 Assembly shows XOR instruction xor ecx edi in Stream UID: 00000000-00005180-15888-1180-000A2670 Assembly shows XOR instruction xor ecx 01h in Stream UID: 00000000-00005180-15888-1180-000A2670 Assembly shows XOR instruction xor ebx FFFFFFFFh in Stream UID: 00000000-00005180-15888-1180-000A2670 Assembly shows XOR instruction xor edi FFFFFFFFh in Stream UID: 00000000-00005180-15888-1180-000A2670 Assembly shows XOR instruction xor dh dl in Stream UID: 00000000-00005180-15888-1180-000A2670 Assembly shows XOR instruction xor edx 45B096F7h in Stream UID: 00000000-00005180-15888-1180-000A2670 Assembly shows XOR instruction xor edx 01h in Stream UID: 00000000-00005180-15888-1180-000A2670 Assembly shows XOR instruction xor edx edi in Stream UID: 00000000-00005180-15888-1180-000A2670 Assembly shows XOR instruction xor edx ebx in Stream UID: 00000000-00005180-15888-1180-000A2670 Assembly shows XOR instruction xor ecx 48h in Stream UID: 00000000-00005180-15888-1180-000A2670 Assembly shows XOR instruction xor edx 16h in Stream UID: 00000000-00005180-15888-1180-000A2670 Assembly shows XOR instruction xor edx FFFFFFFFh in Stream UID: 00000000-00005180-15888-1180-000A2670 Assembly shows XOR instruction xor ecx 02h in Stream UID: 00000000-00005180-15888-1180-000A2670 Assembly shows XOR instruction xor ecx FFFFFFFDh in Stream UID: 00000000-00005180-15888-1180-000A2670 Assembly shows XOR instruction xor ecx dword ptr [esp+00000254h] in Stream UID: 00000000-00005180-15888-1180-000A2670 Assembly shows XOR instruction xor ebx 02h in Stream UID: 00000000-00005180-15888-1180-000A2670 Assembly shows XOR instruction xor ecx D46F913Fh in Stream UID: 00000000-00005180-15888-1180-000A2670 Assembly shows XOR instruction xor edx ecx in Stream UID: 00000000-00005180-15888-1180-000A2670 Assembly shows XOR instruction xor eax FFFFFFFFh in Stream UID: 00000000-00005180-15888-1180-000A2670 Assembly shows XOR instruction xor eax 01h in Stream UID: 00000000-00005180-15888-1180-000A2670 Assembly shows XOR instruction xor ecx 7EEA5A87h in Stream UID: 00000000-00005180-15888-1180-000A2670 Assembly shows XOR instruction xor ebx 7EEA5A87h in Stream UID: 00000000-00005180-15888-1180-000A2670 Assembly shows XOR instruction xor ebx 8115A578h in Stream UID: 00000000-00005180-15888-1180-000A2670 Assembly shows XOR instruction xor ecx ebx in Stream UID: 00000000-00005180-15888-1180-000A2670 Assembly shows XOR instruction xor edi 65h in Stream UID: 00000000-00005180-15888-1180-000A2670 Assembly shows XOR instruction xor cl dl in Stream UID: 00000000-00005180-15888-1180-000A2670 Assembly shows XOR instruction xor ecx 4A5E7B80h in Stream UID: 00000000-00005180-15888-1180-000A2670 Assembly shows XOR instruction xor ecx edx in Stream UID: 00000000-00005180-15888-1180-000A2670 Assembly shows XOR instruction xor ebx 01h in Stream UID: 00000000-00005180-15888-1180-000A2670 Assembly shows XOR instruction xor eax 02h in Stream UID: 00000000-00005180-15888-1180-000A2670 Assembly shows XOR instruction xor ecx 15DBC453h in Stream UID: 00000000-00005180-15888-1180-000A2670 Assembly shows XOR instruction xor ecx 6A243BACh in Stream UID: 00000000-00005180-15888-1180-000A2670 Assembly shows XOR instruction xor edi edx in Stream UID: 00000000-00005180-15888-1180-000A2670 Assembly shows XOR instruction xor ecx AEDE229Fh in Stream UID: 00000000-00005180-15888-1180-000A2670 Assembly shows XOR instruction xor ebx 65h in Stream UID: 00000000-00005180-15888-1180-000A2670 Assembly shows XOR instruction xor ecx 65h in Stream UID: 00000000-00005180-15888-1180-000A2670 Assembly shows XOR instruction xor dl al in Stream UID: 00000000-00005180-15888-1180-000A2670 Assembly shows XOR instruction xor ebx 13h in Stream UID: 00000000-00005180-15888-1253-0009BFB8 Assembly shows XOR instruction xor bl byte ptr [esi+ecx-06B91167h] in Stream UID: 00000000-00005180-15888-1253-0009BFB8 Assembly shows XOR instruction xor ecx dword ptr [000D26C0h] in Stream UID: 00000000-00005180-15888-1253-0009BFB8 Assembly shows XOR instruction xor edx 71h in Stream UID: 00000000-00005180-15888-1341-0009F641 Assembly shows XOR instruction xor ebx 01h in Stream UID: 00000000-00005180-15888-1341-0009F641 Assembly shows XOR instruction xor eax 01h in Stream UID: 00000000-00005180-15888-1341-0009F641 Assembly shows XOR instruction xor ecx edx in Stream UID: 00000000-00005180-15888-1341-0009F641 Assembly shows XOR instruction xor ebx ecx in Stream UID: 00000000-00005180-15888-1341-0009F641 Assembly shows XOR instruction xor ecx 01h in Stream UID: 00000000-00005180-15888-1341-0009F641 Assembly shows XOR instruction xor edx FFFFFFFFh in Stream UID: 00000000-00005180-15888-1341-0009F641 Assembly shows XOR instruction xor ebx edx in Stream UID: 00000000-00005180-15888-1341-0009F641 Assembly shows XOR instruction xor ebx FFFFFFFFh in Stream UID: 00000000-00005180-15888-1341-0009F641 Assembly shows XOR instruction xor ebx 02h in Stream UID: 00000000-00005180-15888-1341-0009F641 Assembly shows XOR instruction xor al FFh in Stream UID: 00000000-00005180-15888-1341-0009F641 Assembly shows XOR instruction xor cl bl in Stream UID: 00000000-00005180-15888-1341-0009F641 Assembly shows XOR instruction xor eax FFFFFFFFh in Stream UID: 00000000-00005180-15888-1341-0009F641 Assembly shows XOR instruction xor ebx FFFFFFFDh in Stream UID: 00000000-00005180-15888-1341-0009F641 Assembly shows XOR instruction xor eax 000000FEh in Stream UID: 00000000-00005180-15888-1341-0009F641 Assembly shows XOR instruction xor ebx 000000B7h in Stream UID: 00000000-00005180-15888-1341-0009F641 Assembly shows XOR instruction xor ecx 15BB793Ah in Stream UID: 00000000-00005180-15888-1341-0009F641 Assembly shows XOR instruction xor cl dl in Stream UID: 00000000-00005180-15888-1341-0009F641 Assembly shows XOR instruction xor cl 21h in Stream UID: 00000000-00005180-15888-1341-0009F641 Assembly shows XOR instruction xor ecx FFFFFFFFh in Stream UID: 00000000-00005180-15888-1341-0009F641 Assembly shows XOR instruction xor ecx 3Fh in Stream UID: 00000000-00005180-15888-1341-0009F641 Assembly shows XOR instruction xor cl F3h in Stream UID: 00000000-00005180-15888-1341-0009F641 Assembly shows XOR instruction xor edx 000000D0h in Stream UID: 00000000-00005180-15888-1341-0009F641 Assembly shows XOR instruction xor eax 000000D0h in Stream UID: 00000000-00005180-15888-1341-0009F641 Assembly shows XOR instruction xor eax 2Fh in Stream UID: 00000000-00005180-15888-1341-0009F641 Assembly shows XOR instruction xor edi 2Fh in Stream UID: 00000000-00005180-15888-1341-0009F641 Assembly shows XOR instruction xor ebx 000000D0h in Stream UID: 00000000-00005180-15888-1341-0009F641 Assembly shows XOR instruction xor ebx 2Fh in Stream UID: 00000000-00005180-15888-1341-0009F641 Assembly shows XOR instruction xor ecx FFFFFFFFh in Stream UID: 00000000-00005180-15888-1354-000A1163 Assembly shows XOR instruction xor edi FFFFFFFFh in Stream UID: 00000000-00005180-15888-1354-000A1163 Assembly shows XOR instruction xor eax FFFFFFFFh in Stream UID: 00000000-00005180-15888-1354-000A1163 Assembly shows XOR instruction xor ecx 01h in Stream UID: 00000000-00005180-15888-1354-000A1163 Assembly shows XOR instruction xor ecx 0000009Ch in Stream UID: 00000000-00005180-15888-1354-000A1163 Assembly shows XOR instruction xor cl dl in Stream UID: 00000000-00005180-15888-1354-000A1163 Assembly shows XOR instruction xor eax 01h in Stream UID: 00000000-00005180-15888-1354-000A1163 Assembly shows XOR instruction xor ebx 02h in Stream UID: 00000000-00005180-15888-1354-000A1163 Assembly shows XOR instruction xor edi 967DEF0Fh in Stream UID: 00000000-00005180-15888-1354-000A1163 Assembly shows XOR instruction xor ecx edx in Stream UID: 00000000-00005180-15888-1354-000A1163 Assembly shows XOR instruction xor ecx B3EF7879h in Stream UID: 00000000-00005180-15888-1354-000A1163 Assembly shows XOR instruction xor edx 01h in Stream UID: 00000000-00005180-15888-1354-000A1163 Assembly shows XOR instruction xor eax 03h in Stream UID: 00000000-00005180-15888-1354-000A1163 Assembly shows XOR instruction xor dl cl in Stream UID: 00000000-00005180-15888-1354-000A1163 Assembly shows XOR instruction xor eax 1B16274Bh in Stream UID: 00000000-00005180-15888-1354-000A1163 Assembly shows XOR instruction xor edx E850AEFEh in Stream UID: 00000000-00005180-15888-1354-000A1163 Assembly shows XOR instruction xor ebx 01h in Stream UID: 00000000-00005180-15888-1354-000A1163 Assembly shows XOR instruction xor edi 000000F5h in Stream UID: 00000000-00005180-15888-1361-000A1C4A Assembly shows XOR instruction xor dl al in Stream UID: 00000000-00005180-15888-1361-000A1C4A Assembly shows XOR instruction xor ecx 6956278Fh in Stream UID: 00000000-00005180-15888-1361-000A1C4A Assembly shows XOR instruction xor edx 01h in Stream UID: 00000000-00005180-15888-1361-000A1C4A Assembly shows XOR instruction xor edi AB900427h in Stream UID: 00000000-00005180-15888-1361-000A1C4A Assembly shows XOR instruction xor ebx 02h in Stream UID: 00000000-00005180-15888-1361-000A1C4A Assembly shows XOR instruction xor ch cl in Stream UID: 00000000-00005180-15888-1361-000A1C4A Assembly shows XOR instruction xor edx FFFFFFFFh in Stream UID: 00000000-00005180-15888-1361-000A1C4A Assembly shows XOR instruction xor ecx FFFFFFFDh in Stream UID: 00000000-00005180-15888-1800-000C1BB1 Assembly shows XOR instruction xor bh bl in Stream UID: 00000000-00005180-15888-1806-000C2992 Assembly shows XOR instruction xor bh 80h in Stream UID: 00000000-00005180-15888-1806-000C2992 Assembly shows XOR instruction xor ecx 242A43D5h in Stream UID: 00000000-00005180-15888-2149-000C082D Assembly shows XOR instruction xor ecx B748D4B0h in Stream UID: 00000000-00005180-15888-2149-000C082D31:T2e48,Found XOR loop in file "sample.bin" at offset 26264; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 28426; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 64398; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 108254; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 118178; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 129050; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 215674; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 302161; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 347641; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 380687; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 415301; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 469568; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 487283; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 542451; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 580116; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 626060; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 655872; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 689655; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 695165; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 888535; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 976720; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1055556; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1080763; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1168611; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1210176; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1239917; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1272622; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1320955; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1357385; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1366200; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1371462; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1385192; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1406618; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1429437; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1440385; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1503391; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1517127; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1541981; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1559603; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1587335; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1594184; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1602785; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1617004; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1646393; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1657417; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1677413; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1679050; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1687923; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1696843; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1729076; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1734936; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1735793; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 13516; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 40406; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 113581; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 181564; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 290337; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 371690; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 457570; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 458089; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 462060; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 462186; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 534113; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 555198; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 588056; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 730257; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 908172; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1051218; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1066678; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1079170; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1089892; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1110297; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1389696; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1551100; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1645535; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1755864; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1827288; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 23236; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 46287; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 115702; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 160569; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 268409; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 403522; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 429256; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 451114; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 458491; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 490120; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 505858; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 644852; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 706141; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 800806; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 823250; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 847344; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 877991; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 977974; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 983561; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 984672; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 998933; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1005359; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1006053; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1030235; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1070690; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1088664; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1089257; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1107221; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1113148; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1115524; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1127798; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1136769; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1137398; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1145751; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1202615; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1246148; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1250041; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1309701; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1311542; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1315834; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1359696; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1361037; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1364650; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1380123; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1381108; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1389373; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1403875; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1432966; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1485692; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1497274; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1512704; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1532290; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1539834; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1544337; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1545310; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1546921; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1549747; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1553186; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1562032; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1567209; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1574950; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1596408; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1616610; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1617760; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1625015; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1638903; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1645105; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1654901; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1661381; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1667182; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1676803; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1680612; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1695670; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1699464; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1702498; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1705039; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1710584; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1727096; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1727887; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1729031; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1745912; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1754894; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1789013; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1814653; code bytes = 803032:T865,"07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\2E4916B07F3DE90C8DDE2566FD9B9B400D89BBBA"; Key: "BLOB") "07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB") "07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\E6A3B45B062D509B3382282D196EFE97D5956CCB"; Key: "BLOB") "07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\F5AD0BCC1AD56CD150725B1C866C30AD92EF21B0"; Key: "BLOB") "07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB")33:T503,"07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe" searching for class "OLLYDBG" "07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe" searching for class "GBDYLLO" "07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe" searching for class "pediy06" "07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe" searching for class "FilemonClass" "07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe" searching for window "File Monitor - Sysinternals: www.sysinternals.com" "07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe" searching for class "PROCMON_WINDOW_CLASS" "07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe" searching for window "Process Monitor - Sysinternals: www.sysinternals.com" "07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe" searching for class "RegmonClass" "07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe" searching for window "Registry Monitor - Sysinternals: www.sysinternals.com" "07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe" searching for class "18467-41" "07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe" searching for class "Regmonclass"34:Ta5f,"07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe" called "WinHttpSendRequest" with parameters {"hRequest": "943e68" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "act=life" "dwOptionalLength": "8" "dwTotalLength": "8" "dwContext": "0" "$error": "2ee7"} "07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe" called "WinHttpSendRequest" with parameters {"hRequest": "949788" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "act=life" "dwOptionalLength": "8" "dwTotalLength": "8" "dwContext": "0" "$error": "2f8f"} "07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe" called "WinHttpSendRequest" with parameters {"hRequest": "953e38" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "act=life" "dwOptionalLength": "8" "dwTotalLength": "8" "dwContext": "0" "$error": "2f8f"} "07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe" called "WinHttpSendRequest" with parameters {"hRequest": "94ee48" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "act=life" "dwOptionalLength": "8" "dwTotalLength": "8" "dwContext": "0" "$error": "2f8f"} "07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe" called "WinHttpSendRequest" with parameters {"hRequest": "940bb0" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "act=life" "dwOptionalLength": "8" "dwTotalLength": "8" "dwContext": "0" "$error": "2f8f"} "07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe" called "WinHttpSendRequest" with parameters {"hRequest": "940ce8" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "act=life" "dwOptionalLength": "8" "dwTotalLength": "8" "dwContext": "0" "$error": "2f8f"} "07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe" called "WinHttpSendRequest" with parameters {"hRequest": "940ce8" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe" called "WinHttpSendRequest" with parameters {"hRequest": "940bb0" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "act=life" "dwOptionalLength": "8" "dwTotalLength": "8" "dwContext": "0" "$error": "2ee7"}35:T6c50,Found URL "https://atten-supporse.biz/apiatten-supporse.biztten-supporse.bizilemonclass0610063006b0020000000000000000000000000000000000000000000000000000000000000:00000000000000010000000000000004000000000000000+000000000000000.000000000000000%000000000000000x000000000000000r000000000000000i000000000000000l000000000000000c000000000000000f000000000000000" - Source: "00000000-00005180.00000000.137710.008C0000.00000004.mdmp") Found URL "https://atten-supporse.biz/api!" - Source: "00000000-00005180.00000000.137710.008C0000.00000004.mdmp") Found URL "https://76561199724331900/apisteamcommunity.comsteamcommunity.comhttps://steamcommunity.com/profiles/76561199724331900system" - Source: "00000000-00005180.00000001.138288.008C0000.00000004.mdmp") Found URL "https://covery-mover.biz/apimsiscanbuffermsiscanbuslfreeobjectatten-supporse.biz.bizcalrpccalrpcross-certificate" - Source: "00000000-00005180.00000001.138288.008C0000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1english1sea" - Source: "00000000-00005180.00000001.138288.008C0000.00000004.mdmp") Found URL "https://secure.comodo.com/cps0" - Source: "00000000-00005180.00000001.138288.008C0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0tdefaultt2.5.4.3t2.5.4.4t2.5.4.5t2.5.4.6t2.5.4.7t2.5.4.8t2.5.4.9n30'cryptsp.dllapioapiogotiategoextenderrberoshannelcryptsipdllgetsigneddatamsgcryptsipdllremovesigneddatamsgcryptsipdllcreateindirectdatacryptsipdllverifyindirectdatacryptsipdllismyfiletype2cryptdllexportpublickeyinfoexcryptdllimportpublickeyinfoexcryptdllencodepublickeyandparameterscryptdllconvertpublickeyinfot1.3.14.3.2.12t1.3.14.3.2.22t1.3.14.3.2.12t2.5.4.10t2.5.4.11t2.5.4.12t2.5.4.13t2.5.4.14t2.5.4.15t2.5.4.16t2.5.4.17t2.5.4.18t2.5.4.19t2.5.4.20t2.5.4.21t2.5.4.22t2.5.4.23t2.5.4.24t2.5.4.25t2.5.4.26t2.5.4.27tl" - Source: "00000000-00005180.00000001.138288.008C0000.00000004.mdmp") Found URL "https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=oimk9sdo4iqn&l=english&_cdn=akamai" - Source: "00000000-00005180.00000001.138288.008C0000.00000004.mdmp") Found URL "https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=6inmyk2ncgk7&l=english&_cdn=akamai" - Source: "00000000-00005180.00000001.138288.008C0000.00000004.mdmp") Found URL "https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries" - Source: "00000000-00005180.00000001.138288.008C0000.00000004.mdmp") Found URL "https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=ycibdwvvdr3r&l=english&_cdn=akamai" - Source: "00000000-00005180.00000001.138288.008C0000.00000004.mdmp") Found URL "https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg" - Source: "00000000-00005180.00000001.138288.008C0000.00000004.mdmp") Found URL "https://community.akamai.steamstatic.com/public/images/skin_1/arrowdn9x5.gif" - Source: "00000000-00005180.00000001.138288.008C0000.00000004.mdmp") Found URL "http://www.digicert.com/cps0n0l04.http://crl3.digicert.com/digicertevrsacag2.crl04.http://crl4.digicert.com/digicertevrsacag2.crl0sg0e0$http://ocsp.digicert.com0=1http://cacerts.digicert.com/digicertevrsacag2.crt0c>o21" - Source: "00000000-00005180.00000001.138288.008C0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0" - Source: "00000000-00005180.00000001.138288.008C0000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicertglobalrootg2.crl07t0r071http://crl3.digicert.com/digicertglobalrootg2.crl07apio_kkt:cylkt?cgmkt0cnkt5cokt6cokt+cokt,cbpkt!cer-agentnnp'cntent-typeep-aliveapioapiodecddecd=ym'quj->d'q>" - Source: "00000000-00005180.00000001.138288.008C0000.00000004.mdmp") Found URL "https://broadcast.st.dl.eccded.nttp://127.0.0.1:0" - Source: "00000000-00005180.00000001.138288.008C0000.00000004.mdmp") Found URL "http://checksteaered" - Source: "00000000-00005180.00000001.138288.008C0000.00000004.mdmp") Found URL "https://skcom" - Source: "00000000-00005180.00000001.138288.008C0000.00000004.mdmp") Found URL "https://www.google.com/recaptcha/" - Source: "00000000-00005180.00000001.138288.008C0000.00000004.mdmp") Found URL "https://recaptcha.net/recaptcha/;" - Source: "00000000-00005180.00000001.138288.008C0000.00000004.mdmp") Found URL "https://steamloopback.host" - Source: "00000000-00005180.00000001.138288.008C0000.00000004.mdmp") Found URL "https://store.steampowered.com/;x-frame-optionssameoriginpersistent-authwww-authenticatevarysteamcountry=us%7cdd89e304c87f19ea401ddd7cfd7158f5;" - Source: "00000000-00005180.00000001.138288.008C0000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicertglobalrootg2.crl071http://crl4.digicert.com/digicertglobalrootg2.crl0https://www.digicert.com/cps0" - Source: "00000000-00005180.00000001.138288.008C0000.00000004.mdmp") Found URL "https://www.digicert.com/rpa-ua0d;/fm7oygnaxpm3w%ta" - Source: "00000000-00005180.00000001.138288.008C0000.00000004.mdmp") Found URL "https://www.digicert.com/rpa-ua0d;/fm7oygnaxahsm[" - Source: "00000000-00005180.00000001.138288.008C0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00005180.00000001.138288.008C0000.00000004.mdmp") Found URL "http://g.symcd.com0e0c0a60301%http://www.geotrust.com/resources/cps06/0-0+%http://g.symcb.com/geotrustpca-g3.crl0symantecpki-1-697033ti^l" - Source: "00000000-00005180.00000001.138288.008C0000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00005180.00000001.138288.008C0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czc0?1$0" - Source: "00000000-00005180.00000001.138288.008C0000.00000004.mdmp") Found URL "http://isrg.trustid.ocsp.identrust.com0;/http://apps.identrust.com/roots/dstrootcax3.p7c0m0k0000." - Source: "00000000-00005180.00000001.138288.008C0000.00000004.mdmp") Found URL "http://cps.root-x1.letsencrypt.org0<50301+http://crl.identrust.com/dstrootcax3crl.crl0ig'" - Source: "00000000-00005180.00000001.138288.008C0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00005180.00000001.138288.008C0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0internet1verisign," - Source: "00000000-00005180.00000001.138288.008C0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com05addons.mozilla.orgwww.addons.mozilla.org0zsb)j9e/p1<92a@ef" - Source: "00000000-00005180.00000001.138288.008C0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0%www.google.comgoogle.com0io]l,e9no8wz!h.$j>qq10p1+0)" - Source: "00000000-00005180.00000001.138288.008C0000.00000004.mdmp") Found URL "http://www.public-trust.com/cps/omniroot.html0w0u1gte" - Source: "00000000-00005180.00000001.138288.008C0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0dmxt*j]+xijom5o" - Source: "00000000-00005180.00000001.138288.008C0000.00000004.mdmp") Found URL "http://ocsp.entrust.net03,0*0(" - Source: "00000000-00005180.00000001.138288.008C0000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.11c)d[b" - Source: "00000000-00005180.00000001.138288.008C0000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0w0u1staat" - Source: "00000000-00005180.00000001.138288.008C0000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl0]ko)tsz'ek" - Source: "00000000-00005180.00000001.138288.008C0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.skype.comwww.login.skype.com0" - Source: "00000000-00005180.00000001.138288.008C0000.00000004.mdmp") Found URL "http://cybertrust.omniroot.com/repository.cfm0w0u1gte" - Source: "00000000-00005180.00000001.138288.008C0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0j)z" - Source: "00000000-00005180.00000001.138288.008C0000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1tampa1sea" - Source: "00000000-00005180.00000001.138288.008C0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0global" - Source: "00000000-00005180.00000001.138288.008C0000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0\0z1staat" - Source: "00000000-00005180.00000001.138288.008C0000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domorganisatielatestcrl-g2.crl0^tl*" - Source: "00000000-00005180.00000001.138288.008C0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.yahoo.comwww.login.yahoo.com0yvr,0ab^9ckxentrust.net1;092www.entrust.net/cps" - Source: "00000000-00005180.00000001.138288.008C0000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.1q7z?,o2;n)wp+(the" - Source: "00000000-00005180.00000001.138288.008C0000.00000004.mdmp") Found URL "https://www.verisign.com/repository/cpsthis" - Source: "00000000-00005180.00000001.138288.008C0000.00000004.mdmp") Found URL "https://www.verisign.com;" - Source: "00000000-00005180.00000001.138288.008C0000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0salt" - Source: "00000000-00005180.00000001.138288.008C0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/mail.google.comwww.mail.google.com0?=*k!\yro2;n%2+joki0!!salt" - Source: "00000000-00005180.00000001.138288.008C0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0kw(=n" - Source: "00000000-00005180.00000001.138288.008C0000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0f$\_)$bf!gte" - Source: "00000000-00005180.00000001.138288.008C0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0\0" - Source: "00000000-00005180.00000001.138288.008C0000.00000004.mdmp") Found URL "http://ocsp.entrust.net0d=0;09000." - Source: "00000000-00005180.00000001.138288.008C0000.00000004.mdmp") Found URL "http://www.digicert.com.my/cps.htm02+0)0'!http://crl.entrust.net/2048ca.crl09yk3y!;8kbgte" - Source: "00000000-00005180.00000001.138288.008C0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0or" - Source: "00000000-00005180.00000001.138288.008C0000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl00ev" - Source: "00000000-00005180.00000001.138288.008C0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0salt" - Source: "00000000-00005180.00000001.138288.008C0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0-login.live.comwww.login.live.com0nwk1uy1un:4o0-%i1oc*9" - Source: "00000000-00005180.00000001.138288.008C0000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0v7.1ctj7+>.entrus.x^ygeotrust" - Source: "00000000-00005180.00000001.138288.008C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0>ej-+\lu>gvpob\hzagxr" - Source: "00000000-00005180.00000001.138288.008C0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?r0m01.3.6.1.5.5.7.1.12okb&]>-xgj2.16.840.1.113730.1.13xx4bx'ect" - Source: "00000000-00005180.00000001.138288.008C0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnk't" - Source: "00000000-00005180.00000001.138288.008C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00005180.00000001.138288.03BB0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005180.00000001.138288.03BB0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lquuub6tqoft" - Source: "00000000-00005180.00000001.138288.03BB0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l9v=\" - Source: "00000000-00005180.00000001.138288.03BB0000.00000004.mdmp") Found URL "https://community.akamai.steamstatic.com/" - Source: "00000000-00005180.00000001.138288.03BB0000.00000004.mdmp") Found URL "https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/" - Source: "00000000-00005180.00000001.138288.03BB0000.00000004.mdmp") Found URL "https://api.steampowered.com/" - Source: "00000000-00005180.00000001.138288.03BB0000.00000004.mdmp") Found URL "https://recaptcha.net" - Source: "00000000-00005180.00000001.138288.03BB0000.00000004.mdmp") Found URL "https://www.google.com/recaptcha/" - Source: "00000000-00005180.00000001.138288.03BB0000.00000004.mdmp") Found URL "https://www.gstatic.cn/recaptcha/" - Source: "00000000-00005180.00000001.138288.03BB0000.00000004.mdmp") Found URL "https://www.gstatic.com/recaptcha/" - Source: "00000000-00005180.00000001.138288.03BB0000.00000004.mdmp") Found URL "https://www.youtube.com/" - Source: "00000000-00005180.00000001.138288.03BB0000.00000004.mdmp") Found URL "https://s.ytimg.com;" - Source: "00000000-00005180.00000001.138288.03BB0000.00000004.mdmp") Found URL "https://store.steampowered.com/" - Source: "00000000-00005180.00000001.138288.03BB0000.00000004.mdmp") Found URL "https://checkout.steampowered.com/" - Source: "00000000-00005180.00000001.138288.03BB0000.00000004.mdmp") Found URL "https://login.steampowered.com/" - Source: "00000000-00005180.00000001.138288.03BB0000.00000004.mdmp") Found URL "https://help.steampowered.com/" - Source: "00000000-00005180.00000001.138288.03BB0000.00000004.mdmp") Found URL "https://steam.tv/" - Source: "00000000-00005180.00000001.138288.03BB0000.00000004.mdmp") Found URL "https://steamcommunity.com/" - Source: "00000000-00005180.00000001.138288.03BB0000.00000004.mdmp") Found URL "https://*.valvesoftware.com" - Source: "00000000-00005180.00000001.138288.03BB0000.00000004.mdmp") Found URL "https://*.steambeta.net" - Source: "00000000-00005180.00000001.138288.03BB0000.00000004.mdmp") Found URL "https://*.discovery.beta.steamserver.net" - Source: "00000000-00005180.00000001.138288.03BB0000.00000004.mdmp") Found URL "https://*.steamcontent.com" - Source: "00000000-00005180.00000001.138288.03BB0000.00000004.mdmp") Found URL "https://steambroadcast.akamaized.net" - Source: "00000000-00005180.00000001.138288.03BB0000.00000004.mdmp") Found URL "https://steambroadcast-test.akamaized.net" - Source: "00000000-00005180.00000001.138288.03BB0000.00000004.mdmp") Found URL "https://broadcast.st.dl.eccdnx.com" - Source: "00000000-00005180.00000001.138288.03BB0000.00000004.mdmp") Found URL "https://lv.queniujq.cn" - Source: "00000000-00005180.00000001.138288.03BB0000.00000004.mdmp") Found URL "https://steambroadcastchat.akamaized.net" - Source: "00000000-00005180.00000001.138288.03BB0000.00000004.mdmp") Found URL "http://127.0.0.1:27060" - Source: "00000000-00005180.00000001.138288.03BB0000.00000004.mdmp") Found URL "https://www.youtube.com" - Source: "00000000-00005180.00000001.138288.03BB0000.00000004.mdmp") Found URL "https://www.youtube-nocookie.com" - Source: "00000000-00005180.00000001.138288.03BB0000.00000004.mdmp") Found URL "https://www.google.com" - Source: "00000000-00005180.00000001.138288.03BB0000.00000004.mdmp") Found URL "https://sketchfab.com" - Source: "00000000-00005180.00000001.138288.03BB0000.00000004.mdmp") Found URL "https://player.vimeo.com" - Source: "00000000-00005180.00000001.138288.03BB0000.00000004.mdmp") Found URL "https://medal.tv" - Source: "00000000-00005180.00000001.138288.03BB0000.00000004.mdmp") Found URL "https://recaptcha.net/recaptcha/;" - Source: "00000000-00005180.00000001.138288.03BB0000.00000004.mdmp") Found URL "https://steamloopback.host" - Source: "00000000-00005180.00000001.138288.03BB0000.00000004.mdmp") Found URL "https://store.steampowered.com/;expires:" - Source: "00000000-00005180.00000001.138288.03BB0000.00000004.mdmp") Found URL "https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=g517uopauy8x&l=english&_cdn=akamai" - Source: "00000000-00005180.00000001.138288.03BB0000.00000004.mdmp") Found URL "https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=wgcgw2rjiiq0&l=english&_cdn=akamai" - Source: "00000000-00005180.00000001.138288.03BB0000.00000004.mdmp") Found URL "https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=5fbr3ly2nkik&l=english&_cdn=akamai" - Source: "00000000-00005180.00000001.138288.03BB0000.00000004.mdmp") Found URL "https://community.akamai.steamstatic.com/public/css/globalv2.css?v=driomtao1-6b&l=english&_cdn=akamai" - Source: "00000000-00005180.00000001.138288.03BB0000.00000004.mdmp") Found URL "https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=ofpptuz_etfk&l=english&_cdn=akamai" - Source: "00000000-00005180.00000001.138288.03BB0000.00000004.mdmp") Found URL "https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=iwtbnfm6geks&l=english&_cdn=akamai" - Source: "00000000-00005180.00000001.138288.03BB0000.00000004.mdmp") Found URL "https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=cmt0gkdqa1ot&l=english&_cdn=akamai" - Source: "00000000-00005180.00000001.138288.03BB0000.00000004.mdmp") Found URL "https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=npjelbnreo6w&l=english&_cdn=akamai" - Source: "00000000-00005180.00000001.138288.03BB0000.00000004.mdmp") Found URL "https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdakocdigbc&l=english&_cdn=akamai&load=effects,controls,slider,dragdrop" - Source: "00000000-00005180.00000001.138288.03BB0000.00000004.mdmp") Found URL "https://community.akamai.steamstatic.com/public/javascript/global.js?v=uixvhtqqsfxt&l=english&_cdn=akamai" - Source: "00000000-00005180.00000001.138288.03BB0000.00000004.mdmp") Found URL "https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=gqhvlrk4-jx-&l=english&_cdn=akamai" - Source: "00000000-00005180.00000001.138288.03BB0000.00000004.mdmp") Found URL "https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=a9q1reojmdbo&l=english&_cdn=akamai" - Source: "00000000-00005180.00000001.138288.03BB0000.00000004.mdmp") Found URL "https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=abyllorgn4b_&l=english&_cdn=akamai" - Source: "00000000-00005180.00000001.138288.03BB0000.00000004.mdmp") Found URL "https://community.akamai.steamstatic.com/public/shared/javascript/auth_refresh.js?v=w6qbwi-5-j2s&l=english&_cdn=akamai" - Source: "00000000-00005180.00000001.138288.03BB0000.00000004.mdmp") Found URL "https://community.akamai.steamstatic.com/public/javascript/modalcontent.js?v=ebc6wsfpyw7y&l=english&_cdn=akamai" - Source: "00000000-00005180.00000001.138288.03BB0000.00000004.mdmp") Found URL "https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=zbxeuexvq0fz&l=english&_cdn=akamai" - Source: "00000000-00005180.00000001.138288.03BB0000.00000004.mdmp") Found URL "https://community.akamai.steamstatic.com/public/javascript/profile.js?v=mi3ojmipybxa&l=english&_cdn=akamai" - Source: "00000000-00005180.00000001.138288.03BB0000.00000004.mdmp") Found URL "https://community.akamai.steamstatic.com/public/javascript/reportedcontent.js?v=qnay-krx3moe&l=english&_cdn=akamai" - Source: "00000000-00005180.00000001.138288.03BB0000.00000004.mdmp") Found URL "https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=asnznxt9kvqn&l=english&_cdn=akamai" - Source: "00000000-00005180.00000001.138288.03BB0000.00000004.mdmp") Found URL "https://community.akamai.steamstatic.com/public/shared/images/responsive/steam_share_image.jpg" - Source: "00000000-00005180.00000001.138288.03BB0000.00000004.mdmp") Found URL "https://steamcommunity.com/login/home/?goto=profiles%2f76561199724331900" - Source: "00000000-00005180.00000001.138288.03BB0000.00000004.mdmp") Found URL "https://store.steampowered.com/explore/" - Source: "00000000-00005180.00000001.138288.03BB0000.00000004.mdmp") Found URL "https://store.steampowered.com/wishlist/" - Source: "00000000-00005180.00000001.138288.03BB0000.00000004.mdmp") Found URL "https://store.steampowered.com/points/shop/" - Source: "00000000-00005180.00000001.138288.03BB0000.00000004.mdmp") Found URL "https://store.steampowered.com/news/" - Source: "00000000-00005180.00000001.138288.03BB0000.00000004.mdmp") Found URL "https://store.steampowered.com/stats/" - Source: "00000000-00005180.00000001.138288.03BB0000.00000004.mdmp") Found URL "https://steamcommunity.com/discussions/" - Source: "00000000-00005180.00000001.138288.03BB0000.00000004.mdmp") Found URL "https://steamcommunity.com/workshop/" - Source: "00000000-00005180.00000001.138288.03BB0000.00000004.mdmp") Found URL "https://steamcommunity.com/market/" - Source: "00000000-00005180.00000001.138288.03BB0000.00000004.mdmp") Found URL "https://steamcommunity.com/?subsection=broadcasts" - Source: "00000000-00005180.00000001.138288.03BB0000.00000004.mdmp") Found URL "https://store.steampowered.com/about/" - Source: "00000000-00005180.00000001.138288.03BB0000.00000004.mdmp") Found URL "https://help.steampowered.com/en/" - Source: "00000000-00005180.00000001.138288.03BB0000.00000004.mdmp") Found URL "https://store.steampowered.com/mobile" - Source: "00000000-00005180.00000001.138288.03BB0000.00000004.mdmp") Found URL "https://community.akamai.steamstatic.com/public/shared/images/responsive/footerlogo_valve_new.png" - Source: "00000000-00005180.00000001.138288.03BB0000.00000004.mdmp") Found URL "https://store.steampowered.com/privacy_agreement/" - Source: "00000000-00005180.00000001.138288.03BB0000.00000004.mdmp") Found URL "http://www.valvesoftware.com/legal.htm" - Source: "00000000-00005180.00000001.138288.03BB0000.00000004.mdmp") Found URL "https://help.steampowered.com/faqs/view/10bb-d27a-6378-4436" - Source: "00000000-00005180.00000001.138288.03BB0000.00000004.mdmp") Found URL "https://store.steampowered.com/subscriber_agreement/" - Source: "00000000-00005180.00000001.138288.03BB0000.00000004.mdmp") Found URL "https://store.steampowered.com/steam_refunds/" - Source: "00000000-00005180.00000001.138288.03BB0000.00000004.mdmp") Found URL "https://store.steampowered.com/account/cookiepreferences/" - Source: "00000000-00005180.00000001.138288.03BB0000.00000004.mdmp") Found URL "https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png" - Source: "00000000-00005180.00000001.138288.03BB0000.00000004.mdmp") Found URL "https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png" - Source: "00000000-00005180.00000001.138288.03BB0000.00000004.mdmp") Found URL "https://community.akamai.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016" - Source: "00000000-00005180.00000001.138288.03BB0000.00000004.mdmp") Found URL "https://www.valvesoftware.com/contact?contact-person=translation%20team%20feedback" - Source: "00000000-00005180.00000001.138288.03BB0000.00000004.mdmp") Found URL "https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=oimk9sdo4iqn&l=english&_cdn=akamai" - Source: "00000000-00005180.00000001.138288.03BB0000.00000004.mdmp") Found URL "https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=6inmyk2ncgk7&l=english&_cdn=akamai" - Source: "00000000-00005180.00000001.138288.03BB0000.00000004.mdmp") Found URL "https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries" - Source: "00000000-00005180.00000001.138288.03BB0000.00000004.mdmp") Found URL "https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=ycibdwvvdr3r&l=english&_cdn=akamai" - Source: "00000000-00005180.00000001.138288.03BB0000.00000004.mdmp") Found URL "https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg" - Source: "00000000-00005180.00000001.138288.03BB0000.00000004.mdmp") Found URL "https://community.akamai.steamstatic.com/public/images/skin_1/arrowdn9x5.gif" - Source: "00000000-00005180.00000001.138288.03BB0000.00000004.mdmp")36:Td03,"07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGLEVEL"; Value: "") "07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGMATCHANYMASK"; Value: "") "07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DEBUGHEAPFLAGS"; Value: "") "07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "")37:T10a7,"07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES") "07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS") "07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS") "07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE")1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790331490794,"unified_at":"2026-09-25T10:18:10.794Z","metadata":{"hashes":{"sha256":"07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac","sha1":"b16422716ca83c131c1cbd6c6fd4c1a8fdfa800b","md5":"28cd41e552164efdf6eaf4c5f00b7821","sha512":"91074cddf0b9411579d07c46058e6429b92cb3cd97932b0f5036f0f8f6b8b2ad4b609bd2caa3c5aaee7f5d1b88b051c9efc8bd3c97b132002ea8f9f11edb1178","ssdeep":"49152:qeNCyvXugD9/YgWCKtIhmNUemaJAbO+dB:qe/+gDWgWZSa6","ssdeep_chunks":["49152:qeNCyvX","49152:eNCyvXu","49152:NCyvXug","49152:CyvXugD","49152:yvXugD9","49152:vXugD9/","49152:XugD9/Y","49152:ugD9/Yg","49152:gD9/YgW","49152:D9/YgWC","49152:9/YgWCK","49152:/YgWCKt","49152:YgWCKtI","49152:gWCKtIh","49152:WCKtIhm","49152:CKtIhmN","49152:KtIhmNU","49152:tIhmNUe","49152:IhmNUem","49152:hmNUema","49152:mNUemaJ","49152:NUemaJA","49152:UemaJAb","49152:emaJAbO","49152:maJAbO+","49152:aJAbO+d","49152:JAbO+dB","98304:qeNCyvX","98304:eNCyvXu","98304:NCyvXug","98304:CyvXugD","98304:yvXugD9","98304:vXugD9/","98304:XugD9/Y","98304:ugD9/Yg","98304:gD9/YgW","98304:D9/YgWC","98304:9/YgWCK","98304:/YgWCKt","98304:YgWCKtI","98304:gWCKtIh","98304:WCKtIhm","98304:CKtIhmN","98304:KtIhmNU","98304:tIhmNUe","98304:IhmNUem","98304:hmNUema","98304:mNUemaJ","98304:NUemaJA","98304:UemaJAb","98304:emaJAbO","98304:maJAbO+","98304:aJAbO+d","98304:JAbO+dB","49152:qe/+gDW","49152:e/+gDWg","49152:/+gDWgW","49152:+gDWgWZ","49152:gDWgWZS","49152:DWgWZSa","49152:WgWZSa6"],"imphash":"2eabe9054cad5152567f0699947a2c5b"},"file_info":{"file_name":"file","file_type":["peexe","executable"],"file_type_id":"exe","file_size":1839104,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1733824694000,"last_seen":1786346324000,"last_multi_scan":1786346324000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["evasive","credentialharvesting","commodity","lummastealer","criminal","informationstealer","malicious"]},"stats":{"av":{"malicious_count":15,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":51},"sandbox_signatures":{"informative_count":99,"suspicious_count":15,"malicious_count":5,"total":119},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Spy]/Win32.Convagent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Crypt.XPACK.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Ransom.Gunra.28","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Ransom.Gunra.28 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Packed.Themida.HZB trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Trojan.Heur!.038120A1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"HEUR:TrojanSpy/Stealer.ay","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Riskware ( 005cdebc1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"high_entropy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Themida.CX.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Genus.XJL","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Phpw.Win32.9018","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Ransom.Gunra.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"}],"sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"},{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"},{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"},{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"},{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Contains ability to empty the recycle bin (API string)"},{"type":"informative","value":"Able to permanently delete files from the Recycle Bin"}],"sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"},{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Able to utilize the Windows bcrypt cryptographic API"},{"type":"suspicious","value":"Entrypoint in PE header is within an uncommon section"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"}],"sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"},{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"suspicious","value":"Tries to detect debugger using ProcessDebugPort"},{"type":"suspicious","value":"Sets the 'ThreadHideFromDebugger' thread data structure"}],"sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"},{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"The input sample contains the RDTSCP instruction"},{"type":"suspicious","value":"Contains ability to detect virtual environment"},{"type":"informative","value":"The input sample possibly contains the RDTSCP instruction"}],"sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"},{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"section contains high entropy"},{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"},{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"},{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"},{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"},{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"malicious","value":"Reads the system/video BIOS version"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Read system defined device setup information from registry"},{"type":"informative","value":"Contains ability to retrieve information about operating system (API string)"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads system-defined device setup information from registry"},{"type":"informative","value":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"},{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"}],"sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"},{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"},{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"suspicious","value":"Queries process information"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes"},{"type":"suspicious","value":"Calls an API typically used to enumerate process encountered in a system snapshot"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"}],"sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"},{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Scanning for window names"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"}],"sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"},{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contacts server"}],"sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"},{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains reference to Sysinternals URL"}],"sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"},{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"suspicious","value":"Contains ability to use Microsoft's Enhanced Cryptographic Provider"},{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"},{"type":"malicious","value":"Makes HTTPS connections using an insecure TLS/SSL version"},{"type":"informative","value":"Uses HTTPS for communication"}],"sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"},{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","identifiers":[{"type":"malicious","value":"Application communicates with a malicious domain"}],"sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"suspicious","value":"Modifies Software Policy Settings"}],"sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"tactic":"Defense Evasion","technique":"Junk Code Insertion","attack_id":"T1027.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/016","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – Anomalous PE file structure"}],"sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to query security token membership for user discovery (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Calls an API typically used to send the specified request to the HTTP server"},{"type":"informative","value":"Calls an API typically used to to receive the response to a HTTP requests"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Found User Agent related strings"}],"sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"tactic":"Command and Control","technique":"Dead Drop Resolver","attack_id":"T1102.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1102/001","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Web Service","attack_id":"T1567","attack_id_wiki":"https://attack.mitre.org/techniques/T1567","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"},{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00004392.00000000.149586.009D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"Oid/\" (Indicator: \"Oid\"; Source: \"00000000-00004392.00000000.149586.014E2000.00000080.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"},{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.947700581511831","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"},{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"},{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004392-00000C29-1324950043\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"},{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"file.exe\" called \"GetForegroundWindow\" (UID: 00000000-00004392)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"},{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"file.exe\" called \"IsWow64Process\" with parameter \"4392\" - (UID: 00000000-00004392)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"},{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"file.exe\" called \"GetWindowTextA\" (UID: 00000000-00004392)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"},{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"file.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00004392)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"},{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$27","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"},{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"file.exe\" called \"GetVersionExA\" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004392)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"},{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"file.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"},{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"3024,,RtlGetVersion,NTDLL.dll,\"00:38:53.625\",RX=0,PX=0\" (Indicator: \"GetVersion\"; Source: \"00000000-00004392.00000000.149586.009D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"}]},{"level":"informative","category":"General","name":"An application crash occurred","description":"Report process \"WerFault.exe\" was created by \"svchost.exe\"\n Report process \"WerFault.exe\" was created by \"file.exe\"","origin":"Monitored Target","id":"target-2","sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$28","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"},{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$29","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"},{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"Found reference to API (Indicator: \"lstrcpy\"; File: \"file\")\n Found reference to API (Indicator: \"CryptExportKey\"; Source: \"00000000-00004392.00000000.149586.009D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"},{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"informative","category":"General","name":"Contains reference to Sysinternals URL","description":"Found string \"ess Monitor - Sysinternals: www.sysinternals.com\" (Indicator: \"www.sysinternals.com\"; Source: \"00000000-00004392.00000000.149586.009D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-262","sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"},{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"Local\\SM0:4392:168:WilStaging_02\"\n \"SM0:4392:168:WilStaging_02\"\n \"DBWinMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"},{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$2a","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"},{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"file.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 74CB0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"},{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"file.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 772A0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"},{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"file\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"},{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"file\" has an executable section named \"\"\n \"file\" has an executable section named \"zroyxpcd\"\n \"file\" has an executable section named \"chhltftk\"\n \"file\" has an executable section named \".taggant\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"},{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"file\" has an writable section named \"\"\n \"file\" has an writable section named \".rsrc\"\n \"file\" has an writable section named \".idata\"\n \"file\" has an writable section named \"zroyxpcd\"\n \"file\" has an writable section named \"chhltftk\"\n \"file\" has an writable section named \".taggant\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"},{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$2b","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"},{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \"zroyxpcd\" is \"0x199000\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"},{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \"\" is \"0x29c000\" greater than 0x100000\n Virtual size of \"zroyxpcd\" is \"0x199000\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"},{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"file.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"file.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"file.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"},{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"WerFault.exe\" with commandline \"-pss -s 440 -p 4392 -ip 4392\" (UID: 00000000-00003664)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 4392 -s 748\" (UID: 00000000-00003488)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 4392 -s 748\" (UID: 00000000-00003524)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"WerFault.exe\" with commandline \"-pss -s 440 -p 4392 -ip 4392\" (UID: 00000000-00003664)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 4392 -s 748\" (UID: 00000000-00003488)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 4392 -s 748\" (UID: 00000000-00003524)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"}]},{"level":"informative","category":"General","name":"The input sample possibly contains the RDTSCP instruction","description":"Found VM detection artifact \"RDTSCP trick\" in \"sample.bin\" (Offset: 98378)","origin":"Binary File","mitre_attack_id":"T1497","relevance":5,"id":"binary-26","sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"file\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"},{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"file.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$2c","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"},{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"file.exe\" queries basic process information of the \"C:\\file.exe\" (UID: 4392)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$2d","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"},{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"file.exe\" reads file \"c:\\windows\\syswow64\\ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"},{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to detect virtual environment\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: The input sample possibly contains the RDTSCP instruction","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"},{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"file.exe\" trying to touch file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"file.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\apphelp.dll\"\n \"file.exe\" trying to touch file \"C:\\file.exe\"\n \"file.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ntdll.dll\"\n \"file.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\kernel32.dll\"\n \"file.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \"file.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"file.exe\" trying to touch file \"C:\\Windows\\Temp\\VxSSL32.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"},{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"\"file.exe\" trying to access non-existent file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"file.exe\" trying to access non-existent file \"C:\\FLTLIB.DLL\"\n \"file.exe\" trying to access non-existent file \"C:\\CRYPTSP.DLL\"\n \"file.exe\" trying to access non-existent file \"C:\\WINMM.DLL\"\n \"file.exe\" trying to access non-existent file \"C:\\winmm.dll\"\n \"file.exe\" trying to access non-existent file \"C:\\WINMMBASE.DLL\"\n \"file.exe\" trying to access non-existent file \"C:\\WINMMBASE.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"},{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"2%.pt\"\n Heuristic match: \"r-.na\"\n Heuristic match: \"w5`.tl\"\n Heuristic match: \"\\di.sk\"\n Heuristic match: \"s.com\"\n Pattern match: \"www.sysinternals.com\"\n Pattern match: \"http://www.w3.org/2001/xmlschema-instance\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"},{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e\n Observed JA3 fingerprint: 1fc1c530fdab845a0a2b05d0b5335bcb\n Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"},{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to empty the recycle bin (API string)","description":"Found reference to API \"SHEmptyRecycleBinW\" (Indicator: \"EmptyRecycleBin\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-111","sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"},{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"file.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"file.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"15\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"},{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"file.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"},{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about operating system (API string)","description":"Found reference to API \"3024,,RtlGetVersion,NTDLL.dll,\"00:38:53.625\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00004392.00000000.149586.009D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Read system defined device setup information from registry","description":"\"file.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0000\"; Key: \"DRIVERDESC\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00004392.00000000.149586.009D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"file.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\"file.exe\" queried SystemProcessInformation at 00000000-00004392-00000C13-1323900139 [PID: 4392]\n \"file.exe\" queried SystemProcessInformation at 00000000-00004392-00000C13-1323908965 [PID: 4392]\n \"file.exe\" queried SystemProcessInformation at 00000000-00004392-00000C13-1324203008 [PID: 4392]\n \"file.exe\" queried SystemProcessInformation at 00000000-00004392-00000C13-1324212808 [PID: 4392]\n \"file.exe\" queried SystemProcessInformation at 00000000-00004392-00000C13-1324966038 [PID: 4392]\n \"file.exe\" queried SystemProcessInformation at 00000000-00004392-00000C13-1324974779 [PID: 4392]\n \"file.exe\" queried SystemProcessInformation at 00000000-00004392-00000C13-1325052276 [PID: 4392]\n \"file.exe\" queried SystemProcessInformation at 00000000-00004392-00000C13-1325061423 [PID: 4392]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"},{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"section contains high entropy","description":"\"file\" has section name with entropy \"7.9763421473\"\n \"file\" has section name zroyxpcd with entropy \"7.95320750593\"\n \"file\" has section name chhltftk with entropy \"6.19936285522\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Contains ability to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"CryptExportKey\" (Indicator: \"CryptExportKey\"; Source: \"00000000-00004392.00000000.149586.009D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":2,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to detect virtual environment","description":"\"file.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"SYSTEMBIOSVERSION\")\n \"file.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"VIDEOBIOSVERSION\")","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-87","sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"},{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate process encountered in a system snapshot","description":"\"file.exe\" called \"Process32FirstW with parameter [System Process]\" (UID: 00000000-00004392)\n \"file.exe\" called \"Process32NextW with parameter System\" (UID: 00000000-00004392)","origin":"API Call","mitre_attack_id":"T1057","relevance":5,"id":"api-104","sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"},{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"file\" claimed CRC 1887145 while the actual is CRC 1903448","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"},{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"file\" has an entrypoint in section \".taggant\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"},{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"malicious","category":"Environment Awareness","name":"Reads the system/video BIOS version","description":"\"file.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"SYSTEMBIOSVERSION\")\n \"file.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"VIDEOBIOSVERSION\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":9,"id":"registry-6","sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"},{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$2f","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to utilize the Windows bcrypt cryptographic API","description":"Found reference to API \"BCryptOpenAlgorithmProvider\" (Indicator: \"BCryptOpenAlgorithmProvider\"; Source: \"00000000-00005180-00000C2C-1166513001\")\n Found reference to API \"BCryptImportKeyPair\" (Indicator: \"BCryptImportKey\"; Source: \"00000000-00005180-00000C2C-1167335266\")\n Found reference to API \"BCryptDestroyKey\" (Indicator: \"BCryptDestroyKey\"; Source: \"00000000-00005180-00000C2C-1167336248\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-927","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$30","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00005180.00000000.137710.008C0000.00000004.mdmp, 00000000-00005180.00000001.138288.008C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00005180.00000001.138288.008C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$31","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"file/memory contains long string with (Indicator: \"youtube.com\"; Source: \"00000000-00005180.00000001.138288.03BB0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005180-00000C2C-1155531750\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00005180-00000C2C-1167226562\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00005180-00000C2C-1167226697\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00005180-00000C2C-1157833019\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00005180)\n \"07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00005180)\n \"07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe\" called \"Process32FirstW\" with parameters (UID: 00000000-00005180)\n \"07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe\" called \"Process32NextW\" with parameters (UID: 00000000-00005180)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00005180)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO Server Hello with Downgrade Request to TLS 1.1 or Lower\" (SID: 2071343, Rev: 1, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$32","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"52.16.171.153:443\"\n \"52.27.79.221:443\"\n \"34.229.166.50:443\"\n \"44.244.22.128:443\"\n \"3.238.30.69:443\"\n \"50.16.27.236:443\"\n \"23.60.136.72:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"info@diginotar.nl\"\n Pattern match: \"cps-requests@verisign.com\"\n Pattern match: \"premium-server@thawte.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"informative","category":"General","name":"Found User Agent related strings","description":"Found string \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36\" (Indicator: \"mozilla/5.0 (\"; Source: \"00000000-00005180.00000000.137710.008C0000.00000004.mdmp\")\n Found string \"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36\" (Indicator: \"mozilla/5.0 (\"; Source: \"00000000-00005180.00000001.138288.008C0000.00000004.mdmp\")\n Found string \"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36\" (Indicator: \"user-agent: \"; Source: \"00000000-00005180.00000001.138288.008C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"0c000d0038247170@WS2_32.dll\"\n \"0d000e0010946474@wshtcpip.DLL\"\n \"0e000f0000946474@wshtcpip.DLL\"\n \"0b000c00f4936474@wshtcpip.DLL\"\n \"09000a00e8936474@wshtcpip.DLL\"\n \"17001800d0936474@wshtcpip.DLL\"\n \"17001800b8936474@wshtcpip.DLL\"\n \"12001300a4936474@wshtcpip.DLL\"\n \"160017008c936474@wshtcpip.DLL\"\n \"1700180074936474@wshtcpip.DLL\"\n \"1200130060936474@wshtcpip.DLL\"\n \"120013004c936474@wshtcpip.DLL\"\n \"0800090040936474@wshtcpip.DLL\"\n \"0d000e0010946474@wship6.dll\"\n \"0e000f0000946474@wship6.dll\"\n \"0b000c00f4936474@wship6.dll\"\n \"09000a00e8936474@wship6.dll\"\n \"17001800d0936474@wship6.dll\"\n \"17001800b8936474@wship6.dll\"\n \"12001300a4936474@wship6.dll\"\n \"160017008c936474@wship6.dll\"\n \"1700180074936474@wship6.dll\"\n \"1200130060936474@wship6.dll\"\n \"120013004c936474@wship6.dll\"\n \"0800090040936474@wship6.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"atten-supporse.biz\"\n \"covery-mover.biz\"\n \"dare-curbys.biz\"\n \"dwell-exclaim.biz\"\n \"formy-spill.biz\"\n \"impend-differ.biz\"\n \"print-vexer.biz\"\n \"se-blurry.biz\"\n \"steamcommunity.com\"\n \"zinc-sneark.biz\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\system32\\bcryptprimitives.dll\" [Source: 00000000-00005180-00000C2B-1166153309]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"$33","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"informative","category":"General","name":"The input sample contains the RDTSCP instruction","description":"Found VM detection artifact \"RDTSCP trick\" in \"sample.bin\" (Offset: 98378)","origin":"Binary File","mitre_attack_id":"T1497","relevance":5,"id":"binary-26","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=DigiCert EV RSA CA G2, O=DigiCert Inc, C=US\" (SHA1: 41:3C:40:63:B9:78:68:32:EB:FA:54:6A:05:DA:00:4C:70:48:C6:F6; see report for more information)\n The input sample is signed with a certificate issued by \"CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US\" (SHA1: 09:0A:16:F9:BA:16:00:1B:2E:C1:30:F8:05:23:E5:B5:EB:25:91:58; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to send the specified request to the HTTP server","description":"$34","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-190","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to to receive the response to a HTTP requests","description":"\"07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"940ce8\"\n \"lpReserved\": \"0\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-191","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSASend\" (Indicator: \"WSASend\"; Source: \"00000000-00005180-00000C2C-1161470419\")\n Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; Source: \"00000000-00005180-00000C2C-1161470727\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"AUTHUI.DLL: Shutdown Choices Message Window\" (Indicator: \" shutdown \"; Source: \"00000000-00005180.00000000.137710.00F50000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"www.mail.google.com0\" [Source: 00000000-00005180.00000001.138288.008C0000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"2.5.29.35\"\n Potential IP \"127.0.0.1\" found in string \"ttp://127.0.0.1:\"\n Potential IP \"2.5.29.35\" found in string \"#2.5.29.35\"\n \"2.5.29.14\"\n \"2.5.29.17\"\n \"2.5.29.32\"\n \"2.5.29.15\"\n Potential IP \"2.5.29.37\" found in string \"%2.5.29.37\"\n \"2.5.29.31\"\n \"2.5.29.19\"\n \"2.5.29.4\"\n \"2.5.29.10\"\n \"2.5.29.1\"\n \"2.5.4.3\"\n \"2.5.29.16\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$35","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"T /profiles/76561199724331900 HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00005180.00000001.138288.008C0000.00000004.mdmp\")\n Found string \"HTTP/1.1 200 OK\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00005180.00000001.138288.03BB0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"atten-supporse.biz\" has high entropy\n Contacted domain: \"covery-mover.biz\" has high entropy\n Contacted domain: \"dare-curbys.biz\" has high entropy\n Contacted domain: \"dwell-exclaim.biz\" has high entropy\n Contacted domain: \"formy-spill.biz\" has high entropy\n Contacted domain: \"print-vexer.biz\" has high entropy\n Contacted domain: \"zinc-sneark.biz\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"52.16.171.153\" on port \"443\"\n HTTPS traffic to \"52.27.79.221\" on port \"443\"\n HTTPS traffic to \"34.229.166.50\" on port \"443\"\n HTTPS traffic to \"44.244.22.128\" on port \"443\"\n HTTPS traffic to \"3.238.30.69\" on port \"443\"\n HTTPS traffic to \"50.16.27.236\" on port \"443\"\n HTTPS traffic to \"23.60.136.72\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \":\\Windows\\system32\\kerberos.DLL\" (Indicator: \"kerberos\"; Source: \"00000000-00005180.00000000.137710.008C0000.00000004.mdmp, 00000000-00005180.00000001.138288.008C0000.00000004.mdmp\")\n Found string \"icrosoft Kerberos V1.0\" (Indicator: \"kerberos\"; Source: \"00000000-00005180.00000000.137710.008C0000.00000004.mdmp\")\n Found string \"Microsoft Kerberos V1.0\" (Indicator: \"kerberos\"; Source: \"00000000-00005180.00000000.137710.008C0000.00000004.mdmp\")\n Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00005180.00000000.137710.008C0000.00000004.mdmp\")\n Found string \"crosoft Kerberos V1.0\" (Indicator: \"kerberos\"; Source: \"00000000-00005180.00000001.138288.008C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"\"07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe\" called \"FindFirstFileW\" with parameter %APPDATA%\\Microsoft\\SystemCertificates\\My\\Certificates\\* (UID: 00000000-00005180)\n \"07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe\" called \"FindNextFileW\" with parameter .. (UID: 00000000-00005180)\n \"07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe\" called \"FindFirstFileW\" with parameter %APPDATA%\\Microsoft\\SystemCertificates\\My\\CRLs\\* (UID: 00000000-00005180)\n \"07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe\" called \"FindFirstFileW\" with parameter %APPDATA%\\Microsoft\\SystemCertificates\\My\\CTLs\\* (UID: 00000000-00005180)","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"Microsoft Enhanced RSA and AES Cryptographic Provider\" (Indicator: \"aes\"; Source: \"00000000-00005180.00000001.138288.008C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0000\"; Key: \"DRIVERDESC\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"informative","category":"System Destruction","name":"Able to permanently delete files from the Recycle Bin","description":"Found string \"SHEmptyRecycleBinW\" (File: \"07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-922","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$36","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"\"07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\LOCAL SETTINGS\\MUICACHE\\137\\52C64B7E\"; Key: \"LANGUAGELIST\"; Value: \"en-US\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"SHEmptyRecycleBinW\" (Source: 07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac, API is part of module: SHELL32.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac\" has section name with entropy \"7.976342147298525\"\n \"07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac\" has section name zroyxpcd with entropy \"7.953207505927057\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Sets the 'ThreadHideFromDebugger' thread data structure","description":"\"07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe\" is setting \"ThreadHideFromDebugger\" data for thread ID 0xfffffffe","origin":"API Call","mitre_attack_id":"T1622","relevance":10,"id":"api-84","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Tries to detect debugger using ProcessDebugPort","description":"\"07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac.exe queries ProcessDebugPort (UID: 5180)","origin":"API Call","mitre_attack_id":"T1622","relevance":5,"id":"api-238","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"14/24 Antivirus vendors marked sample as malicious (58% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 52.16.171.153 on port 443 is sent without HTTP header\n TCP traffic to 52.27.79.221 on port 443 is sent without HTTP header\n TCP traffic to 34.229.166.50 on port 443 is sent without HTTP header\n TCP traffic to 44.244.22.128 on port 443 is sent without HTTP header\n TCP traffic to 3.238.30.69 on port 443 is sent without HTTP header\n TCP traffic to 50.16.27.236 on port 443 is sent without HTTP header\n TCP traffic to 23.60.136.72 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – Anomalous PE file structure","description":"YARA signature for null IAT Directory of PE file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":1,"id":"yara-153","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found an instant messenger related domain","description":"\"login.skype.com0\" (Indicator: \"skype.com\")\n \"login.skype.com\" (Indicator: \"skype.com\")\n \"www.login.skype.com0\" (Indicator: \"skype.com\")","origin":"File/Memory","relevance":10,"id":"string-61","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$37","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"14/24 Antivirus vendors marked sample as malicious (58% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"malicious","category":"Network Related","name":"Application communicates with a malicious domain","description":"Contacted Domain: \"se-blurry.biz\" has been identified as malicious\n Contacted Domain: \"zinc-sneark.biz\" has been identified as malicious\n Contacted Domain: \"dwell-exclaim.biz\" has been identified as malicious\n Contacted Domain: \"dare-curbys.biz\" has been identified as malicious\n Contacted Domain: \"print-vexer.biz\" has been identified as malicious\n Contacted Domain: \"impend-differ.biz\" has been identified as malicious","origin":"Network Traffic","mitre_attack_id":"T1566","relevance":10,"id":"network-88","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"level":"malicious","category":"Network Related","name":"Makes HTTPS connections using an insecure TLS/SSL version","description":"Connection was made using TLSv1.0 [tls.handshake.version: 0x0301]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":10,"id":"network-53","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"},{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Queries process information"},{"detail":"Reads the system/video BIOS version"}],"sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"},{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Sets the 'ThreadHideFromDebugger' thread data structure"}],"sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"},{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 10 domains and 10 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]}]},"activity":{"stats":{"process_count":4,"spawned_processes_count":4,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":4,"imported_dlls_count":82,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":32,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":32,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":7,"dns_resolutions_count":10,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["evasive","credentialharvesting","commodity","lummastealer","criminal","informationstealer","malicious"],"sample_flags":["Sample Crashed","Network Traffic"],"sandbox_reports":[{"id":"6a797b530ef30e427f0daea4","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Themida.CX.gen","contacted_countries":["IRL","USA"],"submit_name":"07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac","analysis_start_time":"2026-08-10T07:18:44+00:00","indicators_count":{"informative":86,"suspicious":31,"malicious":7},"tags":["Network Traffic"],"is_in_unified_schema":true},{"id":"675810b6961d3168ae055e85","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":80,"submit_name":"file","analysis_start_time":"2024-12-10T09:58:15+00:00","indicators_count":{"informative":52,"suspicious":13,"malicious":2},"tags":["Sample Crashed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"52.16.171.153","port":443,"protocol":"TCP","country":"Ireland","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"address":"52.27.79.221","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"address":"34.229.166.50","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"address":"44.244.22.128","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"address":"3.238.30.69","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"address":"50.16.27.236","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"address":"23.60.136.72","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]}],"dns_resolutions":[{"domain":"atten-supporse.biz","ttl":900,"country":"-","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"domain":"covery-mover.biz","address":"44.244.22.128","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"domain":"dare-curbys.biz","address":"44.244.22.128","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"domain":"dwell-exclaim.biz","address":"34.229.166.50","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"domain":"formy-spill.biz","address":"52.27.79.221","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"domain":"impend-differ.biz","address":"50.16.27.236","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"domain":"print-vexer.biz","address":"3.238.30.69","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"domain":"se-blurry.biz","address":"52.16.171.153","ttl":300,"country":"Ireland","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"domain":"steamcommunity.com","address":"23.60.136.72","ttl":20,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"domain":"zinc-sneark.biz","address":"52.27.79.221","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"}],"processes":[{"pid":4392,"ppid":0,"name":"file.exe","command_line":"","sha256":"07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac","normalized_path":"C:\\file.exe","uid":"00000000-00004392","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":3488,"ppid":4392,"name":"WerFault.exe","command_line":"-u -p 4392 -s 748","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004392","uid":"00000000-00003488"},{"pid":3524,"ppid":4392,"name":"WerFault.exe","command_line":"-u -p 4392 -s 748","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004392","uid":"00000000-00003524"},{"pid":3664,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 440 -p 4392 -ip 4392","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00003664","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="}],"all_imported_dlls":["KernelBase.dll","SHCore.dll","shlwapi.dll","kernel32.dll","user32.dll","VxSSL32.dll","rpcrt4.dll","cryptsp.dll","ntdll.dll","winmmbase.dll","wow64cpu.dll","apphelp.dll","sspicli.dll","cryptbase.dll","fltLib.dll","advapi32.dll","msvcrt.dll","shell32.dll","ws2_32.dll","combase.dll","oleaut32.dll","profapi.dll","gdi32.dll","imm32.dll","winmm.dll","cfgmgr32.dll","windows.storage.dll","kernel.appcore.dll","ucrtbase.dll","gdi32full.dll","msvcp_win.dll","bcryptprimitives.dll","sechost.dll","win32u.dll","ole32.dll","powrprof.dll","wow64.dll","wow64win.dll","vcruntime140.dll","api-ms-win-crt-runtime-l1-1-0.dll","winhttp.dll","rasadhlp.dll","api-ms-win-core-synch-l1-2-0.dll","nsi.dll","usp10.dll","api-ms-win-core-file-l1-2-0.dll","crypt32.dll","webio.dll","credssp.dll","userenv.dll","msvcp140.dll","wship6.dll","FWPUCLNT.DLL","schannel.dll","api-ms-win-crt-filesystem-l1-1-0.dll","api-ms-win-crt-utility-l1-1-0.dll","api-ms-win-crt-heap-l1-1-0.dll","api-ms-win-crt-time-l1-1-0.dll","WSHTCPIP.DLL","msasn1.dll","mswsock.dll","api-ms-win-crt-string-l1-1-0.dll","api-ms-win-core-timezone-l1-1-0.dll","api-ms-win-core-localization-l1-2-0.dll","dnsapi.dll","winnsi.dll","bcrypt.dll","lpk.dll","secur32.dll","ncrypt.dll","api-ms-win-core-file-l2-1-0.dll","api-ms-win-crt-environment-l1-1-0.dll","rsaenh.dll","api-ms-win-crt-stdio-l1-1-0.dll","msctf.dll","wshqos.dll","gpapi.dll","api-ms-win-core-processthreads-l1-1-1.dll","api-ms-win-crt-convert-l1-1-0.dll","api-ms-win-crt-locale-l1-1-0.dll","api-ms-win-crt-math-l1-1-0.dll","IPHLPAPI.DLL"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"},{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\MY\\","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"Local\\SM0:4392:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"}]},{"name":"SM0:4392:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"}]},{"name":"DBWinMutex","sources":[{"report_type":"sandbox","report_id":"675810b6961d3168ae055e85"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"6a797b530ef30e427f0daea4"}]}]}},"report_ids":{"sandbox_job_ids":["6a797b530ef30e427f0daea4","675810b6961d3168ae055e85"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Ransom.Gunra.Generic Sample 07224a91d2fc… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 07224a91d2fc…. Malware family: Ransom.Gunra.Generic. Threat score 100/100. 15/25 AV engines flagged this file. 5 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac"}],["$","meta","4",{"property":"og:title","content":"Malicious Ransom.Gunra.Generic Sample 07224a91d2fc… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 07224a91d2fc…. Malware family: Ransom.Gunra.Generic. Threat score 100/100. 15/25 AV engines flagged this file. 5 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/07224a91d2fc05f6b417caaa70c22da0c49d553b0d68f36270f05990dc0eb2ac"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Ransom.Gunra.Generic Sample 07224a91d2fc… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 07224a91d2fc…. Malware family: Ransom.Gunra.Generic. Threat score 100/100. 15/25 AV engines flagged this file. 5 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L38","11",{}]]